Skills & Plugins
Skills and plugins extend what Claude can do — and a plugin can run code on every session: hooks, MCP servers, scripts. Waxell gives you one place to decide which ones your people get.
upload or request ──▶ security scan ──▶ your policy ──▶ review queue ──▶ published
│ │
└── auto-approve / auto-reject ├─▶ Claude Code
└─▶ Claude Desktop, Cowork, claude.ai
How it works
- Something comes in. An admin uploads a skill or plugin in Govern → Skills & Plugins, or a member requests one from Connect → Skills.
- Waxell scans it. Every upload is security-scanned for prompt injection, credential access, data exfiltration and code that runs automatically. See Security scanning.
- Your policy decides what it can. Clean scans can be approved automatically; anything risky goes to a person. See Auto-approval.
- A person decides the rest — approve, reject, or revoke later.
- The approved set is published to where your people use Claude:
- Claude Code — through your approved marketplace, optionally locked down for everyone. See Claude Code.
- Claude Desktop, Cowork and claude.ai — through a GitHub or GitLab repository that claude.ai syncs. See Sync to claude.ai.
Revoking takes it back out of all of them.
Who does what
| Role | Where | What they do |
|---|---|---|
| Admin | Govern → Skills & Plugins | Upload, review, approve, reject, revoke; set the auto-approval policy; connect the publishing destinations. |
| Member | Connect → Skills | See what's approved and how to install it; request something new; track their requests. |
| Claude admin (claude.ai Owner) | claude.ai Admin settings | Connect the marketplace repository once; set who can see each plugin. |
What you can upload
| Upload | Becomes |
|---|---|
A SKILL.md file | A skill |
| A skill folder, zipped | A skill (its other files come with it) |
A Claude Code plugin, zipped — a folder with .claude-plugin/plugin.json | A plugin, as uploaded |
Uploads up to 8 MB (zipped), 500 files and 16 MB uncompressed. Each file can be up to 2 MB. Binary files — a Word template, an image, a font — ship with the skill or plugin and are inspected by type (see Security scanning); together they can be up to 4 MB.
Next steps
- Admins: start with the admin quickstart.
- Members: see Request a skill or plugin.