{{PLUGIN_NAME}}

{{DESCRIPTION}}

A private Claude Code plugin distributed via a private GitHub repository.

Install (for users)

One-time: authenticate with GitHub so Claude Code can clone the private repo.

gh auth login

In Claude Code:

/plugin marketplace add {{GITHUB_OWNER}}/{{GITHUB_REPO}}
/plugin install {{PLUGIN_NAME}}@{{MARKETPLACE_NAME}}

Updates are automatic. When the maintainer bumps version in .claude-plugin/plugin.json and pushes to main, Claude Code picks up the new version on its next marketplace refresh.

Skills

Skill	Triggers on
project-onboarding	Starting work on an unfamiliar repository

Recommended client settings

These aren't shipped by the plugin (that would override your preferences). Add them to your own ~/.claude/settings.json or the project's .claude/settings.json to get more out of Claude Code.

A starter block you can copy:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(ls *)",
      "Bash(pwd)",
      "Bash(node scripts/validate.js)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(curl *)"
    ]
  },
  "companyAnnouncements": [
    "Reminder: secrets live in 1Password, not .env.local"
  ]
}

• $schema — enables autocomplete and validation in VS Code and JetBrains.
• permissions.allow — pre-approves safe commands so you're not prompted on every git status. Add your test/build commands as you go.
• permissions.deny — defense-in-depth. Claude usually honors it but not always, so keep real secrets out of the repo regardless.
• companyAnnouncements — prints at the top of every session. Great for client-specific reminders.

Power-user settings

• statusLine — custom bottom-bar script showing branch, token usage, and cost. See the Claude Code statusLine docs.
• Autocompact threshold — the default compacts at ~95% of the context window. Lowering toward 75% keeps output quality higher on long sessions. See the settings reference for the current key name.
• Commit attribution — if you don't want Co-Authored-By: Claude footers on your commits, there's a setting to disable it. Check the settings reference for the exact key.

---

For maintainers

Forking this template

1. Clone the template into a new private GitHub repo under your org.
2. Run the initializer to replace {{PLACEHOLDER}} tokens interactively:

   node scripts/init.js

3. Delete the init script (one-shot):

   rm scripts/init.js

4. Validate, commit, push:

   node scripts/validate.js
   git add -A && git commit -m "init plugin"
   git push

Adding a skill

1. Create the directory and file:

   mkdir -p skills/my-skill
   $EDITOR skills/my-skill/SKILL.md

2. Start with frontmatter. Only name and description are required, but the description is the trigger — front-load it with the conditions under which Claude should invoke the skill:

   ---
   name: my-skill
   description: Use when [situation]. Does [what]. Reads [inputs] to produce [output].
   ---

3. Keep SKILL.md tight (under ~200 lines). If it grows, move detail into skills/my-skill/references/*.md and link from the body.
4. Lint before committing:

   node scripts/validate.js

Releasing a new version

1. Bump version in .claude-plugin/plugin.json (semver).
2. Update CHANGELOG.md.
3. Commit and push to main. No tag is required — Claude Code's marketplace refresh polls the repo.

Directory layout

.claude-plugin/
├── plugin.json          # Plugin manifest
└── marketplace.json     # Self-hosted marketplace pointing at this repo
skills/
└── project-onboarding/
    └── SKILL.md
scripts/
├── init.js              # One-shot template initializer (delete after first use)
└── validate.js          # Validates manifest, skill frontmatter, and hooks.json
hooks/
├── hooks.json           # Ships empty; opt in per hook (see EXAMPLES.md)
└── EXAMPLES.md          # Ready-to-copy hook snippets
.github/workflows/
└── validate.yml         # Runs validate.js on every PR

Add these as you need them — they follow the standard Claude Code plugin spec and need no extra wiring:

• commands/ — slash commands (flat .md files)
• agents/ — custom subagents
• .mcp.json — MCP server definitions

Security notes for private distribution

• The plugin cache on each user's machine (~/.claude/plugins/cache/) is unencrypted. Never put secrets, API keys, or customer data inside skill files. Reference environment variables instead.
• The cache lives under the user's home directory — if they sync their home to iCloud, OneDrive, or similar, the plugin syncs with it.
• Keep the GitHub repo private and rotate access when team members leave.