Official vs community Cowork plugins: who made it?

Every plugin listing answers one question clearly - what it does - and blurs three others: who wrote it, who listed it, and who checked it. Those are three separate facts, and mixing them up is how people over-trust a community package or dismiss a good one.

This guide untangles the three, using Anthropic's current documentation and this directory's own labeling rules. Sources at the end.

Fact one: who published it

The publisher is the person or organization that wrote and maintains the package.

• Anthropic-built plugins. Anthropic maintains an open-source repository of knowledge-work plugins (sales, finance, legal, marketing, HR, engineering, design, operations, data analysis, and more), built for Cowork and compatible with Claude Code. The source is public under an Apache 2.0 license, so you can read exactly what a plugin instructs Claude to do before installing it.
• Partner-built plugins. Anthropic's own materials note that some plugins in its library, like Salesforce in Claude, are built by partners and bundle the partner's connectors and skills. "In the official catalog" and "written by Anthropic" are not the same thing.
• Community plugins. Everything else: individuals and teams publishing packages on GitHub. Quality ranges from excellent to abandoned, and the only way to tell is to inspect.

Our official plugins page lists only the Anthropic-built set. Everything else in the directory is community, labeled as such.

Fact two: who listed it

A catalog is a distribution surface, not an endorsement of every entry. Anthropic's marketplace, a GitHub repository, and independent directories like this one are three different catalogs with three different bars for inclusion.

This matters because catalogs blur into publishers in casual reading. A plugin "from the marketplace" can be Anthropic-built, partner-built or community-built; the catalog alone does not say. Check the publisher field, not just where you found the listing.

Fact three: who checked it

Review comes in different strengths, and none of them is a guarantee:

• Anthropic-built plugins are maintained by Anthropic itself, which makes them the safest starting point and the ones with first-party support.
• Community plugins in this directory are reviewed by a human before publishing: the repository must contain a valid plugin package, and obvious non-plugins are filtered out. That is an inclusion bar, not a security audit.
• Enterprise skill scanning is a separate, runtime check: on Enterprise plans with scanning enabled, plugins are checked for malicious content at install or update, with risky ones blocked or flagged. It scans content, not output quality.

A listing, a manifest, a star count or a marketplace badge is metadata. None of them proves a plugin is safe, accurate or right for your organization. Our plugin security guide covers the checks worth doing yourself.

What changes in practice

Support. Official plugins have a maintainer you can hold accountable and a public issue tracker. Community plugins depend on one maintainer's spare time; check when the repository last moved before building a workflow on it.

Compatibility claims. "Works in Cowork and Code" needs evidence per component. Skills and commands work across chat, Cowork and Code; hooks and sub-agents do not run in chat; local MCP components run through the desktop app. A community README claiming universal support is a claim, not a test result.

Updates. Official plugins change as Anthropic's docs and hosts change. Community plugins can pin to older behavior. After any update, re-run your first-task test and compare outputs.

Where to start. If you are new, start with the official set for your role, learn what a good package looks like, then evaluate community options against that baseline. Our requirements checklist covers plan and surface needs, and plugins vs skills vs connectors explains what is inside a package.

A quick inspection habit

Before installing anything, community or not:

1. Read the publisher name and find their repository or organization.
2. Skim the package contents: which skills, commands, connectors or local components are inside.
3. Check the last update date and the README's install instructions against your host.
4. Run a first task on synthetic notes before connecting real accounts.

Five minutes of that beats any label.

Sources

• Use plugins in Claude - Claude Help Center
• anthropics/knowledge-work-plugins on GitHub
• Install plugins - Claude.ai Documentation