# Review a Claude Code plugin

Source URL:
Author:
Commit or release:
License:
Supported client/version:

1. Read the plugin manifest and the exact pinned source.
2. List skills, commands, agents, MCP servers and hooks separately.
3. Inspect hook commands and installation scripts without running them.
4. Record network destinations, environment variables and requested permissions.
5. Reject unexplained secret access, destructive commands or untrusted downloads.
6. Test the approved component in a disposable project with no production credentials.
7. Record installation and removal steps from the source documentation.
8. Keep the source version and review result. A newer release needs another review.

Do not treat a marketplace listing, download count or this checklist as a security guarantee.