Install and configure Claude Code plugins: complete guide

# Global extensions (all your projects)
~/.claude/
├── commands/          # Global skills (slash commands)
├── agents/            # Global agents
└── rules/             # Global rules

# Per-project extensions
.claude/
├── commands/          # Project skills
├── agents/            # Project agents
├── rules/             # Project rules
└── settings.json      # MCP configuration and permissions

# Install from a GitHub repo (relative to root)
/install-github affaan-m/everything-claude-code

# repomix - analyzes and condenses a codebase for context
npx repomix

# Generate a compressed context file
npx repomix --output repomix-output.txt --ignore "node_modules/**"

# You then pass this file to Claude Code:
# "Analyze this codebase: [paste content of repomix-output.txt]"

{
  "mcpServers": {
    "context7": {
      "command": "npx",
      "args": ["-y", "@upstash/context7-mcp"]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your-token"
      }
    }
  },
  "permissions": {
    "allow": ["Bash(git:*)", "Read(**)", "Edit(**)"],
    "deny": []
  }
}

# Create a custom skill in .claude/commands/
cat > .claude/commands/deploy-staging.md << 'EOF'
# Deploy Staging

Deploy the application to the staging environment following these steps:

1. Verify tests pass (`npm run test`)
2. Build the application (`npm run build`)
3. Verify the Docker build works
4. Create a git tag with the version
5. Push to the `staging` branch
6. Confirm deployment in the Slack #releases channel

If any step fails, stop immediately and report the error.
EOF

/deploy-staging

# Create an agent in .claude/agents/
cat > .claude/agents/security-reviewer.md << 'EOF'
---
name: security-reviewer
description: Security expert who analyzes code to detect OWASP vulnerabilities
---

You are a cybersecurity expert specializing in web application security.
You analyze code looking for:
- SQL and NoSQL injections
- XSS and CSRF vulnerabilities
- Hardcoded secrets (tokens, passwords, API keys)
- Authentication and authorization issues
- Security misconfigurations (CORS, headers, CSP)

For each issue found, you provide:
1. Severity (CRITICAL / HIGH / MEDIUM / LOW)
2. Precise location in the code
3. Explanation of the risk
4. A secure fix example
EOF

my-team-extension/
├── README.md                    # Documentation and installation instructions
├── commands/                    # Skills (slash commands)
│   ├── deploy-staging.md
│   └── hotfix.md
├── agents/                      # Specialized agents
│   ├── security-reviewer.md
│   └── architect.md
└── rules/                       # Rules and conventions
    └── coding-conventions.md

/install-github your-org/my-team-extension
# or manually:
git clone https://github.com/your-org/my-team-extension
cp -r my-team-extension/commands/ .claude/commands/
cp -r my-team-extension/agents/ .claude/agents/

# List available skills
ls .claude/commands/
ls ~/.claude/commands/

# List available agents
ls .claude/agents/
ls ~/.claude/agents/

# Disable a skill (rename with a different extension)
mv .claude/commands/unused-skill.md .claude/commands/unused-skill.md.disabled

# Delete a skill
rm .claude/commands/skill-to-remove.md

# Update (re-download from the source repo)
curl -o .claude/commands/tdd-guide.md \
  https://raw.githubusercontent.com/affaan-m/everything-claude-code/main/commands/tdd-guide.md