open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Releases Activity
ktg-plugin-marketplace/README.md
Kjell Tore Guttormsen a67d7f5340 docs(catalog): repo-mailbox block describes board + route, not just coord-send 
Same defect class as 9992235, found by auditing the remaining ten blocks:
the version label v0.12.1 was correct while the prose sat three minor
bumps behind. The block promised "3 skills" in its stat line and then
described exactly one of them.

`board` (v0.10.0) and `route` (v0.10.0) were invisible in the catalog --
the cross-repo attention board and the model/effort rubric that is now
the single copy of the operator's global routing policy. `reply-expected`
/ `--fyi` (v0.11.0) was missing too: the format can finally tell a
question from a notice, and absence means expected.

Two numbers were measured wrong, not estimated wrong:

  3 CLI scripts     -> 6 operational (board, coord-count, coord-done,
                       coord-inbox, coord-send, route) + 3 selftests
  70 selftest checks -> 251, by running them:
                       coord 159, route 56, board 36

The other nine blocks were audited on the same two axes and are correct.
Every "Key commands" line was checked against real command files -- no
phantom commands anywhere, so the flag half of the graceful-handoff
defect does not repeat. Two prose claims I suspected held up on close
reading: voyage's annotation HTML view (README:24, 509+) and
claude-design's "enforced by test" -- that test says "collision", not
"overlap", so the first grep was too narrow, not the catalog wrong.

voyage's "500+ tests" stays UNMEASURED (76 test files, assertions not
run). Not asserted either way.
2026-07-31 21:13:10 +02:00

211 lines
15 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# ktg-plugin-marketplace
Open-source Claude Code plugins for AI-assisted development, security, and planning.
Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo-maintained, AI-assisted, fork-and-own. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for what upstream provides and how this is meant to be used.
All code here is generated by Claude Code through a dialog-based process: I direct, review, test, and validate; Claude writes. Treat the plugins as AI-authored, human-curated.
## Installation
```bash
claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
```
Then open Claude Code and type `/plugin` to browse and install — the command above only registers the marketplace, it installs nothing.
Each plugin keeps its own full README and CHANGELOG; this page is just the catalog.
---
## Plugins
### [LLM Security](https://git.fromaitochitta.com/open/llm-security) `v7.8.3`
Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and Google DeepMind's AI Agent Traps taxonomy.
- **Automated enforcement** — 9 hooks block prompt injection, secrets in code, destructive commands, and supply-chain risks in real time
- **Deterministic scanning** — 23 Node.js scanners for entropy, Unicode codepoints, typosquatting, taint flow, git forensics, AI-BOM, trigger/signature/AST-taint, and IDE-extension prescan (VS Code + JetBrains)
- **Advisory analysis** — 20 commands that scan, audit, and model threats with letter-graded reports and remediation
- **Enterprise governance** — EU AI Act / NIST AI RMF / ISO 42001 mapping, SARIF 2.1.0 output, policy-as-code, standalone CLI
Key commands: `/security posture`, `/security audit`, `/security scan`, `/security ide-scan`, `/security threat-model`
6 agents · 23 scanners · 9 hooks · 2013 tests · [Full documentation →](https://git.fromaitochitta.com/open/llm-security)
---
### [Config-Audit](https://git.fromaitochitta.com/open/config-audit) `v5.13.0`
Configuration intelligence for Claude Code. Claude reads instructions from 7+ file types across multiple scopes; this plugin tells you what's wrong, what's missing, what's silently conflicting, what's actually loaded, and where you're burning tokens.
- **Health** — 16 deterministic scanners catch broken imports, deprecated settings, conflicting rules, permission contradictions, plugin-hygiene collisions, and token waste
- **Opportunities** — context-aware recommendations for Claude Code features you're not using
- **Action** — auto-fix with mandatory backups, syntax validation, and rollback
- **Inventory + hotspots** — read-only view of active plugins, skills, MCP servers, hooks, and CLAUDE.md cascade, plus a ranked map of token waste
- **Plain-language UX** — output leads with prose and groups findings by impact and urgency (`--raw` and `--json` available)
Key commands: `/config-audit posture`, `/config-audit feature-gap`, `/config-audit fix`, `/config-audit whats-active`, `/config-audit tokens`
7 agents · 16 scanners · 21 commands · 1410 tests · [Full documentation →](https://git.fromaitochitta.com/open/config-audit)
---
### [Voyage](https://git.fromaitochitta.com/open/voyage) `v5.9.1`
A six-command planning pipeline with specialized agent swarms, adversarial review, and zero-friction multi-session resumption. Renamed from `ultraplan-local`/`/ultra*-local` to avoid collision with Anthropic's `/ultraplan` and `/ultrareview`. No cloud dependency.
- **`/trekbrief`** — capture intent through a quality-gated interview; emits a reviewable brief
- **`/trekresearch`** — deep multi-source research with triangulation and confidence ratings
- **`/trekplan`** — transform the brief into an executable, manifest-verified plan
- **`/trekexecute`** — disciplined execution with independent audit and bounded failure recovery
- **`/trekreview`** — independent post-hoc review; severity-tagged findings feed back into planning
- **`/trekcontinue`** — resume the next session from saved state in one command
Per-phase effort and model dialog; `/trekbrief`, `/trekplan`, and `/trekreview` render an operator-annotation HTML view you can mark up and copy back into Claude.
24 agents · 6 commands (+1 helper) · 7 hooks · 500+ tests · [Full documentation →](https://git.fromaitochitta.com/open/voyage) · [Migration guide](https://git.fromaitochitta.com/open/voyage/src/branch/main/MIGRATION.md)
---
### [AI Psychosis](https://git.fromaitochitta.com/open/ai-psychosis) `v1.2.1`
Meta-awareness tools that counteract sycophancy, reinforcement loops, and compulsive AI interaction patterns. AI assistants are structurally optimized to be agreeable; this surfaces when that becomes a problem.
- **Behavioral instructions** — rules that modify Claude's behavior: no unearned affirmations, mandatory risk identification, pattern naming
- **Programmatic detection** — 4 hooks measure session duration, dependency language, rapid-fire bursts, edit ratios, and late-night usage, with progressive alerts
- **Interaction reports** — `/interaction-report` for aggregated session statistics (opt-in)
- **Contemplative references** — optional pointers when interaction flags are elevated (opt-in)
Research-informed thresholds. Alerts are progressive and never blocking. Privacy-first: prompt text is never logged.
1 skill · 1 command · 4 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ai-psychosis)
---
### [Graceful Handoff](https://git.fromaitochitta.com/open/graceful-handoff) `v3.1.0`
One deliberate command to end a session cleanly and hand it to the next. `/graceful-handoff` reaches a natural stopping point and overwrites the nearest `STATE.md` — the continuity artifact the following session reads at startup.
- **Stopping point first** — finishes the current logical unit and leaves the code working before it writes anything
- **Overwrites the nearest `STATE.md`** — a complete state-of-play in a fixed format, headed by a mandatory `👉 NESTE — START HER` block: where you are, the next concrete step, what to read
- **Remote-aware commit** — classifies the remote (private → tracked and committed, public → local-only), stages *only* `STATE.md`, never `git add -A`; push stays yours
- **User-initiated only** — `disable-model-invocation: true`, so the model cannot hand off on its own. A slim deterministic helper does the mechanical parts under a 60-second budget
v3.0 removed the auto-trigger hooks on purpose: a hook has no session context, so it could only ever write a poor snapshot — and would overwrite a good, model-written `STATE.md`.
Key command: `/graceful-handoff [--no-commit] [--dry-run]`
1 skill · 1 pipeline · 30 tests · [Full documentation →](https://git.fromaitochitta.com/open/graceful-handoff)
---
### [MS AI Architect](https://git.fromaitochitta.com/open/ms-ai-architect) `v1.17.0` `🇳🇴 Norwegian`
Microsoft AI solution architecture guidance for Norwegian public sector and enterprise, through Cosmo Skyberg — a structured architect persona who understands the problem before recommending technology.
- **Structured advisory** — 7-phase methodology from business need to architecture recommendation and optional diagram
- **Regulatory assessments** — ROS (NS 5814), DPIA/PVK, 6×5 security scoring, EU AI Act classification, cost in NOK (P10/P50/P90)
- **Norwegian public sector** — Digdir architecture principles, Utredningsinstruksen, NSM, Schrems II data residency, EU AI Act workflow
- **Grounded and current** — 389 reference documents, verified against live Microsoft Learn via MCP; `/architect:kb-update` refreshes the knowledge base
- **Playground** — single-file decision-builder and report viewer covering all 17 report types, light/dark, runs offline
Key commands: `/architect`, `/architect:ros`, `/architect:security`, `/architect:dpia`, `/architect:utredning`, `/architect:cost`
12 agents · 29 commands · 5 skills (389 docs) · 2 hooks · [Full documentation →](https://git.fromaitochitta.com/open/ms-ai-architect)
---
### [LinkedIn Studio](https://git.fromaitochitta.com/open/linkedin-studio) `v0.8.0`
Build authentic LinkedIn authority through algorithmic understanding, strategic consistency, and AI-assisted content creation.
- **Long-form newsletter pipeline** — a multi-phase orchestrator (research → skeleton → prose → de-AI/voice scrub → fact-check → editorial and persona gates → visual assets → lock → delivery) with maintained edition state
- **Adversarial review** — cold headless content, language, and fact reviewers re-check a frozen draft with no drafting-session context; `/linkedin:pivot` re-opens cleared gates on major rewrites
- **Content engine** — Content Matrix (40+ ideas from one topic), voice training with drift detection, full ideation → publish → 48-hour monitoring
- **Honest analytics** — CSV-import pipeline with weekly/monthly reports and anomaly alerts. Adds an
**optional, manually-entered `saves`** count (add a `Saves` column with the number read off native
LinkedIn analytics; never auto-tracked, `unknown` ≠ 0, excluded from the engagement rate). `dwell`
time stays **explicitly unmeasurable** — no fabricated metric or surface
- **Growth and monetization** — phase-specific guidance from 0 to 10K+ followers; topic-relevance profile optimization aligned to LinkedIn's 2026 ranking model
Key commands: `/linkedin:create` + `/linkedin:measure` (journey front-doors), `/linkedin:onboarding`, `/linkedin:post`, `/linkedin:newsletter`, `/linkedin:report`
20 agents · 30 commands (five journeys) · 6 skills · 9 hooks · [Full documentation →](https://git.fromaitochitta.com/open/linkedin-studio)
---
### [OKR for Public Sector](https://git.fromaitochitta.com/open/okr) `v1.8.2` `🇳🇴 Norwegian`
Turn strategy into measurable goals. An AI coach that learns your organization once, then builds on that knowledge so you spend time on strategy, not re-explaining context.
- **Strategy to OKR** — transform goals from virksomhetsplan or tildelingsbrev into well-structured OKR with quality checks and alignment scoring
- **Gap analysis** — `/okr:gap` compares strategy documents against current OKR: what's covered, what's missing, what to do
- **Cross-cycle learning** — `/okr:analyse` tracks score trends and recurring antipatterns across cycles with charts
- **19 antipattern detection** — catches sandbagging, activity-disguised-as-KR, set-and-forget, and 16 more
- **Built for norsk offentlig sektor** — 4-month tertials, DFO terminology, tillitsvalgt involvement, Riksrevisjon-ready documentation
Key commands: `/okr:skriv`, `/okr:kvalitet`, `/okr:gap`, `/okr:analyse`, `/okr:kaskade`, `/okr:governance`
7 agents · 14 commands · 3 hooks · [Full documentation →](https://git.fromaitochitta.com/open/okr)
---
### [Human-Friendly Style](https://git.fromaitochitta.com/open/human-friendly-style) `v1.1.0`
A shared Claude Code [output style](https://code.claude.com/docs/en/output-styles) used across this marketplace, so the conversation feels like dialog rather than a console dump.
- Explains what and why, not how — reserving technical detail for when you ask
- Hides noise by default — long paths, raw commands, JSON, and stack traces are summarized
- Always shows irreversible actions verbatim — deploys, deletes, force-push, migrations
- Matches your language (Norwegian or English) and is honest about uncertainty
Optional and works alongside every other plugin. Activate with `/config` → Output style → Human-Friendly.
1 output style · [Full documentation →](https://git.fromaitochitta.com/open/human-friendly-style)
---
### [Claude Design](https://git.fromaitochitta.com/open/claude-design) `v0.1.0`
End-to-end facilitator for prompting Claude Design (`claude.ai/design`). Walks you from raw idea through prompt drafting, delivery, and iteration coaching. The output is the prompt; the artifact gets built in Claude Design.
- **Eight-phase flow** — disambiguate → intent preset → audience and destination → DESIGN.md anchor → five-layer prompt → delivery → iteration coaching → ship-readiness
- **Evidence-graded references** — five foundation plus eight per-preset references, each carrying an Anthropic-domain citation
- **Complements Anthropic's official design plugin** — this covers idea → prompt → iterate; theirs covers critique → handoff, with zero command overlap (enforced by test)
1 skill · 13 reference files · 5 tests · [Full documentation →](https://git.fromaitochitta.com/open/claude-design)
---
### [repo-mailbox](https://git.fromaitochitta.com/open/repo-mailbox) `v0.12.1`
A local mailbox for coordination between Claude Code sessions in different repositories. Session A in repo X leaves a message for repo Y; the next session in repo Y gets it injected as context at startup. Local, private, no network, no SaaS.
- **Deliver until done** — directed messages re-inject at every session start (`/clear` never loses them) until replied to or archived; broadcasts deliver once per repo via a seen set. `reply-expected` distinguishes a question from a notice (`--fyi`); absence means expected
- **Untrusted by design** — message content is quote-prefixed and framed as untrusted data; send-side field sanitization blocks frontmatter injection. The obligation to answer is procedural, never substantive
- **`coord-send`** — natural-language sending: maps "tell repo-x the bug is fixed" to the right delivery — broadcasts, bounded multi-target loops, replies, retractions, and deferred sends
- **`board`** — read-only cross-repo attention board: which repos have a live next step, which are blocked and on whom, which owe a reply, and what each costs to move
- **`route`** — turns four scored traits of the next task into a model/effort row from a closed six-row rubric, with a pasteable startup command and a one-row-cheaper fallback
1 hook · 3 skills · 6 CLI scripts · 251 selftest checks · [Full documentation →](https://git.fromaitochitta.com/open/repo-mailbox)
---
## Shared infrastructure
### [Playground Design System](https://git.fromaitochitta.com/open/playground-design-system) `v0.6.0`
Shared design system for plugin Playgrounds — the visual self-service UIs that complement terminal slash-commands. Aksel/Digdir-aligned, WCAG 2.1 AA, light + dark themes, print-ready. Used by `ms-ai-architect`, `okr`, `llm-security`, `voyage`, and `config-audit`.
- **Tokens and components** — self-hosted fonts (OFL 1.1), a deuteranopia-safe severity ramp, and Tier 1–3 components: radar, matrix-heatmap, findings-browser, AI Act pyramid and timeline, maturity-ladder, and more
- **Privacy-first** — all fonts self-hosted, zero CDN requests, works offline and behind air-gapped firewalls
- **Vendoring sync** — `scripts/sync-design-system.mjs <plugin>` keeps each plugin standalone; a SHA-256 manifest detects local drift
[Full documentation →](https://git.fromaitochitta.com/open/playground-design-system) · [Browse showcase](https://git.fromaitochitta.com/open/playground-design-system/src/branch/main/playground-examples/index.html)
---
## License
MIT
Reference in a new issue View git blame Copy permalink