Plugins and provenance: checking before installing

This lesson is still being tested: it improves with learners' feedback. If something is unclear, it is the lesson that needs fixing, not you.

By the end of this lesson, you will be able to

say what a plugin can do on your computer;
recognize where a plugin comes from: official, community or third-party catalog;
read a plugin before installing it, with a decision sheet;
install, disable and uninstall a plugin, starting with the course’s own.

Why it matters to you

A plugin installs several extensions at once: skills, connectors, hooks. It is handy, and it is also the fastest way to add code you haven’t read to your computer. As with a phone app, the real question is not “is it useful?”, but “what will it be able to do, and who made it?”.

Before you start


You need	Claude Code in the terminal (module 4, lesson 2), and the decision sheet (resource)
Cost	The agent subscription: Claude Pro at minimum, €18 per month excl. VAT, price shown in France on 24/10/2026. A plugin may have its own costs
Duration	40 minutes
Reminder	A plugin runs with your rights: don’t install anything you haven’t looked at

Understand it in 3 minutes

What a plugin can do, according to the Claude Code documentation (24/10/2026): it can run arbitrary code on your machine, with your user privileges. It can contain:

hooks: commands launched automatically;
MCP servers (connectors), some of which run on your computer;
programs added to the ones Claude can launch;
background tasks (monitors) and mods: code that starts by itself, in the background or inside Claude Code, with your rights;
skills, commands and agents: instructions that guide what Claude does, but a skill can also register hooks, allow tools without asking you and run commands before Claude reads it: so read its SKILL.md file too, with the same caution as the rest of the plugin.

Claude Code’s permission rules apply to Claude’s actions, not to the code the plugin launches by itself (its hooks, its servers).

Where does it come from? A plugin is installed from a catalog (marketplace). The documentation distinguishes three tiers: official and community (reserved names, which Claude Code accepts only for catalogs coming from Anthropic’s repositories), and third-party: all the others. A catalog’s name tells you who publishes it, not what each plugin does.

It can change. With automatic updates, the files you reviewed can change on your disk.

Before installing, the decision sheet (resource): the need, the author and the catalog, what the plugin contains, what it can read or do, its cost, and how to remove it.

Do it together

The exercise plugin is the course companion: you can read everything it contains on the website’s Continue in Claude Code page (the Companion page).

1Step 1: Fill in the sheet before installing

Open the Companion page and the Decision sheet resource. Fill in:

Need: follow the lessons from Claude Code.
Provenance: third-party catalog, published on the course website, with a fingerprint that lets you verify the archive.
Contents: a skill (the instructor’s guidelines) and a read-only MCP server; no hook, no background task, no mod, no added program. In the SKILL.md, the allowed-tools field lets the course server’s six read tools run without asking you, and only those; no ! followed by a command.
Cost: free; the agent subscription is still needed.
Removal: claude plugin uninstall (step 4).

2Step 2: Add the catalog and look before installing

In the terminal:

claude plugin marketplace add https://neurylio.com/compagnon/marketplace.json

Then start claude --permission-mode manual in your folder and type:

/plugin install formation-ia@formation-ia-pratique

According to the documentation, in a session, this command does not install right away: it opens the plugin’s details page, with what it is going to install. Read it. Does what it announces match your sheet? If so, choose the install for you: Install for you (user scope): the plugin is then recorded in your personal settings, and the uninstall command in step 4 works as is.

If you choose another scope, add --scope project (for everyone who works in the folder) or --scope local (for you, in this folder only) to that uninstall command.

3Step 3: Check what is installed

Quit Claude Code (/exit): the commands in steps 3 and 4 are typed in the terminal, not in the conversation with Claude.

claude plugin list

The plugin appears, with its version and the status “enabled”.

4Step 4: Disable, then uninstall

claude plugin disable formation-ia@formation-ia-pratique
claude plugin list

The status changes to “disabled”: the plugin stays installed, but is no longer used. To remove it completely (if you installed it for a folder, add --scope project or --scope local to the command):

claude plugin uninstall formation-ia@formation-ia-pratique
claude plugin list

The list no longer shows it. The formation-ia-pratique catalog, however, stays registered in your settings (claude plugin marketplace list shows it). If you don’t plan to install any more course extensions, remove it too, once the plugin is uninstalled:

claude plugin marketplace remove formation-ia-pratique

This command also uninstalls all the plugins installed from that catalog.

The plugin’s files stay for a while in Claude Code’s cache (14 days; if it was your last plugin, until your next plugin installation): that is normal. You can reinstall the companion whenever you want from the Companion page.

Your turn

The deliverable of module 7, second half: a complete decision sheet for a real extension that tempts you (a plugin, a connector, a shared skill), installed or not:

fill in the five parts of the sheet;
if you install it: for this folder only if possible.
- For a plugin, choose the “local” scope (“Install for you, in this repo only”: for you, in this folder only), not the “project” scope, which writes to the shared .claude/settings.json file.
- Write down the exact command to remove it (for a plugin in “local” scope, with --scope local);
file the sheet in your journal.

Resources to download

Decision sheet: install an extension, or not: need, provenance, what it can do, cost, decision and removal.

Check your work

It worked if:

you installed, disabled and then uninstalled the companion, checking each time with claude plugin list;
your decision sheet for a real extension is filled in, with a decision and its reason;
you can say whether a catalog is official, community or third-party.

Common mistakes:

installing from a link found online, without reading the plugin’s details;
thinking a name that contains “official” is enough;
forgetting that a verified plugin can change with updates;
keeping a disabled plugin “just in case”: uninstall what you no longer use.

Keep it and pick it up later

Keep your decision sheets in your journal: they say why each extension is there.
At the monthly upkeep (module 5, lesson 7), read your list of plugins again.

Going further

optional

The official documentation, in English: code.claude.com/docs/en/plugins/security (what a plugin can do, catalog tiers, review before installation) and code.claude.com/docs/en/plugins/install (install, manage, uninstall).

New words

5 words explained

Word	What it means
Plugin	A package that installs several extensions at once: skills, connectors, hooks, programs
Catalog (marketplace)	The list you install plugins from; its name says who publishes it
Provenance	Where an extension comes from, and who made it
Disable	Keep a plugin installed, but stop using it
Uninstall	Remove a plugin from your computer

The cycle of catalog, installation, disabling and uninstallation of the companion was actually run with Claude Code 2.1.310, in an isolated configuration (test report, T41). The interactive /plugin panel was not run.