Claude Code Plugins: Vet, Install & Build Them Safely

Claude Code plugins can make you much faster. They can also run code on your machine, read your files and touch your secrets. Most people install them the same way they install a browser extension: click, trust, forget. This course teaches you a better way.

You'll learn how plugins actually work under the hood, including skills, slash commands, agents, hooks and MCP servers, so you know exactly what you're agreeing to when you install one. You'll see how marketplaces work, where plugins come from, and what is and isn't checked before they reach you.

Then you'll get a simple six-question checklist you can use on any plugin in a few minutes: Is the publisher verifiable? Is it pinned to a version you reviewed? Does it do only what it says (do the permissions and hooks match the description)? Are the hooks safe? Is the repo maintained? Did you test it before trusting it? We'll use it on real plugins for code intelligence, Git workflows, testing and documentation, and compare overlapping plugins to decide which one to keep.

In the hands-on part, you'll build your own plugin from scratch: env-guard, a small plugin with a skill and a hook that blocks Claude from reading your .env files. Then we'll try to break it. Along the way you'll make real mistakes, find a real bypass, fix it, write tests for it, and then package, version and publish the plugin on GitHub with its own marketplace.

By the end, you'll be able to:

- Vet any Claude Code plugin before it runs on your machine

- Spot red flags in hooks, scripts and permissions

- Choose between similar plugins with confidence

- Build your own plugin with a skill and a hook that blocks Claude from reading your .env secrets, then test it against real bypasses

No plugin experience needed. If you can use a terminal and Git, you're ready.