Anthropic’s official Claude Code plugin directory climbs GitHub — but “official” isn’t a safety guarantee

#Claude Code’s official plugin hub is now a GitHub heavyweight

The anthropics/claude-plugins-official repository has quietly become the center of the Claude Code ecosystem. With around 38,000 stars and 4,300 forks, it is the marketplace that

```text
/plugin install name@claude-plugins-official
```

resolves against. Anthropic describes it as an “official, Anthropic-managed directory of high quality Claude Code Plugins”, licensed under Apache‑2.0.

The layout is deliberately simple:

• /plugins – internal plugins developed and maintained by Anthropic
• /external_plugins – third‑party plugins from partners and the community
• /plugins/example-plugin – a reference implementation to copy from

Plugins are installed either with the slash command above or via /plugin → Discover inside Claude Code. The catalog itself lives in the two folders and the Discover UI; the README only calls out the example plugin.

#Naming rules and skill‑only bundles

Every plugin follows a standard layout, but only the manifest is required. One rule matters a lot for anyone publishing:

• The name field is an immutable slug. Once published, it must never change, or existing installs will fail with plugin-not-found.
• To change what users see in the UI, you edit displayName instead.
• If a rename is truly unavoidable, you must add an entry to the renames map in .claude-plugin/marketplace.json so the loader transparently migrates users from the old slug to the new one on the next sync.

The directory also supports skill bundles without a plugin.json. In that case, the marketplace entry sets strict: false and provides an explicit skills array. Each path is relative to source.path and points to a directory containing a SKILL.md. Skills are then registered as <plugin-name>:<skill-name> in Claude Code.

For SDK authors with existing skills scattered across a repo, this avoids creating a separate plugin repository while still letting you pin a commit for reproducible installs.

#The security warning, spelled out

The most important part of the README is a short, blunt warning:

“Make sure you trust a plugin before installing, updating, or using it. Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change.”

In practice, that’s three distinct risks:

• Content risk – plugins can ship commands, skills and MCP servers that run code on your machine and steer your agents.
• Behavior risk – Anthropic does not promise a plugin does what its description claims.
• Change risk – a later update can introduce new behavior after you have already approved the plugin.

Defensive habits the repo itself implicitly encourages:

• Prefer plugins under /plugins (maintained by Anthropic) over /external_plugins when both solve your problem.
• Pin versions or commits where the tooling allows it.
• Review .mcp.json in the source repo to see which commands and servers are wired in.
• Run agents with limited permissions and, ideally, in sandboxed environments.

The GitHub star count mainly tells you the directory is widely bookmarked. It does not measure plugin quality. More useful signals live in the entries themselves: who maintains the plugin, how recently it was updated, whether dependencies are pinned, and whether its MCP servers are open source.

Finally, the @claude-plugins-official suffix on the install command identifies the marketplace, not a trust level. Claude Code supports multiple marketplaces; the suffix prevents name collisions when two marketplaces offer plugins with the same name. Community collections like ECC and Superpowers run their own marketplaces alongside this one, and the same trust questions apply there as well.

Source: Anthropic, Gündəm · explainx.ai