Plugin Verification — Claude Code Guide

Installation is a trust decision

Evaluate a plugin beyond its description. Check origin, actual capabilities, compatibility, required permissions, and maintenance. An internal package can still be poorly documented or lack an accountable owner.

Review area	What to find out
Origin	Author, repository, license, release history, owner
Capability surface	Skills, shell, hooks, network, credentials, writes
Compatibility	Scope, OS, shell, repository structure, conflicts
Maintainability	Version, changelog, update, disable, uninstall, rollback

Check actual capabilities

Is it only instructions, or does it include shell scripts?
Which hooks run automatically?
Which network resources does it access?
Which credentials are required and with what rights?
Which files or states can it change?
Is read-only sufficient for the task?

Check compatibility and lifecycle

Match scope to the installation goal.
Check supported shell and operating system.
Compare expected repository structure with your project.
Find required commands and directories.
Check namespace conflicts and workflow duplication.
Test the smallest safe scenario.
Record rollback and disable steps.

Decision record

Plugin review summary

Problem: ...
Candidate: ...
Read: ...
Write: ...
Network: ...
Credentials: ...
Compatibility: ...
Owner: ...
Rollback: ...
Decision: install / hold / reject

Stop conditions

The source or maintainer is unclear.
The capability surface cannot be inspected.
Required permissions are broader than the problem.
There is no disable or rollback path.
The package duplicates a safer existing workflow.