Skills Plugin Structure
📦

Plugin Structure

v0.1.0 Content revision r1 Safe ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build Claude Code Plugin Structures

Plugin authors need a reliable structure before adding commands, agents, skills, hooks, or MCP servers. This skill explains the expected layout, manifest fields, naming rules, and portable path patterns.

Supports: Claude Codex Code(CC)
🥈 80 Silver

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "Plugin Structure" from https://skillstore.io/skills/plugin-structure.md and its manifest at https://skillstore.io/api/skills/plugin-structure/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/plugin-structure.md Signed manifest GET /api/skills/plugin-structure/manifest Signed lockfile GET /api/skills/plugin-structure/lockfile

Test it

Using "Plugin Structure". Create a minimal plugin for a hello command.

Expected outcome:

  • A concise directory plan with the manifest under .claude-plugin.
  • A commands directory containing one markdown command file.
  • Notes explaining why no agents, hooks, or MCP files are needed.

Using "Plugin Structure". Review a plugin layout that mixes files under .claude-plugin.

Expected outcome:

  • A list of misplaced component directories.
  • A corrected layout that keeps components at the plugin root.
  • Guidance on when custom paths should be declared in the manifest.

Using "Plugin Structure". Plan a team plugin with commands, agents, skills, and hooks.

Expected outcome:

  • A structured architecture grouped by component type and purpose.
  • Naming guidance for related commands, agents, and skills.
  • Security review notes for hook commands and external integrations.

Security Audit

Safe
v9 • 7/20/2026 Open versioned report

All 218 static findings are false positives caused by Markdown syntax, code fences, documentation examples, and configuration placeholders. The skill provides structural guidance only; no evidence of prompt injection, credential exfiltration, hidden execution, or malicious intent was found.

7
Files scanned
3,146
Lines analyzed
0
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (50)
examples/advanced-plugin.md:198 examples/advanced-plugin.md:204 examples/advanced-plugin.md:285-286 examples/advanced-plugin.md:286-287 examples/advanced-plugin.md:287-292 examples/advanced-plugin.md:292 examples/advanced-plugin.md:295 examples/advanced-plugin.md:300 examples/advanced-plugin.md:307 examples/advanced-plugin.md:383 examples/advanced-plugin.md:389 examples/advanced-plugin.md:396 examples/advanced-plugin.md:399 examples/advanced-plugin.md:428 examples/advanced-plugin.md:436 examples/advanced-plugin.md:444 examples/advanced-plugin.md:458 examples/advanced-plugin.md:468-473 examples/advanced-plugin.md:473 examples/advanced-plugin.md:478-483 examples/advanced-plugin.md:483 examples/advanced-plugin.md:490 examples/advanced-plugin.md:494 examples/advanced-plugin.md:497 examples/advanced-plugin.md:500 examples/advanced-plugin.md:503 examples/advanced-plugin.md:506 examples/advanced-plugin.md:518 examples/advanced-plugin.md:526 examples/advanced-plugin.md:531 examples/advanced-plugin.md:545 examples/advanced-plugin.md:567 examples/advanced-plugin.md:586 examples/advanced-plugin.md:593 examples/advanced-plugin.md:595 examples/advanced-plugin.md:598 examples/advanced-plugin.md:600 examples/advanced-plugin.md:603 examples/advanced-plugin.md:605 examples/advanced-plugin.md:610-611 examples/advanced-plugin.md:611-612 examples/advanced-plugin.md:612-617 examples/advanced-plugin.md:617-618 examples/advanced-plugin.md:618-619 examples/advanced-plugin.md:619-624 examples/advanced-plugin.md:624 examples/advanced-plugin.md:626 examples/advanced-plugin.md:498 examples/standard-plugin.md:80 examples/standard-plugin.md:82
🌐 Network access (17)
examples/advanced-plugin.md:113 examples/advanced-plugin.md:115 examples/advanced-plugin.md:118 examples/standard-plugin.md:50 examples/standard-plugin.md:51 references/manifest-reference.md:97 references/manifest-reference.md:105 references/manifest-reference.md:143 references/manifest-reference.md:152 references/manifest-reference.md:476 references/manifest-reference.md:477 references/manifest-reference.md:495 references/manifest-reference.md:497 references/manifest-reference.md:500 SKILL.md:74 SKILL.md:76 SKILL.md:77
📁 Filesystem access (8)
examples/advanced-plugin.md:141 references/manifest-reference.md:340 references/manifest-reference.md:349 references/manifest-reference.md:301 references/manifest-reference.md:308 references/manifest-reference.md:361 references/manifest-reference.md:517 SKILL.md:96
🔑 Env variables (3)
examples/advanced-plugin.md:170 references/manifest-reference.md:320 SKILL.md:247
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/plugin-structure/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/plugin-structure/security.svg)](https://skillstore.io/skills/plugin-structure?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/plugin-structure?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/plugin-structure/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/plugin-structure.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

anthropics. (2026). Plugin Structure security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/plugin-structure/audits/9

BibTeX citation

@techreport{anthropics-plugin-structure-2026, author = {anthropics}, title = {Plugin Structure security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/plugin-structure/audits/9}, note = {Author version 0.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "Plugin Structure security audit report (audit version 9)" version: "0.1.0" type: report authors: - name: "anthropics" date-released: "2026-07-20" url: "https://skillstore.io/skills/plugin-structure/audits/9" identifiers: - type: other value: "skillstore:plugin-structure:audit:9" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
anthropics Recommended Current

plugin-structure

Skillstore Score 80
Evidence Confidence High
Skillstore usage 10
Updated

2026-08-21

anthropics

anthropics-plugin-structure

Skillstore Score 80
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

davila7

davila7-plugin-structure

Skillstore Score 79
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
100
Maintainability
87
Content
77
Community
74
Spec Compliance

What You Can Build

Scaffold a New Plugin

Create a clean plugin directory with a manifest and only the component folders needed for the first release.

Review Plugin Organization

Check whether commands, agents, skills, hooks, and MCP server files follow expected discovery and naming rules.

Document Team Plugin Standards

Convert plugin architecture rules into simple guidance for teams that maintain shared developer automation.

Try These Prompts

Plan a Simple Plugin 
Design a minimal Claude Code plugin named <plugin-name> with one command. Include the required folders and explain each file.
Add Components 
Extend my plugin plan with commands, agents, and skills. Keep default discovery paths unless a custom path is necessary.
Review Manifest Paths 
Review this plugin manifest plan for path issues, naming issues, and missing metadata. Suggest corrections without adding extra features.
Design Advanced Layout 
Create an advanced Claude Code plugin architecture for <workflow>. Include component boundaries, safe path conventions, and review notes.

Best Practices

  • Start with default discovery directories before adding custom manifest paths.
  • Use kebab-case names that describe each component purpose clearly.
  • Use CLAUDE_PLUGIN_ROOT for plugin-owned files instead of hardcoded local paths.

Avoid

  • Putting commands, agents, skills, or hooks inside the .claude-plugin directory.
  • Using parent directory traversal or absolute paths in manifest component fields.
  • Adding hooks or MCP servers before documenting their runtime dependencies and permissions.

Frequently Asked Questions

What does this skill help me create?
It helps plan and organize Claude Code plugins with clear manifests and component directories.
Does it create plugin files automatically?
It provides structure guidance and examples. File creation depends on the agent and user request.
Which tools are supported?
The report lists Claude, Codex, and Claude Code as supported tools.
Can custom component paths replace default folders?
No. The skill explains that custom paths supplement default discovery folders.
Does it cover hooks and MCP servers?
Yes. It documents their expected locations, manifest references, and portable path patterns.
What should I review before publishing a plugin?
Review hook commands, MCP environment variables, custom paths, dependencies, and component names before publishing.

Developer Details

Author

anthropics

License

MIT

Author version

v0.1.0

Skillstore revision

r1

Repository

https://github.com/anthropics/claude-code/tree/main/plugins/plugin-dev/skills/plugin-structure

Ref

dbe0e719813583400773166a0621f8a9b8185c72

Maintenance freshness

7/18/2026

Usage

6 downloads · 679 views

File structure

📁 examples/

📄 advanced-plugin.md

📄 minimal-plugin.md

📄 standard-plugin.md

📄 README.md

📁 references/

📄 component-patterns.md

📄 manifest-reference.md

📄 SKILL.md

More from anthropics

View all

Related Skills

View all