Claude Plugins — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Plugins (Plugin) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Opinionated Claude Code plugins by Sasha Marchuk — tooling for ticket management, automation, multi-agent rigor, data analysis, and account migration. Free, MIT-licensed, and open to contributions.
In Claude Code:
/plugin marketplace add SashaMarchuk/claude-plugins
/plugin install clickup@sashamarchuk-plugins
/plugin install g-event@sashamarchuk-plugins
/plugin install ultra@sashamarchuk-plugins
/plugin install ultra-analyzer@sashamarchuk-plugins
/plugin install claude-migrate@sashamarchuk-plugins
/plugin install find-call@sashamarchuk-plugins
/plugin install log-time@sashamarchuk-plugins
/reload-pluginsMarketplace name vs. GitHub source:SashaMarchuk/claude-plugins(GitHubowner/repo) is what you pass tomarketplace addto fetch the manifest.sashamarchuk-pluginsis the marketplace's declared name insidemarketplace.json— that's the suffix you use onplugin install. Anthropic's plugin-manifest validator rejects marketplace names that start withclaude-oranthropic-(reserved for official), hence the rename.
ultra-analyzer and claude-migrate both declare ultra as a dependency, so they pull ultra in automatically on Claude Code v2.1.110+; on older versions the explicit install lines above fetch it. claude-migrate (beta) additionally uses a local Node + Playwright runtime, but only for its byte-exact copy-page verification step. clickup and g-event are independent but share ~/.claude/shared/identity.json for user + teammate data — onboard either one first and the other inherits the roster. find-call (beta) is a read-only consumer of that same file: it never writes it, so it has no onboarding of its own — onboard clickup or g-event once and find-call inherits your profile + roster automatically (and works with limited name-resolution even if you skip onboarding). log-time (beta) is also a read-only consumer of the identity file, has its own onboarding (/log-time:onboard), and pairs especially well with find-call plus a connected calendar — call evidence is the strongest time signal it can gather.
| Plugin | What it does |
|---|---|
| clickup | /clickup:create / :onboard / :connect / :status / :workspace / :memory — create and manage ClickUp tickets with enforced Connextra user stories, fuzzy list aliases, teammate auto-resolution, duplicate detection, and a two-step onboarding wizard (identity + workspace). Works over any ClickUp transport — the ClickUp MCP, the clickup-cli binary, or the raw REST API — through one configurable connection layer: first use investigates what's available, asks which transport to use, and remembers the choice (/clickup:connect); nothing about the transport is hardcoded. |
| g-event | /g-event:schedule / :onboard / :status / :calendar — create/update/cancel Google Calendar events with Google Meet. Always attaches a configurable notes bot, conflict + past-time guards, two-step onboarding (identity + calendar defaults). Shares the teammate roster with clickup. |
| ultra | /ultra:run / :resume — multi-agent swarm with adversarial validation, structured debates, devil's advocate, and anti-AI-slop checks. Tiers --small / --medium / --large / --xl; wraps other skills for maximum-rigor runs. |
| ultra-analyzer (beta) | /ultra-analyzer skill set — rigorous data/corpus pipeline (discover → analyze → validate → synthesize) with resume-able state and /ultra gates at critical boundaries. Source-agnostic: MongoDB, filesystem, PDF, web scrapes, JSON/CSV, SQLite. Requires the `ultra` plugin. |
| claude-migrate (beta) | /claude-migrate:init / :run / :resume / :progress / :verify — move your chats and projects from one Claude.ai account to another. Parse a data export (or extract live in a browser) → cheap-model value scan → you confirm what migrates → distill each kept chat into one paste-ready first message → re-create projects and seed chats. Always builds a byte-exact, self-contained copy page (the zero-tooling floor); when a pre-authenticated browser is reachable it also runs confirmation-gated automation (seed → await OK → rename → strip). Resume-able state machine with /ultra gates. Requires the `ultra` plugin + local Node/Playwright. |
| find-call (beta) | /find-call <call> / :config / :status — pull deep, cited context from a past Google Calendar meeting. Searches Calendar + optional transcripts (Sembly or any connected notetaker) in parallel, reads the notes-bot "Meeting Resources" block (Transcription, Meeting Notes, Video, Parent Folder), disambiguates matches, and spawns sonnet sub-agents per call for transcript-depth. Uses whatever tools are available by default; set a preferred provider per source with :config (always with fallback — data is retrieved by any working method), inspect with :status. Resolves teammate names against the shared roster. Investigation is read-only — never modifies Calendar, Drive, or transcripts; the only thing it writes is its own source-prefs file. |
| log-time (beta) | /log-time [range] / :onboard / :config / :status — reconstruct what you actually worked on and emit a paste-ready time-log for Redmine (or any tracker your config describes). Cross-checks whatever evidence sources you configure — calendar, task tracker, Claude Code session history, meeting transcripts, spreadsheets, any custom source you can describe in plain text — via parallel sonnet sub-agents. Behavior lives in a free-form markdown config (~/.claude/log-time/config.md): your sources, target tickets, day rules, and output style, written by a four-step skippable wizard (forced on first run — it never builds a log unconfigured) and edited any time in natural language via :config. Evidence-only by default — no fabricated hours, no assumed daily target (set an optional steady target if you always log a fixed number). Pairs well with find-call for transcript-depth call context. Read-only against every source — writes only its own config and per-run artifacts. |
Assuming /plugin marketplace add SashaMarchuk/claude-plugins was already run:
/plugin install clickup@sashamarchuk-plugins
/plugin install g-event@sashamarchuk-plugins
/plugin install ultra@sashamarchuk-plugins
/plugin install ultra-analyzer@sashamarchuk-plugins # requires ultra
/plugin install claude-migrate@sashamarchuk-plugins # requires ultra + Node/Playwright
/plugin install find-call@sashamarchuk-plugins # reads (never writes) the shared identity file
/plugin install log-time@sashamarchuk-plugins # evidence-only time-logs; pairs well with find-call
/reload-pluginsAll user state lives outside the plugin directory by design, so /plugin update never wipes what you've collected:
| Location | Contents | Used by |
|---|---|---|
~/.claude/shared/identity.json | User profile + teammate roster (name, email, external_ids, active, last_validated_at) — single source of truth for "who is on the team" | clickup, g-event (read+write) · find-call (read-only) |
~/.claude/clickup/{config.json, memory.md, drafts/} | Workspace + lists + aliases + learned memory rules + idempotency drafts + the connection block (chosen transport — MCP / clickup-cli / REST — fallback order, and a REST token pointer only, never the token value) | clickup |
~/.claude/g-event/config.json | Calendar defaults + always-include attendees (notes bot) + behavior flags | g-event |
~/.claude/find-call/config.json (optional) | Per-source provider preference (calendar/docs/transcripts → auto/cli/mcp/off) — preference + fallback, not a hard pin. Absent = universal auto-detect. Written by /find-call:config (guarded atomic write) or hand-edited | find-call |
~/.claude/log-time/{config.md, runs/} | Free-form markdown config (evidence sources, tracker targets, day rules, output style) + per-run evidence/audit artifacts. Written by /log-time:onboard / :config (confirm-before-write) or hand-edited — it's just text | log-time |
~/.claude/skills/ultra/global-lessons.md | Per-run lessons log | ultra |
<your-project>/.planning/ultra-analyzer/<run-name>/ | Config, seeds, findings, state per analyzer run | ultra-analyzer |
<your-project>/.planning/claude-migrate/<run-name>/ | Per-run migration state, parsed chat units, value scores, distilled briefs, and the generated copy page | claude-migrate |
All JSON writes are atomic (tmp + fsync + os.replace) under fcntl.flock on a sentinel file, and readers preserve unknown keys — so clickup and g-event can evolve independently without stepping on each other's fields in identity.json.
This preservation guarantee was verified empirically — a sandboxed rm -rf + recopy of the plugin dir (simulating a worst-case update) left every pre-seeded user file intact.
create-call skill (now published as g-event)Important: the calendar plugin was renamed from create-call to g-event in this marketplace. If you previously installed create-call as a user-level skill at ~/.claude/skills/create-call/, that legacy skill still wins over the plugin by Claude Code precedence. The rename to g-event doesn't change that — the legacy user-level skill is keyed on the directory name on disk, not the plugin name.
Migration steps:
cp ~/.claude/skills/create-call/contacts.json /tmp/create-call-contacts.bak.jsonrm -rf ~/.claude/skills/create-call/plugin install g-event@sashamarchuk-plugins (after marketplace add SashaMarchuk/claude-plugins)/g-event:onboardcontacts.json entries as a thin seed into ~/.claude/shared/identity.json.The plugin will emit a loud banner on every invocation as long as ~/.claude/skills/create-call/ still exists, so it's hard to miss. (The banner path still points at the legacy directory — that's the shadow source, not the new plugin name.)
gevent (the calendar plugin's previous name)The calendar plugin was renamed `gevent` → `g-event` (the old name collided with the well-known Python gevent library). A plugin rename changes the registry name, so /plugin update treats g-event as a new plugin rather than updating gevent in place — existing gevent users should reinstall:
/plugin uninstall gevent/plugin install g-event@sashamarchuk-plugins/reload-pluginsWhat changes for you:
/gevent:* → /g-event:* (e.g. /gevent:schedule → /g-event:schedule)./g-event run, the plugin's pre-flight deterministically copies a pre-existing ~/.claude/gevent/config.json to ~/.claude/g-event/config.json — only when the old file exists and the new one doesn't; otherwise it's a silent no-op. The old file is left in place so you can roll back; delete it once everything works.~/.claude/shared/identity.json is shared and does not move.find-call keeps working throughout: it reads the new config path and falls back to the legacy one when the new path is absent.All plugins are tested on macOS and Linux. Windows is not currently supported — the shared-identity helper uses fcntl.flock for cross-process locking, which is POSIX-only, and the ultra-analyzer / claude-migrate runners use POSIX shell. claude-migrate additionally needs Node 18+ and Playwright (Chromium) for its verify step (the migration itself runs without them; only byte-exact copy-page verification requires them). A Windows fallback (msvcrt.locking) would be a welcome PR.
"Plugin `<name>` not found in any marketplace" — the marketplace was added but you're using the wrong identifier after @. Inside marketplace.json the declared name is sashamarchuk-plugins. Use that:
/plugin install g-event@sashamarchuk-pluginsNot @SashaMarchuk/claude-plugins (that's the GitHub source, which marketplace add takes).
"Failed to parse marketplace file... impersonates an official Anthropic/Claude marketplace" — you're on an older clone from before 2026-04-23. Pull latest: the marketplace name field has been renamed from claude-plugins to sashamarchuk-plugins. Re-add: /plugin marketplace remove SashaMarchuk-claude-plugins then /plugin marketplace add SashaMarchuk/claude-plugins.
After install, plugins don't show up — run /reload-plugins. Claude Code caches the skill list until reload.
Contributions are welcome — see CONTRIBUTING.md for how to file an issue, propose a plugin, or open a PR. The quickest way to help: open an issue with a concrete example of what broke or what's missing.
MIT — see LICENSE. Use it, fork it, ship your own marketplace from it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.