C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools
buildwithclaude
A single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClaw
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 40/100
- Rank
- #326 of 500
- GitHub stars
- 3.6k
What it does
buildwithclaude serves as a centralized directory and hub for discovering Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections that extend Claude's capabilities across Code, Desktop, Agent SDK, and related platforms. It helps developers and builders locate and integrate pre-built extensions without building from scratch.
Who it’s for
AI builders, developers, and technical teams looking to extend Claude's functionality with curated skills and integrations. Executives seeking to understand what Claude extensions are available for their use cases.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/davepoon/buildwithclaude (opens external site) for current setup instructions. The repository appears to be a discovery hub rather than an npm package, so usage likely involves browsing the catalog directly or integrating listed skills/agents individually into Claude Desktop or Agent SDK projects per each extension's own documentation.
Risks
- Third-party skill integrity: Extensions listed are community-contributed; no apparent vetting process means malicious or poorly-maintained code could be indexed and discovered by users
- Supply chain risk: Depending on external marketplaces and plugin sources increases attack surface if upstream repositories are compromised
- Prompt injection via skills: Unvetted skills may not sanitize inputs, increasing risk of prompt injection attacks against Claude or downstream systems
- Credentials and secrets exposure: Skills may request or mishandle API keys and authentication tokens if permissions and scope are not clearly documented
- Data exfiltration: No apparent audit trail of what data extensions collect or transmit; users rely on individual extension authors' privacy practices
How to stay secure
Security Hardening Guide: buildwithclaude
Least-privilege permissions
- Only enable skills that you actually need for your work; disable unused extensions to reduce your attack surface (the potential entry points for bad actors)
- Review what information each skill requests access to before installing—avoid granting broad permissions like "access all files" when a skill only needs specific data types
- Check if skills require API keys or login credentials, and only provide the minimum access level needed (for example, read-only instead of read-and-write permissions)
- Regularly audit which skills are active and remove any that you've stopped using
Network isolation
- Install skills only from official or trusted sources; avoid downloading extensions from unknown websites or unofficial marketplaces
- If your organization handles sensitive data, consider running buildwithclaude in a separate environment (like a sandboxed computer or virtual machine) away from systems containing confidential information
- Disable internet access for Claude when using untrusted skills, if your workflow allows it, to prevent data from being sent externally
Monitoring
- Keep a log of which skills you install and when, so you can track changes to your system
- Watch for unusual activity after installing new skills, such as unexpected network traffic, slow performance, or new files appearing on your computer
- Enable any available audit logging in buildwithclaude to see what actions skills are performing with your data
Red flags to watch for
- Skills with no documentation, no author information, or poor user reviews—these are signs the code may not be well-maintained or trustworthy
- Skills that ask for sensitive information (passwords, API keys, personal data) without clear explanation of how that information will be used
- Unexpected requests for permissions that seem unrelated to what the skill is supposed to do (for example, a writing tool asking for access to your email)
- Skills that have not been updated recently or show no signs of active maintenance by their creators
Alternatives
- Anthropic's official Claude Extensions marketplace (when available) — vendor-maintained, higher trust baseline
- OpenAI's plugin ecosystem or GPT store — analogous curated marketplace for ChatGPT extensions
- LangChain community integrations — community-driven but with broader ecosystem maturity
- Hugging Face Hub — established open-source model and tool discovery platform with community ratings