Claude Code plugins are great. One command and you get new skills, slash commands, hooks and MCP servers.
But a plugin isn't a prompt. It's a program that runs on your machine.
Security researchers at PromptArmor showed how a plugin's hook can run before Claude's tools, auto-approve a curl command and send your code to another server. The only visible sign was a short PreToolUse:Bash line in the transcript.
Marketplaces don't review plugin code. So here's the checklist I use before every install.
1. Who made it
Look for a real account with history. Be careful with new accounts that copy the name of a well-known plugin.
2. hooks.json
Hooks run shell commands automatically on events like PreToolUse or SessionStart. Open hooks/hooks.json and write down every event and every command it runs.
3. Every script those hooks run
Read them top to bottom. Search for curl, wget, base64, eval and anything that sends data out. If a script is minified or obfuscated, that's your answer.
4. .mcp.json and bin/
MCP servers start the moment the plugin is enabled. A bin/ folder puts programs on Claude's PATH. Check what each one is and where it comes from.
5. Anything that touches ~/.claude/settings.json
A plugin that changes your permissions can auto-approve risky commands. That's the exact trick in the PromptArmor example.
One quick red flag test
Does what it asks for match what it does? A code formatter doesn't need network access. A note-taking skill doesn't need a PreToolUse hook on Bash.
And protect your secrets anyway
Even with good plugins, Claude can read your .env file if you let it. I built a small free plugin, env-guard, that blocks Read, Bash and Grep from touching .env files.
Rule of thumb: if you can't read it, don't run it.
I go deeper on this (vetting real plugins and building your own safe one) in my course: Claude Code Plugins: Vet, Install & Build Them Safely
