We read 891 public Claude Code mods before installing any. Here is what they can do

Before you install a Claude Code mod, run one command on its folder and read two lines:

claude plugin validate ./some-mod

The calls: line tells you what the mod can reach: files, programs, the network, your environment variables. The hooks: line tells you what it gets to see: every tool call, every prompt, the stored conversation. The command reads the code without running it, so it is safe to use on a mod you don't trust yet.

The reason is simple. Mods arrived in Claude Code 2.1.287 on October 1, and they are not sandboxed. A mod runs with your permissions, and a process it starts runs outside the sandbox even when you have sandboxing on. The official docs say this plainly, and they suggest installing mods only from authors and marketplaces you trust.

So what do the mods people are publishing actually ask for? We cloned 891 of them from GitHub and read what claude plugin validate reports for each one. Most of them reach further than a status line needs.

Three checks before you install a mod

1. Read the calls: line. Look for $.http.fetch (network), $.process.run or $.process.spawn (starts programs), $.fs.write (writes files), $.env.get (reads environment variables, where API keys often live), $.prompt.submit (sends prompts as you) and $.model.complete (spends your plan or API key). Each of these is fine when it matches what the mod says it does. A token counter that goes online deserves a second look.
2. Read the hooks: line. tool.call without a filter in braces means the mod sees and can change every tool call. prompt.submit means it sees every prompt you send. session.append means it can rewrite rows of the conversation before they are stored. tool.check means it can answer a permission question before you are asked.
3. If it hooks tool.check, find where it returns allow. That is the code that approves tool calls for you. Check what it lets through: its own tool only, read-only calls, or something wider.

How we tested

1. Find repos. GitHub code search for the mod file layout (a hooks/hooks.json whose modules list names a code file), plus repo searches for Claude Code mods: 1,781 repos.
2. Filter. Not a fork, not archived, pushed to since October 7, and at least 5 stars: 311 repos. 303 of them cloned.
3. Find mods. A mod counts when its hooks.json points at a file that exports register, the definition in the mods reference. That gave 915 mods. Identical files were counted once, keeping the most starred copy: 902.
4. Validate. We ran claude plugin validate --json (Claude Code 2.1.314) on each one. We ran it with an empty home folder, so none of our own settings, hooks or plugins could load next to the mod. We installed nothing and ran no mod code.
5. Count. We left out Anthropic's 4 example mods and 7 whose code the validator could not read. Claude Code would refuse to load those 7 anyway. That leaves 891 community mods from 283 repos. For the rarest and most sensitive cases (approving tool calls, credential files), we also read the code by hand.

Results

A mod can fall into several rows.

Quick guess: how many of the 891 only draw on the screen and keep their own notes? 156, fewer than one in five.

A few examples, without names:

• Network. A mod that lets you continue a session from your phone follows each turn, talks to its relay service over the network, and submits what you type on the phone as your prompt. That is its whole job, and it is also exactly the $.http.fetch plus $.prompt.submit combination worth noticing in a mod that claims to do something smaller.
• Credential paths. All the hits we read were mods reading their own token. One reaction mod for a Telegram bot reads the bot token from a .env file in its own folder and keeps it in memory. The same $.fs.read could read any file you can.
• Every tool call. A remote control mod hooks every tool call, every prompt and every stored conversation row, which it needs to drive the session from elsewhere.
• Approving for you. We read all 11 mods that return allow. Each one has a condition:
  • Five approve only their own tools or calls from their own plugin.
  • Two approve read-only calls, such as reads inside a skill folder.
  • One approves a single fixed search command.
  • One approves an edit while the session holds a lock on that file.
  • One asks an outside command whether the session holds the resource.
  • One asks a model to score the risk and approves below a threshold. That is the widest of the eleven.
  • None of them approves arbitrary shell commands.

How this compares with the public catalogue

The awesome-claude-code-mods catalogue at mods.aidojo.si scans GitHub every day. Its November 1 snapshot lists 8,532 mods. It also uses claude plugin validate, and it gives each mod one reach level, from drawing only up to network access.

The two samples differ in three ways:

• Scope. We only took mods from repos with 5 or more stars and a push in the last 30 days, so our 891 are the more used, more active part of the ecosystem.
• Counting. We count each kind of call and hook separately and read the approval code by hand, where the catalogue gives one level per mod.
• Timing. We cloned on November 6.

Where the two overlap, they agree:

• 521 of our mods appear in the catalogue, and our network flag matches its data on all 521.
• Its whole-catalogue shares sit close to ours: network 9% (ours 11%), starting programs 38% (39%), writing files 18% (23%), sending prompts 11% (13%).
• 161 of our 283 repos are missing from that snapshot, all of them created before it.

What to ignore

Stars. The mods that reach furthest are often the useful ones: a remote control, a database approval panel, a kanban board that reads your queue. Reach tells you what to read, and the description tells you whether the reach makes sense.

Also ignore the idea that a validator pass means a mod is safe. Validation checks that Claude Code can read what the mod will call. Whether those calls are a good idea is still your decision.

Limitations

• Static only. This is a static reading of the code. A listed call may sit in a branch that never runs unless you click something. In the other direction, Claude Code refuses to load a mod whose calls it cannot read, so a mod that loads cannot hide a call from this list.
• Capabilities, not intent. We did not judge whether any mod misuses what it asks for, and we read only the rare cases by hand.
• One snapshot. The sample is mods from active repos with 5 or more stars, as of November 6, 2026. Mods gain new events and calls nearly every week, so these numbers will move.

Reproduce it

The counts above are in mods-review-2026-11.json, with repo and mod names left out. To check a mod yourself, clone it and run claude plugin validate on its folder. The docs' Review what a mod can do section lists which calls to look for.

Looking for something to install? The AgentCraft skills directory lists 5,101 Claude Code skills, and every community skill is reviewed before it's listed.

The full post with the comparison and the data file is on AgentCraft: https://agentcraft.dev/en/blog/claude-code-mods-review-2026-11/

Disclosure: I'm Adrian Vale and I help run AgentCraft.