Extending Claude Code with skills and plugins: 5 essentials for a personal coding-agent toolkit

The bottom line

Claude Code’s extension model is two layers: skills are the unit of work, and plugins are the unit of distribution. A skill is a SKILL.md file with instructions that the agent loads only when relevant; a plugin bundles one or more skills with optional agents, hooks, MCP servers, and LSP configs for sharing across teams. The merge of legacy custom commands into skills means a file at .claude/commands/deploy.md and a skill at .claude/skills/deploy/SKILL.md both create /deploy and behave the same way ¹ .

This tutorial covers the directory layout, five starter-pack skills to install today, the /plugin marketplace add workflow, and the pitfalls that bite first-time users. Five essentials: /simplify and /security-review for the pre-commit pass, a summarize-changes skill you build yourself in three minutes, the commit-commands plugin for the staging-to-PR pipeline, and /claude-api for any code that calls Anthropic’s SDK. All five are either bundled with Claude Code or one command away.

Image: anthropics/claude-plugins-official, the canonical Anthropic-hosted plugin examples repository. The plugins-vs-standalone-skills decision table referenced in this section is at code.claude.com/docs/en/plugins.

What skills and plugins actually are

A skill is a folder with one SKILL.md inside it, plus any supporting scripts or reference files. The skills docs frame it directly: “Create a SKILL.md file with instructions, and Claude adds it to its toolkit. Claude uses skills when relevant, or you can invoke one directly with /skill-name” ² . The right time to author a skill is when you keep pasting the same checklist into chat, or when a section of CLAUDE.md has grown into a procedure rather than a fact. Skill bodies load only when invoked, so long reference material costs almost nothing in context until the moment you need it.

A plugin is a bundle. Per the create-plugins docs, a plugin can ship any subset of: skills, custom subagents, hooks for PreToolUse / PostToolUse events, MCP servers for external integrations, LSP servers for code intelligence, background monitors, executables added to the Bash tool’s PATH, and default settings applied on enable ³ . Plugins are the right shape when you want to share a workflow across machines or with teammates; standalone skills are the right shape for personal workflows and quick experiments.

The mechanism is a published open standard called Agent Skills ⁴ , which other AI tools also implement. Claude Code extends the standard with invocation control, subagent execution, and dynamic context injection.

Skills directory layout

Skills resolve from four locations, in this precedence order:

Location	Path	Applies to
Enterprise	Managed settings	All users in the organisation
Personal	~/.claude/skills/<name>/SKILL.md	All your projects
Project	.claude/skills/<name>/SKILL.md	This project only
Plugin	<plugin>/skills/<name>/SKILL.md	Where the plugin is enabled

When two skills share a name across levels, enterprise overrides personal, personal overrides project. Plugin skills use a plugin-name:skill-name namespace, so they cannot conflict with the other levels ⁵ . Existing .claude/commands/ files keep working; if a skill and a command share a name, the skill wins.

The SKILL.md frontmatter contract is small. Nothing is strictly required, but description is recommended because it tells Claude when to invoke the skill. Combined description plus when_to_use text caps at 1,536 characters ⁶ . Useful optional fields: argument-hint for autocomplete, allowed-tools to whitelist tools the skill can use without per-call approval, disable-model-invocation: true to make the skill user-only, and paths glob patterns to auto-activate the skill only on matching files.

A minimal summarize-changes skill at ~/.claude/skills/summarize-changes/SKILL.md:

---
description: Summarise the staged git changes as a concise commit-message draft.
---
Run `git diff --cached`. Read the diff. Write a 1-2 sentence summary suitable for a commit message subject line, then a 3-bullet body covering the what / why / scope of the change.

Save the file, type /summarize-changes in Claude Code, and the agent invokes it. Claude Code watches the skills directories for file changes, so editing the body takes effect within the current session without restart ⁷ . The exception is when you create a new top-level skills directory that did not exist when the session started — the watcher needs a restart to pick that up.

Five essentials to install today

Five skills that cover the daily dev cycle: write, review, secure, ship, plus a reference loader for any code that calls Anthropic’s API. None claim to be the definitive top picks; the official marketplace ships more than 100 plugins, the community marketplace claims 425 plugins and 2,810 skills as of March 2026 ⁸ . The five below are the ones that work for everyone on day one.

/simplify is bundled with Claude Code. The bundled-skills entry describes it as: “Review your recently changed files for code reuse, quality, and efficiency issues, then fix them. Spawns three review agents in parallel, aggregates their findings, and applies fixes” ⁹ . Pass focus text to scope the pass, e.g., /simplify focus on memory efficiency. The natural slot is the pre-commit moment when you want a second pair of eyes before staging.

/security-review is a built-in command surfaced through the same / menu, scoped to the security pass: “Analyze pending changes on the current branch for security vulnerabilities. Reviews the git diff and identifies risks like injection, auth issues, and data exposure” ¹⁰ . Run it before opening any pull request that touches auth flows, query construction, or anything that reads from external input.

summarize-changes is the skill you author from the docs walkthrough above. The reason to build it yourself rather than install something fancier: every team has a different commit-message style, and a 30-line skill in your own home directory beats a 3,000-line plugin you have to wrestle into your conventions.

commit-commands is a plugin in Anthropic’s demo marketplace. Install it with one command:

/plugin install commit-commands@anthropics-claude-code
/reload-plugins

The plugin ships namespaced skills like /commit-commands:commit covering the staging-message-commit pipeline. After install, /reload-plugins activates it without restarting the session ¹¹ .

/claude-api is bundled. The docs describe it as: “Load Claude API reference material for your project’s language (Python, TypeScript, Java, Go, Ruby, C#, PHP, or cURL) and Managed Agents reference. Covers tool use, streaming, batches, structured outputs, and common pitfalls. Also activates automatically when your code imports anthropic or @anthropic-ai/sdk” ¹² . The auto-activation is the feature: when you open a file that imports the SDK, the skill injects current reference material into context instead of letting the model guess from training data.

Image: anthropics/claude-code, the canonical Anthropic-hosted Claude Code repository. The discover-plugins / /plugin manager workflow is documented at code.claude.com/docs/en/discover-plugins.

Installing community plugins

The two-step model is: add a marketplace, then install plugins from it. The Anthropic-canonical marketplace claude-plugins-official is available automatically when Claude Code starts; run /plugin and open the Discover tab to browse, or visit the public catalog at claude.com/plugins. Featured entries as of 2026-05-08 include Frontend Design, Superpowers, Context7, Code Review, Code Simplifier, GitHub, Skill Creator, Playwright, and Feature Dev.

For a community marketplace, the workflow is identical with a different source. The most-cited example is the claude-code-plugins-plus-skills repo, which exposes its catalog via the same /plugin marketplace add mechanism (note the install slug jeremylongshore/claude-code-plugins is the README’s Quick Start shortcut for the repo named claude-code-plugins-plus-skills; both resolve to the same marketplace):

# Step 1: add the marketplace (GitHub owner/repo shortcut)
/plugin marketplace add jeremylongshore/claude-code-plugins

# Step 2: open the manager and browse
/plugin

# Step 3: install a specific plugin (CLI shortcut, concrete example)
/plugin install code-cleanup@claude-code-plugins

# Step 4: activate without restart
/reload-plugins

# Step 5: invoke the namespaced skill
/code-cleanup:lint

The four supported source types for marketplace add are: GitHub owner/repo, any git URL with optional #branch-or-tag suffix, a local path, or a remote marketplace.json URL. Three install scopes are available: user (default; applies across all your projects), project (writes to .claude/settings.json so collaborators on the repo get it), and local (this repo only, not shared) ¹³ .

The trust posture is worth pausing on. The Anthropic docs are explicit: “Plugins and marketplaces are highly trusted components that can execute arbitrary code on your machine with your user privileges. Only install plugins and add marketplaces from sources you trust” ¹⁴ . Treat a community marketplace add the same way you treat a curl | bash install — read what you are running first.

Image: jeremylongshore/claude-code-plugins-plus-skills, the community marketplace cited in this section. For canonical Anthropic-hosted skill examples see anthropics/skills (the SKILL.md reference).

Common pitfalls

Five seams where first-time skill and plugin work breaks. None are framework bugs; all are surfaced in the docs but easy to miss on first read.

Skill name conflicts across scopes. Personal ~/.claude/skills/commit/ and project .claude/skills/commit/ resolving the same /commit invocation? Personal wins by precedence. Either rename the project skill or move the personal one. Plugin skills sidestep the problem entirely because their plugin-name:skill-name namespace cannot collide with anything outside the plugin.

MCP-server dependencies in plugins. Many official-marketplace plugins (github, gitlab, slack, figma, linear, notion) bundle MCP servers that need authentication. The plugin install succeeds but the integration silently does nothing until you complete the OAuth flow each MCP server prompts for. Run the plugin’s first command after install; it will surface the auth requirement.

Hot-reload boundaries. Adding or editing a skill inside an existing .claude/skills/ directory takes effect immediately. Creating a new top-level .claude/skills/ that did not exist when the session started requires restarting Claude Code so the watcher picks up the new directory ⁷ . If your new skill is not invocable, this is the first thing to check.

Project-trust dialog and allowed-tools. A project-checked-in skill with an allowed-tools field in frontmatter only takes effect after you accept the workspace trust dialog. Skills can grant themselves broad tool access; review the contents of any project skill before trusting a repo you cloned from a stranger.

Description budget truncation. The combined description plus when_to_use text is capped at 1,536 characters in the listing ⁶ . Skills with long descriptions get truncated, which means Claude cannot match user prompts to the skill’s actual purpose. Put the trigger phrase and core use case in the first 50 characters; everything after that is optional context.

Where to go next

Three concrete paths once the basics are in place.

The first is to author your own plugin. The create-plugins docs walk through building a minimal plugin with a .claude-plugin/plugin.json manifest and a skills/ directory. Once it works locally, push to a Git repo and point any teammate at it with /plugin marketplace add owner/repo; they get the same plugin you have.

A second path is to explore the official marketplace categorically. The claude-plugins-official catalog groups plugins into code-intelligence LSPs, external-integration MCP servers (GitHub, GitLab, Atlassian, Linear, Notion, Figma, Slack, and others), development workflow plugins (commit-commands, pr-review-toolkit, plugin-dev), and output-style plugins.

The third is the community ecosystem. The claude-code-plugins-plus-skills repo and tonsofskills.com host a much larger catalog; the project README claims 425 plugins, 2,810 skills, and 200 agents as of its March 2026 stamp ⁸ . Quality varies, the trust posture is community-grade rather than Anthropic-grade, and the install path is the same /plugin marketplace add workflow. The agentskills.io standard site documents the underlying spec for anyone who wants to author a skill that works across multiple AI tools.