39 plugins from public Claude Code marketplaces. Each one bundles skills, slash commands, agents, hooks or MCP servers that install together.
Showing 39 plugins that match these filters.
claude-code-plugins-plusjeremylongshore/tons-of-skills-marketplace4
agentii-investment-intelligenceagentii-ai/agentii-investment-intelligence1
trailofbitstrailofbits/skills1Submit the repo with .claude-plugin/marketplace.json and we list every plugin.
Submit marketplaceSAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening
14 bundled product skills with 19 Python tools: product-skills fork-orchestrator with continuous-discovery loop (deterministic 16-lane router, Torres cadence tracker, OST linter, /cs-product + /cs-grill-product + /cs-product-loop), product manager toolkit (RICE, PRDs), product strategist, UX researcher, UI design system, competitive teardown, landing page generator, SaaS scaffolder, product analytics, experiment designer, product discovery, roadmap communicator, spec-to-repo, design-qa (UI finish gate: inert controls, missing states, rendered WCAG 2.2 checks). Companion standalone plugins: agile-product-owner, code-to-prd, apple-hig-expert, research-summarizer, design-qa.
Build, launch, grade, and schedule Claude Managed Agents (CMA) in your own Anthropic account — a plugin re-implementation of Anthropic's launch-your-agent reference skill (Apache-2.0; independent, not a fork). Every session starts with a goal (./my-agent/goal.json, opt-in SessionStart hook, driven by /cs-goal); loop_compiler.py compiles it into a bounded grade->iterate loop (max_iterations 1..20), a recurring cron scheduled-deployment loop, or a single-pass interview->stage->launch workflow. 6 skills: orchestrator (context: fork goal router) + interview + stage-launch + grade-iterate + run-without-you + wrap-up. 18 stdlib-only deterministic scaffolders (no network/API calls; live launches emitted as BYOK curl that never prints the key), 4 agents, 8 commands, hooks, 5 references, 4 assets. Validators enforce CMA limits. Distinct from engineering/agent-harness (generic domain loop) and write-a-skill (authors Claude Code skills, not CMAs).
Complete fullstack development toolkit: React, Express/FastAPI, PostgreSQL scaffolding with AI agents
25-skill pentest pack with engagement governance, network/code/dependency scans, OWASP Top 10 mapping, and exec-readable reporting. Heavy-hitter compliant; chain-of-custody attestable.
Database query optimization, cloud cost optimization, and scalability improvements
Ship a new language without the usual breakage. Three deterministic stdlib scripts: a translation-file checker for JSON/ARB (i18next, ICU), .properties, .strings, Android strings.xml and gettext .po that blocks on missing keys, renamed placeholders, ICU syntax errors, plural/select without other, zero branches that never match and plural categories the target locale needs, from the embedded Unicode CLDR 49 table (ru few/many, ar six forms); a hardcoded-string scanner for React, Vue, Svelte and HTML that flags text and user-facing attributes outside t(), concatenated translations, locale-less toLocaleString and '$' + amount; and a pseudo-locale generator (en-XA accented and expanded, ar-XB right-to-left) that keeps placeholders and ICU syntax intact. Ships cs-i18n-engineer agent, /cs-i18n-check and /cs-pseudo-locale commands and 3 cited references.
Turn a tangled working tree into a clean, reviewable commit series. Three deterministic stdlib scripts over git: a series planner that groups changes into commits in build-safe order (manifest with lockfile, pure moves, formatting, each module's change with its tests, docs, CI), holds back .env and key files, and flags mixed formatting and moves whose callers would break; a secret gate that scans staged or pushed lines for provider tokens, high-entropy secrets, sensitive files and conflict markers and blocks before the commit exists, with redacted output and reasoned waivers; and a message linter that blocks vague subjects, missing why on large changes and pending fixup commits, matching the repo's own convention. Ships pre-commit, commit-msg and pre-push hooks, cs-commit-craft agent, /cs-commit-craft and /cs-commit-check commands and 3 cited references.
Company Architect: builds a business from scratch as an OKF (Open Knowledge Format) bundle — a tree of versionable .md files with a frontmatter type, links forming a graph, and reserved index.md/log.md, readable by humans and agents alike. Guides the founder through a 12-phase interview (foundation, strategy, market, financial, sales, marketing, product, operations, tech, people, legal, governance), one phase at a time, and generates conformant markdown concepts. 3 stdlib tools: scaffold_bundle (bundle scaffold), okf_linter (validates type/reserved files/links), index_generator (regenerates the index.md files). Standalone-installable; also bundled in c-level-skills. In English.
Workflow-builder skill: design and write deterministic multi-agent workflow scripts (.js files in .claude/workflows/) for Claude Code's Workflow tool (CLAUDE_CODE_WORKFLOWS=1, /workflows). Every session opens with an intake question set; when the user is vague, a stdlib recommendation engine infers and proposes a topology with rationale instead of stalling. Ships 3 stdlib Python tools (intake recommendation engine, .js validator enforcing pure-literal-meta / no-non-determinism / guarded-loop / parallel-thunk rules, topology scaffolder), 3 references citing 7-8 authoritative sources each (API surface, orchestration patterns, decision + intake guide), templates + a runnable example, cs-workflow-architect persona agent + /cs-workflow-build slash command. Use when building, scaffolding, or running a custom Claude Code workflow or orchestrating sub-agents (fan-out, pipeline, loop, judge-panel).
Turn any domain folder of skills into a bounded agentic loop: a manifest builder inventories a domain's skills/tools/checks, a goal compiler turns a goal into a verifiable task plan (refusing vague goals with forcing questions), and a JSON-backed loop controller drives execute->verify->close with retry caps, controller-run verification (no verification theater), human escalation on exhausted budgets, and a close gate that refuses while any task is unverified or unwaived. Ships 3 stdlib Python tools, 18 committed per-domain harness manifests + JSON schema, 3 references citing the 2024-2026 agent-harness canon (Anthropic long-running harnesses, verifier's law, SWE-agent, Ralph loop, Cognition), harness-runner agent + /cs-harness command. Use when an agent or subagent should pick up a goal, define its tasks, complete and verify them, and close the loop.
GTD weekly-review loop. Scans the workspace for open loops (unchecked boxes, TODO/FIXME, stale files), walks the three-phase GET CLEAR / GET CURRENT / GET CREATIVE checklist with a refusal gate (review is never COMPLETE while a mandatory GET CURRENT step is missing), and audits commitments for stalled / no-next-action / someday candidates with a 0-100 health score. Fills the periodic-review gap from audit/productivity-2026-07.
Patent prior-art + IP landscape skill. FTO/novelty/family-resolver via 3-pass Jaccard heuristic. Research-pack convention. Path-B from megaprompt 12.
Docs-anchored grilling session — interrogates a plan against the project's existing language (CONTEXT.md) and recorded decisions (docs/adr/), updating those files inline as terminology and decisions crystallise. Derived from Matt Pocock's MIT-licensed grill-with-docs with stdlib validators (CONTEXT.md linter, ADR scanner, glossary-code consistency), reference docs, cs-grill-with-docs agent, and /cs-grill-with-docs command.
Dependency auditing, version management, and security vulnerability scanning
SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation
9 equity-research dimension skills with ~48 addressable sub-prompt modes: recent-quarter performance, business-model analysis, competitive landscape, growth strategy, secular tech trends, turnaround analysis, risk analysis, earnings sentiment, and valuation methods.
Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.
A11y compliance testing with WCAG 2.1/2.2 validation, screen reader compatibility, and automated accessibility audits
Configure auto-scaling policies for applications and infrastructure
