Skills Discovery

Find community skills and plugins, evaluate quality and safety before use.

<whentouse>

• Searching for existing skills before building from scratch
• Evaluating community plugins for safety and quality
• Finding inspiration for skill design patterns
• Auditing plugins before installation

NOT for: creating new skills (use skills-dev), validating your own skills (use skills-dev)

</whentouse>

Discovery Workflow

1. Search — Find candidates via GitHub topics or code search
2. Filter — Apply quality heuristics to shortlist
3. Audit — Security review before installation
4. Adapt — Customize or extract patterns for your use

GitHub Discovery

Topic Pages

High-signal discovery starting points:

Code Search Patterns

Precise searches for specific artifacts:

# Find SKILL.md files in .claude/skills paths
filename:SKILL.md path:.claude/skills

# Find marketplace configurations
".claude-plugin/marketplace.json"

# Find plugin manifests
".claude-plugin/plugin.json"

# Find hook configurations
"PreToolUse" AND hooks

# Find skills with specific features
filename:SKILL.md "context: fork"
filename:SKILL.md "allowed-tools"
filename:SKILL.md "disable-model-invocation"

Recency Filters

Focus on actively maintained projects (adjust dates as needed):

# Updated in last 90 days (calculate: date -v-90d +%Y-%m-%d)
pushed:>YYYY-MM-DD

# Updated since plugins era (Oct 2025+)
pushed:>2025-10-01

Official Sources

Quality Heuristics

Real Usage Signals

Content Quality

Marketplaces

Security Audit

Threat Model

Installing skills/plugins = running code. Treat with same care as npm packages.

Audit Checklist

Before installing, review:

For Skills:

• Read SKILL.md frontmatter (allowed-tools, disable-model-invocation)
• Check for scripts/ directory — review any scripts
• Search for ! ` `` preprocessing commands
• Verify no secrets/credentials in files

For Plugins:

• Read .claude-plugin/plugin.json
• Check for hooks/ — review hook scripts
• Check for .mcp.json — review MCP endpoints
• Review all referenced skill SKILL.md files

For Hooks:

• Understand exit code semantics (0=allow, 2=block)
• Check for network calls in hook scripts
• Verify no data exfiltration patterns

Sandboxing

When running untrusted skills:

1. Restrict tools — Start with minimal allowed-tools, expand as needed
2. Isolate context — Use context: fork to limit blast radius
3. Block side effects — Add disable-model-invocation: true initially
4. Monitor first run — Watch tool calls on first execution

Safe First Run

# Test skill in restricted mode:
---
name: untrusted-skill-test
allowed-tools: Read, Grep, Glob  # read-only first
context: fork                     # isolated
disable-model-invocation: true   # explicit only
---

Expand permissions only after reviewing behavior.

Use Case Catalog

Common skill categories with examples (for inspiration, not endorsement):

Workflow Automation

Code Quality

Domain Skills

Safety & Guardrails

Context Management

Extraction Patterns

When you find a useful skill, extract patterns rather than copying wholesale:

1. Identify the pattern — What makes it work?
2. Adapt to your context — Match your conventions
3. Minimize scope — Take only what you need
4. Document provenance — Note where the pattern came from

<rules>

ALWAYS:

• Verify recency (prefer active projects)
• Review security surfaces before install
• Start with restricted permissions
• Document what you installed and why

NEVER:

• Blindly install from unknown sources
• Trust stars as quality signal
• Run obfuscated scripts
• Skip hook script review

</rules>

<references>

• [discovery-patterns.md](references/discovery-patterns.md) — Detailed GitHub search patterns
• [security-checklist.md](references/security-checklist.md) — Full audit checklist
• [use-cases.md](references/use-cases.md) — Extended use case catalog

</references>