Skills and Plugin Marketplace

Skills and Plugin Marketplace

CCAM plugins package focused commands, agents, and skills for operations such as investigation, cost control, configuration review, integrations, quality checks, and platform maintenance.

Think in capabilities

Before installing a plugin, identify:

• what data it can read;
• what files or dashboard state it can change;
• whether it can invoke external services;
• which MCP mutation gates it expects;
• how it is versioned and removed;
• whether its instructions fit your repository policy.

The presence of a skill does not grant permission to use destructive or external actions.

Safe evaluation process

1. Read the plugin manifest and every instruction file it will invoke.
2. Inspect scripts and dependencies from the exact revision.
3. Test against a non-production CCAM instance or backup copy.
4. Keep MCP read-only unless a specific workflow requires writes.
5. Verify generated commands and target paths before execution.
6. Pin or record the installed version.
7. Re-review on update.

Included capability families

The repository contains plugin families for platform operations, configuration inspection, insights, cost guardrails, integrations, quality, and developer tooling. Use the repository's plugin documentation as the canonical inventory because available packages evolve with releases.

Team governance

Maintain an allowlist for shared environments. Record plugin name, version, owner, required secrets, mutation level, and review date. A plugin that can change Claude/Codex configuration or send webhook data deserves the same review as an administrative script.

Troubleshooting

If a skill behaves unexpectedly, capture its exact version and input, disable mutation access, reproduce with a minimal read-only call, and inspect the generated tool/CLI request. Report issues without including transcript secrets.