clickup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clickup (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Opinionated Claude Code plugins by Sasha Marchuk — tooling for ticket management, automation, multi-agent rigor, data analysis, and account migration. Free, MIT-licensed, and open to contributions.
In Claude Code:
/plugin marketplace add SashaMarchuk/claude-plugins
/plugin install clickup@sashamarchuk-plugins
/plugin install g-event@sashamarchuk-plugins
/plugin install ultra@sashamarchuk-plugins
/plugin install ultra-analyzer@sashamarchuk-plugins
/plugin install claude-migrate@sashamarchuk-plugins
/plugin install find-call@sashamarchuk-plugins
/plugin install log-time@sashamarchuk-plugins
/reload-pluginsMarketplace name vs. GitHub source:SashaMarchuk/claude-plugins(GitHubowner/repo) is what you pass tomarketplace addto fetch the manifest.sashamarchuk-pluginsis the marketplace's declared name insidemarketplace.json— that's the suffix you use onplugin install. Anthropic's plugin-manifest validator rejects marketplace names that start withclaude-oranthropic-(reserved for official), hence the rename.
ultra-analyzer and claude-migrate both declare ultra as a dependency, so they pull ultra in automatically on Claude Code v2.1.110+; on older versions the explicit install lines above fetch it. claude-migrate (beta) additionally uses a local Node + Playwright runtime, but only for its byte-exact copy-page verification step. clickup and g-event are independent but share ~/.claude/shared/identity.json for user + teammate data — onboard either one first and the other inherits the roster. find-call (beta) is a read-only consumer of that same file: it never writes it, so it has no onboarding of its own — onboard clickup or g-event once and find-call inherits your profile + roster automatically (and works with limited name-resolution even if you skip onboarding). log-time (beta) is also a read-only consumer of the identity file, has its own onboarding (/log-time:onboard), and pairs especially well with find-call plus a connected calendar — call evidence is the strongest time signal it can gather.
| Plugin | What it does |
|---|---|
| clickup | /clickup:create / :onboard / :connect / :status / :workspace / :memory — create and manage ClickUp tickets with enforced Connextra user stories, fuzzy list aliases, teammate auto-resolution, duplicate detection, and a two-step onboarding wizard (identity + workspace). Works over any ClickUp transport — the ClickUp MCP, the clickup-cli binary, or the raw REST API — through one configurable connection layer: first use investigates what's available, asks which transport to use, and remembers the choice (/clickup:connect); nothing about the transport is hardcoded. |
| g-event | /g-event:schedule / :onboard / :status / :calendar — create/update/cancel Google Calendar events with Google Meet. Always attaches a configurable notes bot, conflict + past-time guards, two-step onboarding (identity + calendar defaults). Shares the teammate roster with clickup. |
| ultra | /ultra:run / :resume — multi-agent swarm with adversarial validation, structured debates, devil's advocate, and anti-AI-slop checks. Tiers --small / --medium / --large / --xl; wraps other skills for maximum-rigor runs. |
| ultra-analyzer (beta) | /ultra-analyzer skill set — rigorous data/corpus pipeline (discover → analyze → validate → synthesize) with resume-able state and /ultra gates at critical boundaries. Source-agnostic: MongoDB, filesystem, PDF, web scrapes, JSON/CSV, SQLite. Requires the `ultra` plugin. |
| claude-migrate (beta) | /claude-migrate:init / :run / :resume / :progress / :verify — move your chats and projects from one Claude.ai account to another. Parse a data export (or extract live in a browser) → cheap-model value scan → you confirm what migrates → distill each kept chat into one paste-ready first message → re-create projects and seed chats. Always builds a byte-exact, self-contained copy page (the zero-tooling floor); when a pre-authenticated browser is reachable it also runs confirmation-gated automation (seed → await OK → rename → strip). Resume-able state machine with /ultra gates. Requires the `ultra` plugin + local Node/Playwright. |
| find-call (beta) | /find-call <call> / :config / :status — pull deep, cited context from a past Google Calendar meeting. Searches Calendar + optional transcripts (Sembly or any connected notetaker) in parallel, reads the notes-bot "Meeting Resources" block (Transcription, Meeting Notes, Video, Parent Folder), disambiguates matches, and spawns sonnet sub-agents per call for transcript-depth. Uses whatever tools are available by default; set a preferred provider per source with :config (always with fallback — data is retrieved by any working method), inspect with :status. Resolves teammate names against the shared roster. Investigation is read-only — never modifies Calendar, Drive, or transcripts; the only thing it writes is its own source-prefs file. |
| log-time (beta) | /log-time [range] / :onboard / :config / :status — reconstruct what you actually worked on and emit a paste-ready time-log for Redmine (or any tracker your config describes). Cross-checks whatever evidence sources you configure — calendar, task tracker, Claude Code session history, meeting transcripts, spreadsheets, any custom source you can describe in plain text — via parallel sonnet sub-agents. Behavior lives in a free-form markdown config (~/.claude/log-time/config.md): your sources, target tickets, day rules, and output style, written by a four-step skippable wizard (forced on first run — it never builds a log unconfigured) and edited any time in natural language via :config. Evidence-only by default — no fabricated hours, no assumed daily target (set an optional steady target if you always log a fixed number). Pairs well with find-call for transcript-depth call context. Read-only against every source — writes only its own config and per-run artifacts. |
Assuming /plugin marketplace add SashaMarchuk/claude-plugins was already run:
/plugin install clickup@sashamarchuk-plugins
/plugin install g-event@sashamarchuk-plugins
/plugin install ultra@sashamarchuk-plugins
/plugin install ultra-analyzer@sashamarchuk-plugins # requires ultra
/plugin install claude-migrate@sashamarchuk-plugins # requires ultra + Node/Playwright
/plugin install find-call@sashamarchuk-plugins # reads (never writes) the shared identity file
/plugin install log-time@sashamarchuk-plugins # evidence-only time-logs; pairs well with find-call
/reload-pluginsAll user state lives outside the plugin directory by design, so /plugin update never wipes what you've collected:
| Location | Contents | Used by |
|---|---|---|
~/.claude/shared/identity.json | User profile + teammate roster (name, email, external_ids, active, last_validated_at) — single source of truth for "who is on the team" | clickup, g-event (read+write) · find-call (read-only) |
~/.claude/clickup/{config.json, memory.md, drafts/} | Workspace + lists + aliases + learned memory rules + idempotency drafts + the connection block (chosen transport — MCP / clickup-cli / REST — fallback order, and a REST token pointer only, never the token value) | clickup |
~/.claude/g-event/config.json | Calendar defaults + always-include attendees (notes bot) + behavior flags | g-event |
~/.claude/find-call/config.json (optional) | Per-source provider preference (calendar/docs/transcripts → auto/cli/mcp/off) — preference + fallback, not a hard pin. Absent = universal auto-detect. Written by /find-call:config (guarded atomic write) or hand-edited | find-call |
~/.claude/log-time/{config.md, runs/} | Free-form markdown config (evidence sources, tracker targets, day rules, output style) + per-run evidence/audit artifacts. Written by /log-time:onboard / :config (confirm-before-write) or hand-edited — it's just text | log-time |
~/.claude/skills/ultra/global-lessons.md | Per-run lessons log | ultra |
<your-project>/.planning/ultra-analyzer/<run-name>/ | Config, seeds, findings, state per analyzer run | ultra-analyzer |
<your-project>/.planning/claude-migrate/<run-name>/ | Per-run migration state, parsed chat units, value scores, distilled briefs, and the generated copy page | claude-migrate |
All JSON writes are atomic (tmp + fsync + os.replace) under fcntl.flock on a sentinel file, and readers preserve unknown keys — so clickup and g-event can evolve independently without stepping on each other's fields in identity.json.
This preservation guarantee was verified empirically — a sandboxed rm -rf + recopy of the plugin dir (simulating a worst-case update) left every pre-seeded user file intact.
create-call skill (now published as g-event)Important: the calendar plugin was renamed from create-call to g-event in this marketplace. If you previously installed create-call as a user-level skill at ~/.claude/skills/create-call/, that legacy skill still wins over the plugin by Claude Code precedence. The rename to g-event doesn't change that — the legacy user-level skill is keyed on the directory name on disk, not the plugin name.
Migration steps:
cp ~/.claude/skills/create-call/contacts.json /tmp/create-call-contacts.bak.jsonrm -rf ~/.claude/skills/create-call/plugin install g-event@sashamarchuk-plugins (after marketplace add SashaMarchuk/claude-plugins)/g-event:onboardcontacts.json entries as a thin seed into ~/.claude/shared/identity.json.The plugin will emit a loud banner on every invocation as long as ~/.claude/skills/create-call/ still exists, so it's hard to miss. (The banner path still points at the legacy directory — that's the shadow source, not the new plugin name.)
gevent (the calendar plugin's previous name)The calendar plugin was renamed `gevent` → `g-event` (the old name collided with the well-known Python gevent library). A plugin rename changes the registry name, so /plugin update treats g-event as a new plugin rather than updating gevent in place — existing gevent users should reinstall:
/plugin uninstall gevent/plugin install g-event@sashamarchuk-plugins/reload-pluginsWhat changes for you:
/gevent:* → /g-event:* (e.g. /gevent:schedule → /g-event:schedule)./g-event run, the plugin's pre-flight deterministically copies a pre-existing ~/.claude/gevent/config.json to ~/.claude/g-event/config.json — only when the old file exists and the new one doesn't; otherwise it's a silent no-op. The old file is left in place so you can roll back; delete it once everything works.~/.claude/shared/identity.json is shared and does not move.find-call keeps working throughout: it reads the new config path and falls back to the legacy one when the new path is absent.All plugins are tested on macOS and Linux. Windows is not currently supported — the shared-identity helper uses fcntl.flock for cross-process locking, which is POSIX-only, and the ultra-analyzer / claude-migrate runners use POSIX shell. claude-migrate additionally needs Node 18+ and Playwright (Chromium) for its verify step (the migration itself runs without them; only byte-exact copy-page verification requires them). A Windows fallback (msvcrt.locking) would be a welcome PR.
"Plugin `<name>` not found in any marketplace" — the marketplace was added but you're using the wrong identifier after @. Inside marketplace.json the declared name is sashamarchuk-plugins. Use that:
/plugin install g-event@sashamarchuk-pluginsNot @SashaMarchuk/claude-plugins (that's the GitHub source, which marketplace add takes).
"Failed to parse marketplace file... impersonates an official Anthropic/Claude marketplace" — you're on an older clone from before 2026-04-23. Pull latest: the marketplace name field has been renamed from claude-plugins to sashamarchuk-plugins. Re-add: /plugin marketplace remove SashaMarchuk-claude-plugins then /plugin marketplace add SashaMarchuk/claude-plugins.
After install, plugins don't show up — run /reload-plugins. Claude Code caches the skill list until reload.
Contributions are welcome — see CONTRIBUTING.md for how to file an issue, propose a plugin, or open a PR. The quickest way to help: open an issue with a concrete example of what broke or what's missing.
MIT — see LICENSE. Use it, fork it, ship your own marketplace from it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.