Find plugins

by Michael Dohmen

Build a small internal tool that ships as one self-contained HTML file — no server, no install, no database.

by Tamás Gábor

Select and run bounded multi-agent strategies with durable artifacts, explicit models, typed review gates, and safe recovery.

by fixture

Source fixture for the configure generator golden tests.

by fixture

Source fixture for the configure generator golden tests.

by Manuel Michael Retamozo García

Spec-Driven Development workflow for VS Code Agent Customization with OpenSpec, strict TDD, phase agents, skills, hooks, and verification contracts.

by voitta-ai

Measure a repo's conversion rate (maintainer share of merges, outside PRs waiting, unreleased commits, bot-only reviews) before choosing patch vs issue; write the issue as a spec with reproduction, mechanism, one-PR ask and a kill condition; cross-link duplicates; close your superseded PR with a pointer.

by OTelux contributors

Investigate local OpenTelemetry traces, logs, metrics, errors, and latency with OTelux.

by chock-core

Keep an agent's objective under the operator's control when the agent ingests untrusted content. Separate retrieved data from instructions, refuse tool-scope expansion requested by that data, and confirm sensitive actions against the raw action rather than a summary. Use when building RAG pipelines, email/ticket/doc readers, browser agents, or any planner whose context includes fetched content. Do NOT use for the coding agent's own session hygiene — that is `injection-defense`.

by chock-core

Constrain what an agent's legitimate tools can be made to do. Grant least agency per task, validate tool parameters at the runtime boundary, authorise every invocation rather than only the first, and distrust tool metadata from unverified registries. Use when defining tool schemas, wiring an MCP server, granting shell or cloud-CLI access, or reviewing a tool-calling loop. Do NOT use for the credentials the tool authenticates with — that is `owasp-asi03-identity-privilege-abuse`.

by chock-core

Give each agent its own scoped, short-lived identity so a compromise does not inherit a human's or a shared account's full permissions. Use when an agent needs credentials, a service account, a cloud role, an API token, or when reviewing delegation and impersonation between an agent and its user. Do NOT use for keeping secrets out of the repository — that is `code-safety` and `scan-secrets`.

by chock-core

Verify agent components before loading them, and keep verifying, because runtime tool discovery changes the supply chain after deployment. Use when adding an MCP server, agent framework, plugin, tool registry, or model artifact, and when reviewing what an agent may pull at runtime. Do NOT use for ordinary application dependencies already covered by `verify-dependency-exists`.

by chock-core

Contain code an agent generates or is induced to run. Execute in a sandboxed container with least privilege and deny-by-default egress, prefer parameterised APIs over raw shell, and treat any string reaching a subprocess or interpreter as attacker-controlled. Use when adding a code interpreter, shell tool, subprocess call, or eval-style API to an agent. Do NOT use for eval/exec appearing in ordinary application code — that is `code-safety`.

by chock-core

Stop untrusted content from being written into an agent's durable memory or retrieval index, where it silently steers behaviour in later sessions. Keep context ephemeral by default, validate and attribute every memory write, scope memory per user and per task, and let operators inspect and flush it. Use when adding long-term memory, a vector index, session summarisation, or user preference storage. Do NOT use for the coding agent's own memory files — that is `memory-discipline`.

by chock-core

Authenticate and integrity-protect the channels agents use to talk to each other, so a peer cannot be impersonated, a message tampered with, or a fake agent registered in discovery. Use when building multi-agent orchestration, agent-to-agent protocols, delegation between agents, message buses, or agent discovery services. Do NOT use for a single agent calling ordinary tools — that is `owasp-asi02-tool-misuse`.

by chock-core

Keep one agent's bad output from propagating through everything downstream. Isolate blast radius per agent and per environment, separate development from production access, validate agent-to-agent handoffs, and add circuit breakers that halt automation on behavioural deviation. Use when chaining agents, designing orchestration, granting production access, or wiring agent output into downstream automation. Do NOT use for the transport security of those handoffs — that is `owasp-asi07-insecure-inter-agent-communication`.

by chock-core

Stop an agent from controlling the information a human approves against. Show the raw action rather than a model-authored summary at every confirmation step, forbid persuasive framing in sensitive workflows, and keep an immutable record of what was presented versus what executed. Use when designing approval prompts, human-in-the-loop checkpoints, agent-written PR descriptions, or consent and disclosure flows. Do NOT use for what the agent is permitted to do once approved — that is `owasp-asi02-tool-misuse`.

by chock-core

Make an agent that has drifted, been compromised, or was never inventoried detectable and stoppable. Require an owner, expiry, and inventory entry for every agent, sandbox by default, baseline behaviour and alert on deviation, and keep a tested kill switch. Use when deploying a long-running or autonomous agent, allowing sub-agent spawning, or reviewing agent lifecycle and monitoring. Do NOT use for a single hijacked request within a supervised session — that is `owasp-asi01-agent-goal-hijack`.

by chock-core

Warns (observe rollout) when a change adds or edits code that runs at install or build time: npm install/prepare/pack scripts, gypfile without native sources, bin shadowing, unpinned git/URL deps; setup.py cmdclass and import-time calls, .pth imports, conftest, pyproject build hooks; build.rs and build-deps; go:generate; MSBuild Exec; gemspec, extconf, Podfile, Composer, Maven, Gradle exec. Never refuses yet; judges file text, not what a hook runs. Friction, not a security boundary.

by voitta-ai

Avoid duplicating, superseding, or clobbering work done by another agent session on the same repos: the three collision shapes, the pre-flight check for each, and how to reconcile without losing the better version. Also covers the collision that no artifact check can catch -- two sessions both about to do the same work, with nothing pushed for `gh pr list` to find -- detected by enumerating live peer sessions and asking directly, then split into named lanes with an explicit gate and the decision routed through the shared human. v1.2.0 moves the peer check earlier still: to the first act that CLAIMS shared state -- git worktree add / checkout -b -- because two sessions given the same issue derive the same branch name by default, and a live drill showed both colliding there an hour before either noticed. Adds the rule that you never `git add -A` in a tree you do not exclusively own (that is how one session's commit silently absorbed another's work under a wrong message), and how to read a peer's silence from its ListAgents state, where `waiting` means blocked on user input and your message will not be processed until a human interacts.

by ParaQualis LLC

Life-sciences regulatory & computer-system-validation toolkit for Claude Code — GAMP 5, 21 CFR Part 11, EU GMP Annex 11, the live eCFR, openFDA, and an IQ/OQ/PQ qualification engine (/qualify:build, /qualify:requirements, /qualify:review). Commands, skills, sub-agents, and a document-protection hook. Run /openfda:setup once to provision a free personal openFDA API key (one minute, raises rate limits ~1,000 → ~120,000 requests/day).

by Local developer

Scaffold, assess, and harden repos for Codex-heavy development with agent instructions, project-local .codex skills, advisory trajectory-risk supervision, explicit project-scoped subagent orchestration, skill compliance, agent failure introspection, pre-edit investigation gates, click-path browser QA, research-first changes, OpenSpec SDD, feature state, WIP control, session continuity, initialization readiness, termination evidence, sprint contracts, UI setup, clean TypeScript practices, TDD/e2e workflows, local debugging, docs, scripts, quality gates, runtime support, review, security, lifecycle, and cleanup loops.

by voitta-ai

Diagnose WHICH permission gate refused a command when two are active, and why a standing allow rule did not stop it: the opt-in autoMode.classifyAllShell (default false) suspends every Bash/PowerShell allow rule while auto mode is active, while outside auto mode the same rule applies and bypasses PreToolUse hooks entirely

by voitta-ai

Audit what a service actually auto-runs when it reuses a permission gate built for an interactive terminal. The gate reads a human's editor settings, so an agent or bot driven by other people's input inherits that human's personal allow-list -- measured on one deployment: 123 Bash() patterns, including gh pr merge, gh api and codex exec, auto-running with no approval card. Use when a command you expected to need approval ran without one, when a verdict says "matches user allow pattern", when wiring such a gate into a service, or when a suite's verdicts change with whose machine runs it. Covers locating the discovery paths, measuring and proving the surface with the gate's own verdicts, cutting the inheritance off upstream rather than around it, and asserting at boot that it stayed cut.

by voitta-ai

Audit and clean up personal `~/.claude/skills/` copies that duplicate or shadow skills a plugin bundle also ships, so sessions stop silently running stale versions. Use when: (1) a skill you know was updated upstream behaves like an old version (e.g. it ran at 4.0.0 while the installed bundle ships 4.1.0), (2) you are asked "can I just delete the local copy?" of a skill that also exists in a plugin, (3) `~/.claude/skills/` has accumulated copies of skills that later moved into a plugin bundle, (4) a skill appears in the session's skill list bare (no `plugin:` prefix) and you need to know which file on disk that actually is, (5) after installing or updating a bundle plugin you want to retire the loose per-skill installs it replaced. Key trap: `~/.claude/plugins/marketplaces/<mkt>/` is the fetched marketplace source, NOT loaded — only plugins present under `~/.claude/plugins/cache/` serve skills, and a bundle can turn out not installed at all, leaving the personal copies as the sole (stale) provider. Covers the audit commands (version drift table, two-way content diff against the cache copy), the delete / keep decision tree (byte-identical, version-behind with superseded wording, genuine unpushed fork), and the tar backup before any rm.