re added plugins of anthropics

CHANGELOG.md

@@ -8,20 +8,18 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
 
 ## [3.3.0] — 2026-04-08
 
-### Breaking
-- `security-guidance` removed — never existed as a marketplace plugin (`anthropic/claude-plugins-official` is a non-existent repo). RTK covers security hooks.
-- `pr-review-toolkit` removed — same non-existent marketplace. No replacement available.
-- `frontend-design` reclassified from TOGGLE plugin to **built-in Claude Code skill** (`/mnt/skills/public/frontend-design/`). Always available, 0 token cost, not toggleable.
-- `skill-creator` reclassified from TOGGLE plugin to **built-in Claude Code skill** (`/mnt/skills/examples/skill-creator/`). Always available, 0 token cost, not toggleable.
-- `anthropic/claude-plugins-official` marketplace reference removed from `install-plugins.sh` — this GitHub repo does not exist.
+### Fixed
+- `install-plugins.sh`: marketplace org was `anthropic` (missing 's') — corrected to `anthropics`
+- `install-plugins.sh`: plugins `security-guidance`, `frontend-design`, `pr-review-toolkit` were installed from non-existent marketplace `claude-plugins-official` — corrected to `claude-code-plugins` (from `anthropics/claude-code` repo)
+- `install-plugins.sh`: `skill-creator` plugin does not exist — replaced with `plugin-dev@claude-code-plugins` (correct plugin name)
 
 ### Changed
-- `install-plugins.sh`: fake marketplace block replaced with built-in skill notes; install summary updated
-- `lib/detect-plugins.sh`: `detect_frontend_design()` removed (built-in skill, always available); notes added for all removed plugins
-- `hooks/session-start.sh`: `frontend_design` removed from toggle loop; `security-guidance` removed from always-on display; new `🔵 BUILT-IN` line shows `frontend-design skill-creator`; token cost estimate no longer counts frontend-design
-- `agents/plugin-advisor.md`: decision table, compatibility matrix, recommended sets, conditional rules all updated — frontend-design and skill-creator marked as built-in (0t, not toggleable); security-guidance and pr-review-toolkit removed; passive cost estimates recalculated
-- `README.md`: plugin reference table split into installable plugins + built-in skills; compatibility matrix updated; recommended sets recalculated; removed pr-review-toolkit from slash commands; added "Removed plugins" note explaining what happened
-- `USAGE.md`: all references updated — quick reference, case studies, session-start boxes, signal→plugin table
+- `install-plugins.sh`: adds `anthropics/claude-code` marketplace before installing bundled plugins; install summary updated with correct marketplace sources
+- `lib/detect-plugins.sh`: added `detect_security_guidance()`, `detect_plugin_dev()` functions; removed reference to non-existent `detect_skill_creator`
+- `hooks/session-start.sh`: added `plugin_dev` to toggle loop and token cost estimate
+- `agents/plugin-advisor.md`: all references to `skill-creator` → `plugin-dev`; signal `skill-creation` now recommends `plugin-dev ON`
+- `README.md`: plugin table updated with correct marketplace sources per plugin; new "Marketplaces" subsection documenting all 4 marketplace sources and manual install commands; `/plugin-dev:create-plugin` replaces `/skill-creator`
+- `USAGE.md`: all references to `skill-creator` → `plugin-dev`
 - `version.txt`: 3.2.1 → 3.3.0
 
 ## [3.2.1] — 2026-04-07

README.md

@@ -223,6 +223,7 @@ gsd          # then inside the session:
 
 | Command | Plugin | Description |
 |---|---|---|
+| `/pr-review-toolkit:review-pr` | pr-review-toolkit | Multi-agent PR review (6 specialized agents) |
 | `/context7:docs <lib>` | context7 | Manual doc lookup for a specific library |
 
 ---
@@ -368,6 +369,7 @@ Warns if ruflo is active with no multi-agent signal, or if GSD v2 CLI is not ins
 
 | Pair | Relation | Notes |
 |---|---|---|
+| frontend-design ↔ ui-ux-pro-max | ⚠️ Overlap | Keep both for design-heavy. Drop ui-ux-pro-max for simple UI. |
 | gstack ↔ gsd v2 | ✅ Complementary | Different scopes — CC workflow vs CLI orchestration |
 | gstack ↔ ruflo | ⚠️ Overlap | Both orchestrate multi-step work. Use one or the other. ~3250-4250t combined. |
 | gsd v2 ↔ ruflo | ⚠️ Overlap | Sequential (GSD) vs parallel swarm (ruflo). Pick based on need. |
@@ -375,25 +377,21 @@ Warns if ruflo is active with no multi-agent signal, or if GSD v2 CLI is not ins
 | superpowers ↔ gstack | ✅ Complementary | Used together by orchestrators |
 | context7 ↔ any | ✅ Independent | Doc lookup MCP — always safe to combine |
 
-> **Built-in skills** (always available, 0 tokens, not toggleable):
-> `frontend-design` and `skill-creator` are built-in Claude Code skills. They complement all plugins without conflict.
-
 ### Recommended sets by project type
 
 | Project type | Plugins ON | OFF | Passive cost |
 |---|---|---|---|
-| Backend API / microservice | superpowers, context7* | ui-ux-pro-max, gstack, ruflo | ~800t |
-| Frontend SPA / SSR | superpowers, ui-ux-pro-max, context7 | gstack, ruflo | ~1400t |
-| Full-stack SaaS | superpowers, gstack, ui-ux-pro-max, context7 | ruflo | ~4150t |
+| Backend API / microservice | superpowers, context7* | frontend-design, ui-ux-pro-max, gstack, ruflo | ~800t |
+| Frontend SPA / SSR | superpowers, frontend-design, ui-ux-pro-max, context7 | gstack, ruflo | ~1600t |
+| Full-stack SaaS | superpowers, gstack, frontend-design, ui-ux-pro-max, context7 | ruflo | ~4400t |
 | CLI tool / library | superpowers | all toggles | ~800t |
 | Multi-session large feature | superpowers + gsd v2 CLI (external) | ruflo | ~800t CC |
 | Quick fix / hotfix | superpowers | all toggles | ~800t |
-| Design system / component lib | superpowers, ui-ux-pro-max | gstack, ruflo, gsd | ~1200t |
+| Design system / component lib | superpowers, frontend-design, ui-ux-pro-max | gstack, ruflo, gsd | ~1600t |
 | Enterprise multi-agent | superpowers, ruflo + gsd v2 CLI (external) | others | ~2300t CC |
 
 > *context7 only if using fast-evolving libs (Next.js, React 18+, Prisma, Supabase)
-> rtk is ALWAYS ON (0 tokens) — omitted from estimates
-> frontend-design and skill-creator are built-in Claude Code skills (0 tokens, always available) — omitted from recommendations
+> security-guidance and rtk are ALWAYS ON (0 tokens) — omitted from estimates
 
 ---
 
@@ -412,31 +410,46 @@ Run `/plugin-check` anytime to get a recommendation for the current project type
 
 | Plugin | Status | Passive cost | When to use | Installed by |
 |---|---|---|---|---|
+| **security-guidance** | ✅ ALWAYS ON | 0 tokens (hook only) | — | claude-code-plugins |
 | **RTK** | ✅ ALWAYS ON | 0 tokens (hook only) | — | cargo (pinned in plugins.lock.json) |
-| **Superpowers** | ✅ REQUIRED | ~600–1000 tokens | — required by orchestrators | marketplace |
+| **Superpowers** | ✅ REQUIRED | ~600–1000 tokens | — required by orchestrators | superpowers-marketplace |
 | **GStack** | 🔄 TOGGLE | ~2500–3000 tokens | Full-product: UI + design + deploy + browser QA | git submodule |
 | **GSD v2** | 🖥️ CLI | 0 tokens (external CLI) | Multi-day features, crash recovery, cost tracking, parallel workers | npm (pinned in plugins.lock.json) |
 | **ruflo** | 🔄 TOGGLE | ~500–1500 tokens | Enterprise multi-agent swarm (5+ concurrent agents) | npm + MCP manual |
-| **ui-ux-pro-max** | 🔄 TOGGLE | ~400 tokens | Design system, color/typography choices | marketplace |
+| **plugin-dev** | 🔄 TOGGLE | ~100 tokens | Creating plugins or custom skills | claude-code-plugins |
+| **pr-review-toolkit** | 🔄 TOGGLE | ~300 tokens | PR review sessions | claude-code-plugins |
+| **frontend-design** | 🔄 TOGGLE | ~200 tokens | Any project with a UI | claude-code-plugins |
+| **ui-ux-pro-max** | 🔄 TOGGLE | ~400 tokens | Design system, color/typography choices | ui-ux-pro-max-skill |
 | **Context7 MCP** | 🔄 TOGGLE | ~200 tokens | Fast-evolving libs (Next.js, React, Prisma…) | MCP manual |
 
-**Built-in Claude Code skills (always available, 0 tokens, no install needed):**
+**Rule:** toggle plugins are OFF by default. `/plugin-check` signals when to enable them.
+If you use `/init-project` or `/ship-feature`, plugin-check runs automatically as STEP 0
+and **blocks if Superpowers is not active**.
 
-| Skill | Location | Description |
-|---|---|---|
-| **frontend-design** | `/mnt/skills/public/frontend-design/` | UI design guidance — loaded on demand when relevant |
-| **skill-creator** | `/mnt/skills/examples/skill-creator/` | Create custom skills from conversation — loaded on demand |
+### Marketplaces
 
-These built-in skills are always available and cannot be toggled on/off. They have zero passive token cost
-(loaded on demand only). Use them naturally — Claude Code activates them when the context matches.
+Plugins are installed from GitHub-hosted marketplaces. Three are used by this config:
 
-> **Removed plugins** (previously listed but never existed as installable plugins):
-> - `security-guidance` — was listed as a marketplace plugin but the marketplace `anthropic/claude-plugins-official` does not exist. RTK covers security hooks.
-> - `pr-review-toolkit` — same non-existent marketplace. No replacement available.
+| Marketplace | GitHub repo | Plugins | Auto-available |
+|---|---|---|---|
+| `claude-plugins-official` | `anthropics/claude-plugins-official` | Anthropic-curated third-party plugins | ✅ yes |
+| `claude-code-plugins` | `anthropics/claude-code` | Anthropic bundled plugins (security-guidance, frontend-design, pr-review-toolkit, plugin-dev) | ❌ add manually |
+| `superpowers-marketplace` | `obra/superpowers-marketplace` | Superpowers workflow plugin | ❌ add manually |
+| `ui-ux-pro-max-skill` | `nextlevelbuilder/ui-ux-pro-max-skill` | UI/UX Pro Max design plugin | ❌ add manually |
 
-**Rule:** toggle plugins are OFF by default. `/plugin-check` signals when to enable them.
-If you use `/init-project` or `/ship-feature`, plugin-check runs automatically as STEP 0
-and **blocks if Superpowers is not active**.
+`install-plugins.sh` adds all required marketplaces automatically.
+
+**Manual install example:**
+```bash
+# Add the marketplace (once)
+claude plugin marketplace add anthropics/claude-code
+
+# Install a plugin from it
+claude plugin install --scope user frontend-design@claude-code-plugins
+
+# Browse all available plugins
+/plugin   # → Discover tab
+```
 
 ### Version pinning
 
@@ -635,7 +648,7 @@ Execute on:
 $ARGUMENTS
 ```
 
-3. Or use `/skill-creator` to generate a skill from conversation.
+3. Or use `/plugin-dev:create-plugin` to generate a skill from conversation.
 
 ---
 

USAGE.md

@@ -96,10 +96,9 @@ Tu veux...
 ## Les plugins — décision rapide
 
 ```
-Toujours actifs (0 token) : rtk
-Built-in (toujours disponible, 0 token) : frontend-design, skill-creator
+Toujours actifs (0 token) : security-guidance, rtk
 
-Projet avec interface     → frontend-design déjà disponible (built-in)
+Projet avec interface     → frontend-design ON
 Design élaboré/system     → ui-ux-pro-max ON
 Deploy + QA browser       → gstack ON
 Next.js/React/Prisma      → context7 ON (WARN si absent, pas BLOCK)
@@ -224,7 +223,7 @@ cd mon-projet-existant/
 /plugin-check "App mobile React Native Expo liste de courses, offline-first, SQLite, notifications push"
 
 → SIGNALS: frontend (mobile), fast-libs (Expo SDK)
-→ NOTE: frontend-design available (built-in, 0t)
+→ ENABLE: frontend-design (composants RN)
 → WARN: context7 si Expo SDK 51+ utilisé (fast-libs)
 → OFF: gstack (mobile, pas de browser QA), ui-ux-pro-max (optionnel)
 → BLOCKING: none
@@ -302,7 +301,7 @@ gsd
 /plugin-check "Site vitrine Next.js 14 studio photo, design élaboré, animations Framer Motion, galerie, dark mode, SEO"
 
 → SIGNALS: frontend, design-system, fast-libs(Next.js)
-→ NOTE: frontend-design available (built-in, 0t)
+→ ENABLE: frontend-design (~200t)
 → ENABLE: ui-ux-pro-max (~400t) — "design élaboré" signal fort
 → WARN: context7 non configuré → taper "force" pour continuer (ou configurer avant)
 → OFF: gstack (vitrine statique, pas de deploy complexe)
@@ -356,8 +355,7 @@ Sans ui-ux-pro-max : "Tailwind avec palette neutre, Inter". La différence est v
 /plugin-check "Jeu de puzzle web React + FastAPI + PostgreSQL. Auth JWT, collection de cartes, boutique in-app, leaderboard. Multi-session, dev sur plusieurs semaines."
 
 → SIGNALS: frontend, fast-libs(React), deploy, multi-session
-→ NOTE: frontend-design available (built-in, 0t)
-→ ENABLE: context7
+→ ENABLE: frontend-design, context7
 → ENABLE: ui-ux-pro-max (cartes visuelles, cohérence design)
 → CLI: gsd v2 RECOMMANDÉ (multi-session détecté)
 → OPTIONAL: gstack si deploy CI + browser QA prévus
@@ -456,7 +454,7 @@ ONBOARD COMPLETE: mycli
 /plugin-check "Rust CLI, pas de frontend, pas de deploy"
 
 → SIGNALS: none (CLI pur)
-→ DISABLE: ui-ux-pro-max, gstack, context7
+→ DISABLE: frontend-design, ui-ux-pro-max, gstack, context7
 → KEEP: superpowers
 → COST: ~800t (minimal)
 → ACTION REQUIRED? NO
@@ -521,7 +519,7 @@ DO NOT TOUCH:
 
 → SIGNALS: none (CLI pur, pas de deploy, pas de frontend)
 → KEEP: superpowers
-→ DISABLE: ui-ux-pro-max, gstack, context7, ruflo
+→ DISABLE: frontend-design, ui-ux-pro-max, gstack, context7, ruflo
 → COST: ~800t (base seulement)
 → ACTION REQUIRED? NO
 ```
@@ -803,7 +801,7 @@ OPTIONS:
 SIGNALS: mobile (React Native + Expo détectés)
 
 RECOMMENDATIONS:
-  ℹ️  NOTE    : frontend-design available (built-in, 0t)
+  ⚡ ENABLE  : frontend-design — composants React Native (~200t)
   ⚠️  DISABLE : gstack — mobile, pas de browser QA ni deploy web
   ℹ️  OPTIONAL: ui-ux-pro-max — uniquement si design system complexe
   ℹ️  NOTE    : Docker N/A pour les apps mobiles
@@ -847,7 +845,7 @@ COST: ~800t
 
 RECOMMENDATIONS:
   ✅ KEEP   : superpowers
-  ⚠️ DISABLE: ui-ux-pro-max, gstack, context7, ruflo
+  ⚠️ DISABLE: frontend-design, ui-ux-pro-max, gstack, context7, ruflo
 BLOCKING: none → "proceed"
 
 → Scaffolder: cargo check comme verify (pas cargo build)
@@ -937,7 +935,7 @@ SIGNALS: monorepo, frontend(apps/web/), fast-libs(Next.js), deploy(apps/api/)
 
 RECOMMENDATIONS:
   OK KEEP   : superpowers
-  NOTE      : frontend-design available (built-in, 0t)
+  ENABLE    : frontend-design — apps/web/ uniquement (~200t)
   WARN      : context7 — Next.js detecte dans apps/web/
   DISABLE   : gstack — apps/api/ n'a pas de browser-qa
               (NOTE: gstack aurait ete recommande si browser-qa present)
@@ -975,13 +973,13 @@ L'utilisateur voit exactement ce qui manque et la commande pour corriger.
 
 ### Cas J — session-start : box ne deborde pas avec 5 plugins actifs
 
-**Avant v2.3.0 :** avec `gstack ui-ux-pro-max context7 ruflo` tous actifs, la ligne `ON` depassait la largeur de la box.
+**Avant v2.3.0 :** avec `gstack frontend-design ui-ux-pro-max context7 ruflo` tous actifs, la ligne `ON` depassait la largeur de la box.
 
 **Avec v2.3.0 :**
 ```
 ┌─ Claude Code config ──────────────────────────────────┐
-│  ✅ ON  : rtk superpowers            │
-│  🟢 ON  : gstack ui-ux-pro-max context7...      │  <- tronque a 37+...
+│  ✅ ON  : security-guidance rtk superpowers            │
+│  🟢 ON  : gstack frontend-design ui-ux-pro-ma...      │  <- tronque a 37+...
 │  ⚫ OFF : none                                         │
 │  💰 ~5350t passif (48% budget)                        │
 │  📦 v2.3.0                                            │
@@ -1034,7 +1032,7 @@ PROJECT STATUS
 
 CONFIG
   Version   : v2.4.0
-  Plugins ON: superpowers, context7 (~1000t)
+  Plugins ON: superpowers, frontend-design, context7 (~1200t)
   GSD v2    : installed (2.64.0)
 
 PROJECT
@@ -1080,7 +1078,7 @@ SIGNALS: monorepo (upstream), frontend, fast-libs(Next.js)
 NOTE: dans apps/web/ d'un monorepo (détecté via parent dir)
 
 RECOMMENDATIONS:
-  NOTE: frontend-design available (built-in, 0t) — apps/web/ uniquement
+  ENABLE: frontend-design — apps/web/ uniquement
   WARN: context7 — Next.js détecté
   DISABLE: gstack — pas de browser-qa dans ce package
 ```
@@ -1114,13 +1112,13 @@ Le compteur `5/6 OK` indique exactement le problème sans lire toutes les lignes
 
 ### Cas O — session-start avec 5 toggles actifs
 
-**Avant v2.4.0 :** avec gstack + ui-ux-pro-max + context7 + ruflo actifs, la ligne débordait la box.
+**Avant v2.4.0 :** avec gstack + frontend-design + ui-ux-pro-max + context7 + ruflo actifs, la ligne débordait la box.
 
 **Avec v2.4.0 :**
 ```
 ┌─ Claude Code config ──────────────────────────────────┐
-│  ✅ ON  : rtk superpowers            │
-│  🟢 ON  : gstack ui-ux-pro-max +2 more              │
+│  ✅ ON  : security-guidance rtk superpowers            │
+│  🟢 ON  : gstack frontend-design +3 more              │
 │  ⚫ OFF : none                                         │
 │  💰 ~5350t passif (48% budget)                        │
 │  📦 v2.4.0                                            │
@@ -1149,7 +1147,7 @@ PROJECT STATUS
 
 CONFIG
   Version   : v2.5.0
-  Plugins ON: superpowers, context7 (~1000t)
+  Plugins ON: superpowers, frontend-design, context7 (~1200t)
   GSD v2    : installed (2.64.0)
 
 PROJECT
@@ -1330,14 +1328,14 @@ Sans ce check : `/status` chargerait un agent inexistant → erreur cryptique.
 
 ### Cas T — session-start avec 6 plugins actifs (tous affichés)
 
-**Avant v2.5.0 :** `gstack ui-ux-pro-max +3 more` — 4 plugins masqués.
+**Avant v2.5.0 :** `gstack frontend-design +4 more` — 4 plugins masqués.
 
 **Avec v2.5.0 :**
 ```
 ┌─ Claude Code config ──────────────────────────────────┐
-│  ✅ ON  : rtk superpowers            │
-│  🟢 ON  : gstack ui-ux-pro-max context7│
-│         + ruflo                          │
+│  ✅ ON  : security-guidance rtk superpowers            │
+│  🟢 ON  : gstack frontend-design ui-ux-pro-max context7│
+│         + ruflo plugin-dev                          │
 │  ⚫ OFF : none                                         │
 │  💰 ~5750t passif (52% budget)                        │
 │  📦 v2.5.0                                            │
@@ -1384,7 +1382,7 @@ COST: ~800t (superpowers seul)
 
 RECOMMENDATIONS:
   OK KEEP   : superpowers (peut être utile pour brainstorm initial)
-  DISABLE   : ui-ux-pro-max, gstack, context7, ruflo
+  DISABLE   : frontend-design, ui-ux-pro-max, gstack, context7, ruflo
   NOTE      : Pour un firmware vraiment simple (hotfix, modification ciblée),
               même superpowers peut être désactivé → ~0t passif
 ```
@@ -1504,9 +1502,9 @@ Developer se réoriente instantanément — pas de risque d'implémenter sur la
 
 ```
 ┌─ Claude Code config ──────────────────────────────────┐
-│  ✅ ON  : rtk superpowers            │
-│  🟢 ON  : gstack ui-ux-pro-max context7│
-│             ruflo                        │
+│  ✅ ON  : security-guidance rtk superpowers            │
+│  🟢 ON  : gstack frontend-design ui-ux-pro-max context7│
+│             ruflo plugin-dev                        │
 │  ⚫ OFF : none                                         │
 │  💰 ~5750t passif (52% budget)                        │
 │  📦 v2.6.0                                            │
@@ -1615,9 +1613,19 @@ Si `lib/` n'est pas un symlink vers le repo, `detect-plugins.sh` sourcé est la
 
 ---
 
-### Cas Z5 — ~~plugin-advisor warn sur skill-creator inactif~~ (obsolète depuis v3.3.0)
+### Cas Z5 — plugin-advisor warn sur plugin-dev inactif
 
-> **Obsolète :** `skill-creator` est désormais un skill built-in de Claude Code (toujours disponible, 0 token). Il n'est plus toggleable et n'apparaît plus dans les recommandations enable/disable du plugin-advisor.
+**Contexte :** projet React SaaS, `plugin-dev` resté actif par oubli.
+
+```
+/plugin-check "React SaaS avec FastAPI"
+
+SIGNALS: frontend, deploy, fast-libs(React)
+
+WARN: plugin-dev ON — aucun signal skill-creation détecté
+      → ~100t économisés si désactivé
+      → Activer uniquement quand vous créez des skills custom
+```
 
 ---
 
@@ -1629,7 +1637,7 @@ Si `lib/` n'est pas un symlink vers le repo, `detect-plugins.sh` sourcé est la
 SIGNALS: simple, embedded
 COST: ~800t (superpowers seul)
 
-DISABLE: ui-ux-pro-max, gstack, context7, ruflo
+DISABLE: frontend-design, ui-ux-pro-max, gstack, context7, ruflo, plugin-dev
 NOTE: Pour hotfix ultra-ciblé, superpowers aussi optionnel
 ```
 
@@ -1689,7 +1697,7 @@ NOTE: embedded project detected — minimal plugin footprint
 
 RECOMMENDATIONS:
   superpowers OPTIONAL
-  DISABLE: tout le reste (gstack, context7, ruflo)
+  DISABLE: tout le reste (frontend-design, gstack, context7, ruflo, plugin-dev)
   gsd v2: NOT recommended
 
 Workflow: /analyze src/wifi_driver.c → /ship-feature si multi-fichiers
@@ -1746,7 +1754,7 @@ SIGNALS: embedded (platformio.ini)
 NOTE: embedded project detected — minimal plugin footprint
 
 KEEP   : superpowers (optional)
-DISABLE: ui-ux-pro-max, gstack, context7, ruflo
+DISABLE: frontend-design, ui-ux-pro-max, gstack, context7, ruflo, plugin-dev
 gsd v2 : NOT recommended (sessions courtes, tâches atomiques)
 ```
 
@@ -2000,7 +2008,7 @@ Budget Pro note:
 ```
 Description contient...    →  Plugin
 ─────────────────────────────────────────────────────
-React / Vue / Svelte       →  frontend-design (built-in)
+React / Vue / Svelte       →  frontend-design ON
 Next.js 13+ / App Router   →  context7 WARN
 Prisma / Supabase          →  context7 ON
 "design élaboré" / tokens  →  ui-ux-pro-max ON
@@ -2008,6 +2016,6 @@ Docker + QA browser        →  gstack ON
 "plusieurs semaines"       →  gsd v2 CLI
 "5+ agents parallèles"     →  ruflo ON
 Rust / Python / Go / C     →  tout OFF sauf superpowers
-Mobile / Flutter / RN      →  frontend-design (built-in), gstack OFF
+Mobile / Flutter / RN      →  frontend-design ON, gstack OFF
 Hotfix / script rapide     →  tout OFF sauf superpowers
 ```

agents/plugin-advisor.md

@@ -29,12 +29,6 @@ command -v gsd &>/dev/null && gsd --version 2>/dev/null | head -1 || echo "gsd-n
 command -v rtk &>/dev/null && rtk --version 2>/dev/null | head -1 || echo "rtk-not-installed"
 command -v ruflo &>/dev/null && ruflo --version 2>/dev/null | head -1 || echo "ruflo-cli-not-in-path"
 
-# Built-in Claude Code skills (always available, 0 tokens, NOT toggleable):
-# - frontend-design: /mnt/skills/public/frontend-design/ — UI design guidance
-# - skill-creator: /mnt/skills/examples/skill-creator/ — create custom skills
-# Do NOT recommend enabling/disabling these — they are always present.
-# Do NOT count them in passive token cost.
-
 # Project signals (run from project root)
 ls package.json pyproject.toml Cargo.toml go.mod 2>/dev/null | head -5
 grep -rl "next\|react\|vue\|prisma\|supabase" package.json 2>/dev/null | head -3 || true
@@ -72,7 +66,7 @@ Detect signals from the project description and filesystem scan:
 | `fast-libs` | Next.js, React 18+, Prisma, Supabase, Drizzle, Expo SDK in deps |
 | `multi-agent` | "orchestrate agents", "parallel workers", "swarm", >5 concurrent agents needed |
 | `complex-arch` | multiple services, event bus, distributed system in description |
-| `skill-creation` | "create a skill", "new skill", "custom skill", `/skill-creator` in description |
+| `skill-creation` | "create a skill", "new skill", "custom skill", `/plugin-dev:create-plugin` in description |
 | `embedded` | "firmware", "bare-metal", "microcontroller", "STM32", "ESP32", "RTOS", "driver", "kernel", "bootloader" in description; **or** `platformio.ini` present; **or** linker script (`*.ld`, `*.lds`) present; **or** `Makefile` + `src/*.c` + no `package.json`/`Cargo.toml`/`go.mod`/`setup.py`/`pyproject.toml` (C project without standard ecosystems). Note: `.c` files with a Rust/Node/Go manifest = FFI binding, NOT embedded. |
 | `simple` | single file, hotfix, quick script, no frontend, no deploy |
 
@@ -104,17 +98,17 @@ ACTION REQUIRED? YES / NO
 
 | Signal | Enable / Use | Disable / Skip | Notes |
 |---|---|---|---|
-| `frontend` | ui-ux-pro-max | — | frontend-design is built-in (always available) |
-| `mobile` (React Native/Expo/Flutter) | — | gstack (no browser QA), Docker N/A | frontend-design built-in; ui-ux-pro-max optional |
+| `frontend` | frontend-design, ui-ux-pro-max | — | Both complement each other |
+| `mobile` (React Native/Expo/Flutter) | frontend-design | gstack (no browser QA), Docker N/A | ui-ux-pro-max optional |
 | `monorepo` | per-package plugin recommendations | avoid recommending gstack for whole repo if only one package has browser QA | Specify which plugin applies to which package |
-| `design-system` | ui-ux-pro-max | — | frontend-design built-in; ui-ux-pro-max adds design system depth |
+| `design-system` | frontend-design, ui-ux-pro-max | — | High overlap but both useful |
 | `deploy` + `browser-qa` | gstack | — | Full-product workflow |
 | `multi-session` | gsd v2 CLI | — | Run `gsd` in terminal, not CC plugin |
 | `fast-libs` | context7 | — | Doc freshness critical |
 | `multi-agent` + `complex-arch` | ruflo (MCP) | — | Only if genuine swarm needed |
 | `simple` / single-session | — | gsd, gstack, ruflo, ui-ux-pro-max | Saves ~3000-5000t |
 | `embedded` / firmware | — | all toggles; superpowers optional | workflow: /analyze → edit or /ship-feature |
-| backend/lib/CLI only | — | ui-ux-pro-max, gstack | frontend-design built-in (0t) |
+| backend/lib/CLI only | — | frontend-design, ui-ux-pro-max, gstack | ~3100t saved |
 | small project / hotfix | — | gstack, ruflo, gsd | Overhead exceeds value |
 
 **GSD v2 note:** `gsd-pi` is a standalone CLI (Pi SDK), not a Claude Code plugin. Zero passive token cost in CC sessions. Recommend when: feature > 1 day, multiple isolated context windows needed, crash recovery, cost tracking, or parallel workers. Usage: `gsd` in terminal → `/gsd auto`.
@@ -129,6 +123,7 @@ ACTION REQUIRED? YES / NO
 
 | Pair | Relation | Verdict |
 |---|---|---|
+| frontend-design ↔ ui-ux-pro-max | ⚠️ Overlap | Both do UI styling. Keep both for design-heavy projects; drop ui-ux-pro-max for simple UIs. ~600t combined. |
 | gstack ↔ gsd v2 | ✅ Complementary | GStack = full-product CC workflow. GSD v2 = multi-session CLI. Different scopes, no conflict. |
 | gstack ↔ ruflo | ⚠️ Overlap | Both orchestrate multi-step workflows. GStack is CC-native; ruflo is MCP swarm. High combined overhead (~3250-4250t). Use one or the other. |
 | gsd v2 ↔ ruflo | ⚠️ Overlap | GSD v2 = sequential session pipeline. Ruflo = parallel agent swarm. Pick one per project; ruflo only if genuinely parallel work needed. |
@@ -136,35 +131,33 @@ ACTION REQUIRED? YES / NO
 | superpowers ↔ gstack | ✅ Complementary | Used together in /init-project and /ship-feature. Superpowers = engine, GStack = full-product skills. |
 | superpowers ↔ ruflo | ⚠️ Overlap | Both can orchestrate agent sub-tasks. Together only for advanced hybrid setups. |
 | context7 ↔ any | ✅ Independent | Doc lookup MCP, no workflow overlap. Always safe to combine. |
+| plugin-dev ↔ superpowers | ⚠️ Minor overlap | Superpowers can create skills too. Keep plugin-dev only when actively building new plugins/skills. |
+| frontend-design ↔ gstack | ✅ Complementary | GStack = deploy/QA layer; frontend-design = UI quality layer. Different concerns. |
+| pr-review-toolkit ↔ superpowers | ✅ Complementary | superpowers:requesting-code-review and /pr-review-toolkit:review-pr cover different review styles. |
 | rtk ↔ any | ✅ Independent | Hook-only token compression. Zero interaction with any plugin. |
-
-> **Built-in skills (always available, 0 tokens, not toggleable):**
-> - `frontend-design` — UI design guidance, always loaded on demand
-> - `skill-creator` — create custom skills from conversation, always loaded on demand
-> These do NOT appear in enable/disable recommendations. They complement all plugins without conflict.
+| security-guidance ↔ any | ✅ Independent | Hook-only security rules. Zero interaction. |
 
 ### Recommended sets by project type
 
 | Project type | Plugins ON | OFF | Passive cost |
 |---|---|---|---|
-| Backend API / microservice | superpowers, context7 (if fast libs) | ui-ux-pro-max, gstack, ruflo | ~800t |
-| Frontend SPA / SSR | superpowers, ui-ux-pro-max, context7 | gstack, ruflo | ~1400t |
-| Full-stack SaaS | superpowers, gstack, ui-ux-pro-max, context7 | ruflo | ~4150t |
+| Backend API / microservice | superpowers, context7 (if fast libs) | frontend-design, ui-ux-pro-max, gstack, ruflo | ~800t |
+| Frontend SPA / SSR | superpowers, frontend-design, ui-ux-pro-max, context7 | gstack, ruflo | ~1600t |
+| Full-stack SaaS | superpowers, gstack, frontend-design, ui-ux-pro-max, context7 | ruflo | ~4400t |
 | CLI tool / library | superpowers | all toggles | ~800t |
 | Multi-session large feature | superpowers + gsd v2 CLI (external) | ruflo (unless parallel) | ~800t CC |
 | Quick fix / hotfix | superpowers | all toggles | ~800t |
-| Design system / component lib | superpowers, ui-ux-pro-max | gstack, ruflo, gsd | ~1200t |
-| Fast-evolving libs (Next.js etc.) | superpowers, context7 | ruflo | ~1000t |
-| Enterprise multi-agent orchestration | superpowers, ruflo + gsd v2 (external) | — | ~2300t CC |
+| Design system / component lib | superpowers, frontend-design, ui-ux-pro-max | gstack, ruflo, gsd | ~1600t |
+| Fast-evolving libs (Next.js etc.) | superpowers, context7, frontend-design | ruflo | ~1200t |
+| Enterprise multi-agent orchestration | superpowers, ruflo + gsd v2 (external) | plugin-dev | ~2300t CC |
 
-> rtk is ALWAYS ON (0 tokens) — omitted from cost estimates.
-> frontend-design and skill-creator are built-in (0 tokens) — always available, omitted from recommendations.
+> security-guidance and rtk are ALWAYS ON (0 tokens) — omitted from cost estimates for clarity.
 
 ### Conditional rules
 
 ```
 RULE: IF "mobile" signal (React Native/Expo/Flutter detected):
-  → frontend-design available (built-in, 0t)
+  → frontend-design ON (~200t) — mobile UI components
   → gstack OFF — no browser QA on mobile
   → Docker NOT relevant — no server-side containerization for mobile
   → ui-ux-pro-max OPTIONAL (~400t) — only if design system complexity is high
@@ -172,12 +165,13 @@ RULE: IF "mobile" signal (React Native/Expo/Flutter detected):
 RULE: IF "monorepo" signal detected:
   → scan each top-level package individually for frontend/deploy/fast-libs signals
   → recommend plugins per-package, NOT for the whole repo
+  → if only apps/web/ has frontend: enable frontend-design for web package only
   → if only apps/api/ has deploy: gstack only if apps/api/ has browser QA too
   → NOTE in output: "Plugin X recommended for apps/web/ — disable for apps/api/"
   → passive cost estimate = highest-cost package profile (other packages add nothing)
 
 RULE: IF "frontend" signal OR .tsx/.jsx count > 0:
-  → frontend-design available (built-in, 0t) — no action needed
+  → frontend-design ON (~200t)
   → ui-ux-pro-max ON if "design-system" signal (~400t additional)
 
 RULE: IF "deploy" AND "browser-qa" signals:
@@ -198,7 +192,7 @@ RULE: IF "simple" OR "hotfix":
   → Disable all toggles. ~800t base only.
 
 RULE: IF "embedded" signal (firmware, bare-metal, microcontroller, or Makefile+C without Node/Rust/Go):
-  → Disable ALL toggles including gstack, context7, ruflo
+  → Disable ALL toggles including gstack, context7, ruflo, plugin-dev
   → superpowers OPTIONAL: useful for initial design brainstorm on complex drivers,
     but unnecessary for single-function patches — user decides
   → GSD v2 CLI: not recommended (sessions are short, tasks are atomic)
@@ -209,8 +203,12 @@ RULE: IF gstack ON AND ruflo ON:
   → WARN: functional overlap on multi-step orchestration
   → Suggest: gstack for CC-native workflow, ruflo only if parallel swarm needed
 
+RULE: IF plugin-dev ON AND no `skill-creation` signal detected:
+  → WARN: plugin-dev active but no skill-creation signal (~100t saved if disabled)
+  → Disable unless you're actively building custom plugins or skills
+
 RULE: IF `skill-creation` signal:
-  → skill-creator is built-in (always available, 0t) — no action needed
+  → plugin-dev ON (~100t)
   → superpowers ON — required for skill scaffolding
 
 RULE: IF `browser-qa` signal (e2e tests, Playwright/Cypress/Puppeteer in deps):
@@ -218,9 +216,9 @@ RULE: IF `browser-qa` signal (e2e tests, Playwright/Cypress/Puppeteer in deps):
   → context7 OPTIONAL (depends on framework version)
 
 RULE: IF `design-system` signal (tokens, theme files, Storybook present):
-  → frontend-design available (built-in, 0t)
+  → frontend-design ON (~200t)
   → ui-ux-pro-max ON (~400t)
-  → WARN if ui-ux-pro-max OFF with this signal: design system depth may suffer
+  → WARN if both are OFF with this signal: significant design gap
 
 RULE: IF `complex-arch` signal (multiple services, event bus, distributed system):
   → ruflo MCP ON (~500-1500t)
@@ -233,7 +231,7 @@ RULE: IF `complex-arch` signal (multiple services, event bus, distributed system
 ## BLOCK if
 
 - Superpowers not active → install: `claude plugin marketplace add obra/superpowers-marketplace && claude plugin install --scope user superpowers@superpowers-marketplace`
-- Significant frontend signal + ui-ux-pro-max off (for design-heavy projects)
+- Significant frontend signal + frontend-design AND ui-ux-pro-max both off
 - Full-product (UI+deploy+QA) + gstack not installed
 
 ## WARN (no block)

hooks/session-start.sh

@@ -48,10 +48,12 @@ unset _lib
 TOGGLE_ACTIVE=()
 TOGGLE_INACTIVE=()
 
-for plugin in gstack uiux_pro_max context7 ruflo; do
+for plugin in gstack uiux_pro_max frontend_design plugin_dev context7 ruflo; do
   # Map function name to display name
   case "$plugin" in
     uiux_pro_max)    display="ui-ux-pro-max" ;;
+    frontend_design) display="frontend-design" ;;
+    plugin_dev)      display="plugin-dev" ;;
     *)               display="$plugin" ;;
   esac
 
@@ -87,6 +89,8 @@ unset _claude_real _repo_dir
 _passive_t=0
 detect_superpowers 2>/dev/null && _passive_t=$((_passive_t + 800))
 detect_gstack      2>/dev/null && _passive_t=$((_passive_t + 2750))
+detect_frontend_design 2>/dev/null && _passive_t=$((_passive_t + 200))
+detect_plugin_dev  2>/dev/null && _passive_t=$((_passive_t + 100))
 detect_uiux_pro_max    2>/dev/null && _passive_t=$((_passive_t + 400))
 detect_context7    2>/dev/null && _passive_t=$((_passive_t + 200))
 detect_ruflo       2>/dev/null && _passive_t=$((_passive_t + 1000))
@@ -102,8 +106,7 @@ unset _passive_t _budget_pct
 
 echo ""
 echo "┌─ Claude Code config ──────────────────────────────────┐"
-printf "│  ✅ ON  : %-40s│\n" "rtk superpowers"
-printf "│  🔵 BUILT-IN: %-35s│\n" "frontend-design skill-creator"
+printf "│  ✅ ON  : %-40s│\n" "security-guidance rtk superpowers"
 # Plugin display — all plugins shown, split across 2 lines if >4
 _active_count=${#TOGGLE_ACTIVE[@]}
 _inactive_count=${#TOGGLE_INACTIVE[@]}

install-plugins.sh

@@ -322,11 +322,14 @@ install_plugin() {
   fi
 }
 
-# Built-in Claude Code skills (no install needed)
-ok "frontend-design — built-in Claude Code skill (always available)"
-ok "skill-creator — built-in Claude Code skill (always available)"
-ok "security-guidance — covered by RTK hook (no separate plugin exists)"
-warn "pr-review-toolkit — no marketplace plugin exists; removed from install"
+# Anthropic bundled plugins (from anthropics/claude-code repo)
+# These are NOT in claude-plugins-official — they require the claude-code marketplace
+info "Adding Anthropic bundled plugins marketplace..."
+claude plugin marketplace add anthropics/claude-code 2>/dev/null || true
+install_plugin "security-guidance"  "claude-code-plugins"
+install_plugin "frontend-design"    "claude-code-plugins"
+install_plugin "pr-review-toolkit"  "claude-code-plugins"
+install_plugin "plugin-dev"         "claude-code-plugins"
 
 echo ""
 
@@ -371,16 +374,16 @@ echo "║                     Install Summary                     ║"
 echo "╚══════════════════════════════════════════════════════════╝"
 echo ""
 echo "  ALWAYS ON (installed at user scope):"
+echo "    ✅ security-guidance   — PreToolUse security hook (0 tokens) [claude-code-plugins]"
 echo "    ✅ rtk                 — token compression hook (0 tokens)"
 echo "    ✅ superpowers         — brainstorm/plan/implement/debug workflow"
 echo ""
-echo "  BUILT-IN (Claude Code skills — always available, no install needed):"
-echo "    🔵 frontend-design     — /mnt/skills/public/frontend-design/"
-echo "    🔵 skill-creator       — /mnt/skills/examples/skill-creator/"
-echo ""
 echo "  TOGGLE (installed but start OFF — /plugin-check recommends when needed):"
 echo "    🔄 gstack              — ~/.claude/skills/gstack/ (→ submodule)"
 echo "    🔄 gsd v2              — standalone CLI 'gsd' (gsd-pi, not a Claude Code plugin)"
+echo "    🔄 plugin-dev          — create plugins/skills (~100 tokens) [claude-code-plugins]"
+echo "    🔄 pr-review-toolkit   — /pr-review-toolkit:review-pr (~300 tokens) [claude-code-plugins]"
+echo "    🔄 frontend-design     — UI design skill (~200 tokens) [claude-code-plugins]"
 echo "    🔄 ui-ux-pro-max       — user scope (~400 tokens)"
 echo "    🔄 context7 MCP        — see Step 7 above (~200 tokens)"
 echo "    🔄 ruflo MCP           — see Step 5 above (~500-1500 tokens, enterprise only)"

lib/detect-plugins.sh

@@ -24,6 +24,11 @@ detect_superpowers() {
   return 1
 }
 
+detect_security_guidance() {
+  local cache_dir="$HOME/.claude/plugins/cache"
+  [ -d "$cache_dir" ] && ls "$cache_dir" 2>/dev/null | grep -qi "security-guidance"
+}
+
 
 # --- Toggle plugins ---
 
@@ -37,12 +42,16 @@ detect_gsd() {
   command -v gsd &>/dev/null
 }
 
-# NOTE: frontend-design is a built-in Claude Code skill (/mnt/skills/public/frontend-design/).
-# It is always available and does not need detection. No detect_frontend_design() function needed.
-# NOTE: skill-creator is a built-in Claude Code skill (/mnt/skills/examples/skill-creator/).
-# It is always available and does not need detection. No detect_skill_creator() function needed.
-# NOTE: security-guidance does not exist as a plugin. RTK covers security hooks.
-# NOTE: pr-review-toolkit does not exist as a marketplace plugin.
+detect_frontend_design() {
+  local cache_dir="$HOME/.claude/plugins/cache"
+  [ -d "$cache_dir" ] && ls "$cache_dir" 2>/dev/null | grep -qi "frontend-design"
+}
+
+detect_plugin_dev() {
+  # plugin-dev replaces the old "skill-creator" reference
+  local cache_dir="$HOME/.claude/plugins/cache"
+  [ -d "$cache_dir" ] && ls "$cache_dir" 2>/dev/null | grep -qi "plugin-dev"
+}
 
 detect_uiux_pro_max() {
   local cache_dir="$HOME/.claude/plugins/cache"