ktg-plugin-marketplace/README.md

ktg-plugin-marketplace

Open-source Claude Code plugins for AI-assisted development, security, and planning.

Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo-maintained, AI-assisted, fork-and-own. Issues are welcome as signals; pull requests are not accepted. See GOVERNANCE.md for what upstream provides and how this is meant to be used.

All code here is generated by Claude Code through a dialog-based process: I direct, review, test, and validate; Claude writes. Treat the plugins as AI-authored, human-curated.

Installation

claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git

Then open Claude Code and type /plugin to browse and install — the command above only registers the marketplace, it installs nothing.

Each plugin keeps its own full README and CHANGELOG; this page is just the catalog.

---

Plugins

LLM Security v7.8.3

Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and Google DeepMind's AI Agent Traps taxonomy.

• Automated enforcement — 9 hooks block prompt injection, secrets in code, destructive commands, and supply-chain risks in real time
• Deterministic scanning — 23 Node.js scanners for entropy, Unicode codepoints, typosquatting, taint flow, git forensics, AI-BOM, trigger/signature/AST-taint, and IDE-extension prescan (VS Code + JetBrains)
• Advisory analysis — 20 commands that scan, audit, and model threats with letter-graded reports and remediation
• Enterprise governance — EU AI Act / NIST AI RMF / ISO 42001 mapping, SARIF 2.1.0 output, policy-as-code, standalone CLI

Key commands: /security posture, /security audit, /security scan, /security ide-scan, /security threat-model

6 agents · 23 scanners · 9 hooks · 2013 tests · Full documentation →

---

Config-Audit v5.13.0

Configuration intelligence for Claude Code. Claude reads instructions from 7+ file types across multiple scopes; this plugin tells you what's wrong, what's missing, what's silently conflicting, what's actually loaded, and where you're burning tokens.

• Health — 16 deterministic scanners catch broken imports, deprecated settings, conflicting rules, permission contradictions, plugin-hygiene collisions, and token waste
• Opportunities — context-aware recommendations for Claude Code features you're not using
• Action — auto-fix with mandatory backups, syntax validation, and rollback
• Inventory + hotspots — read-only view of active plugins, skills, MCP servers, hooks, and CLAUDE.md cascade, plus a ranked map of token waste
• Plain-language UX — output leads with prose and groups findings by impact and urgency (--raw and --json available)

Key commands: /config-audit posture, /config-audit feature-gap, /config-audit fix, /config-audit whats-active, /config-audit tokens

7 agents · 16 scanners · 21 commands · 1410 tests · Full documentation →

---

Voyage v5.9.1

A six-command planning pipeline with specialized agent swarms, adversarial review, and zero-friction multi-session resumption. Renamed from ultraplan-local//ultra*-local to avoid collision with Anthropic's /ultraplan and /ultrareview. No cloud dependency.

• /trekbrief — capture intent through a quality-gated interview; emits a reviewable brief
• /trekresearch — deep multi-source research with triangulation and confidence ratings
• /trekplan — transform the brief into an executable, manifest-verified plan
• /trekexecute — disciplined execution with independent audit and bounded failure recovery
• /trekreview — independent post-hoc review; severity-tagged findings feed back into planning
• /trekcontinue — resume the next session from saved state in one command

Per-phase effort and model dialog; /trekbrief, /trekplan, and /trekreview render an operator-annotation HTML view you can mark up and copy back into Claude.

24 agents · 6 commands (+1 helper) · 7 hooks · 500+ tests · Full documentation → · Migration guide

---

AI Psychosis v1.2.1

Meta-awareness tools that counteract sycophancy, reinforcement loops, and compulsive AI interaction patterns. AI assistants are structurally optimized to be agreeable; this surfaces when that becomes a problem.

• Behavioral instructions — rules that modify Claude's behavior: no unearned affirmations, mandatory risk identification, pattern naming
• Programmatic detection — 4 hooks measure session duration, dependency language, rapid-fire bursts, edit ratios, and late-night usage, with progressive alerts
• Interaction reports — /interaction-report for aggregated session statistics (opt-in)
• Contemplative references — optional pointers when interaction flags are elevated (opt-in)

Research-informed thresholds. Alerts are progressive and never blocking. Privacy-first: prompt text is never logged.

1 skill · 1 command · 4 hooks · Full documentation →

---

Graceful Handoff v3.1.0

One deliberate command to end a session cleanly and hand it to the next. /graceful-handoff reaches a natural stopping point and overwrites the nearest STATE.md — the continuity artifact the following session reads at startup.

• Stopping point first — finishes the current logical unit and leaves the code working before it writes anything
• Overwrites the nearest STATE.md — a complete state-of-play in a fixed format, headed by a mandatory 👉 NESTE — START HER block: where you are, the next concrete step, what to read
• Remote-aware commit — classifies the remote (private → tracked and committed, public → local-only), stages only STATE.md, never git add -A; push stays yours
• User-initiated only — disable-model-invocation: true, so the model cannot hand off on its own. A slim deterministic helper does the mechanical parts under a 60-second budget

v3.0 removed the auto-trigger hooks on purpose: a hook has no session context, so it could only ever write a poor snapshot — and would overwrite a good, model-written STATE.md.

Key command: /graceful-handoff [--no-commit] [--dry-run]

1 skill · 1 pipeline · 30 tests · Full documentation →

---

MS AI Architect v1.17.0 🇳🇴 Norwegian

Microsoft AI solution architecture guidance for Norwegian public sector and enterprise, through Cosmo Skyberg — a structured architect persona who understands the problem before recommending technology.

• Structured advisory — 7-phase methodology from business need to architecture recommendation and optional diagram
• Regulatory assessments — ROS (NS 5814), DPIA/PVK, 6×5 security scoring, EU AI Act classification, cost in NOK (P10/P50/P90)
• Norwegian public sector — Digdir architecture principles, Utredningsinstruksen, NSM, Schrems II data residency, EU AI Act workflow
• Grounded and current — 389 reference documents, verified against live Microsoft Learn via MCP; /architect:kb-update refreshes the knowledge base
• Playground — single-file decision-builder and report viewer covering all 17 report types, light/dark, runs offline

Key commands: /architect, /architect:ros, /architect:security, /architect:dpia, /architect:utredning, /architect:cost

12 agents · 29 commands · 5 skills (389 docs) · 2 hooks · Full documentation →

---

LinkedIn Studio v0.8.0

Build authentic LinkedIn authority through algorithmic understanding, strategic consistency, and AI-assisted content creation.

• Long-form newsletter pipeline — a multi-phase orchestrator (research → skeleton → prose → de-AI/voice scrub → fact-check → editorial and persona gates → visual assets → lock → delivery) with maintained edition state
• Adversarial review — cold headless content, language, and fact reviewers re-check a frozen draft with no drafting-session context; /linkedin:pivot re-opens cleared gates on major rewrites
• Content engine — Content Matrix (40+ ideas from one topic), voice training with drift detection, full ideation → publish → 48-hour monitoring
• Honest analytics — CSV-import pipeline with weekly/monthly reports and anomaly alerts. Adds an optional, manually-entered saves count (add a Saves column with the number read off native LinkedIn analytics; never auto-tracked, unknown ≠ 0, excluded from the engagement rate). dwell time stays explicitly unmeasurable — no fabricated metric or surface
• Growth and monetization — phase-specific guidance from 0 to 10K+ followers; topic-relevance profile optimization aligned to LinkedIn's 2026 ranking model

Key commands: /linkedin:create + /linkedin:measure (journey front-doors), /linkedin:onboarding, /linkedin:post, /linkedin:newsletter, /linkedin:report

20 agents · 30 commands (five journeys) · 6 skills · 9 hooks · Full documentation →

---

OKR for Public Sector v1.8.2 🇳🇴 Norwegian

Turn strategy into measurable goals. An AI coach that learns your organization once, then builds on that knowledge so you spend time on strategy, not re-explaining context.

• Strategy to OKR — transform goals from virksomhetsplan or tildelingsbrev into well-structured OKR with quality checks and alignment scoring
• Gap analysis — /okr:gap compares strategy documents against current OKR: what's covered, what's missing, what to do
• Cross-cycle learning — /okr:analyse tracks score trends and recurring antipatterns across cycles with charts
• 19 antipattern detection — catches sandbagging, activity-disguised-as-KR, set-and-forget, and 16 more
• Built for norsk offentlig sektor — 4-month tertials, DFO terminology, tillitsvalgt involvement, Riksrevisjon-ready documentation

Key commands: /okr:skriv, /okr:kvalitet, /okr:gap, /okr:analyse, /okr:kaskade, /okr:governance

7 agents · 14 commands · 3 hooks · Full documentation →

---

Human-Friendly Style v1.1.0

A shared Claude Code output style used across this marketplace, so the conversation feels like dialog rather than a console dump.

• Explains what and why, not how — reserving technical detail for when you ask
• Hides noise by default — long paths, raw commands, JSON, and stack traces are summarized
• Always shows irreversible actions verbatim — deploys, deletes, force-push, migrations
• Matches your language (Norwegian or English) and is honest about uncertainty

Optional and works alongside every other plugin. Activate with /config → Output style → Human-Friendly.

1 output style · Full documentation →

---

Claude Design v0.1.0

End-to-end facilitator for prompting Claude Design (claude.ai/design). Walks you from raw idea through prompt drafting, delivery, and iteration coaching. The output is the prompt; the artifact gets built in Claude Design.

• Eight-phase flow — disambiguate → intent preset → audience and destination → DESIGN.md anchor → five-layer prompt → delivery → iteration coaching → ship-readiness
• Evidence-graded references — five foundation plus eight per-preset references, each carrying an Anthropic-domain citation
• Complements Anthropic's official design plugin — this covers idea → prompt → iterate; theirs covers critique → handoff, with zero command overlap (enforced by test)

1 skill · 13 reference files · 5 tests · Full documentation →

---

repo-mailbox v0.12.1

A local mailbox for coordination between Claude Code sessions in different repositories. Session A in repo X leaves a message for repo Y; the next session in repo Y gets it injected as context at startup. Local, private, no network, no SaaS.

• Deliver until done — directed messages re-inject at every session start (/clear never loses them) until replied to or archived; broadcasts deliver once per repo via a seen set
• Untrusted by design — message content is quote-prefixed and framed as untrusted data; send-side field sanitization blocks frontmatter injection
• Natural-language sending — the coord-send skill maps "tell repo-x the bug is fixed" to the right delivery: broadcasts, bounded multi-target loops, replies, and deferred sends

1 hook · 3 skills · 3 CLI scripts · 70 selftest checks · Full documentation →

---

Shared infrastructure

Playground Design System v0.6.0

Shared design system for plugin Playgrounds — the visual self-service UIs that complement terminal slash-commands. Aksel/Digdir-aligned, WCAG 2.1 AA, light + dark themes, print-ready. Used by ms-ai-architect, okr, llm-security, voyage, and config-audit.

• Tokens and components — self-hosted fonts (OFL 1.1), a deuteranopia-safe severity ramp, and Tier 1–3 components: radar, matrix-heatmap, findings-browser, AI Act pyramid and timeline, maturity-ladder, and more
• Privacy-first — all fonts self-hosted, zero CDN requests, works offline and behind air-gapped firewalls
• Vendoring sync — scripts/sync-design-system.mjs <plugin> keeps each plugin standalone; a SHA-256 manifest detects local drift

Full documentation → · Browse showcase

---

License

MIT