Complete guide.

Three things, one purpose: a public Git repo, a private Git repo, and a web app. Claude Code reads directly from the Git repos. The web app is a discovery and SEO layer on top.

Wealthior-Group/marketplace          ← public source of truth
Wealthior-Group/marketplace-private  ← private source of truth
market.wealthior-group.ch            ← discovery + SEO

c:\Dev\marketplace\
├── plugins/                       ← PUBLIC plugins (pushed to public repo)
│   ├── .claude-plugin/
│   │   └── marketplace.json       ← public registry manifest
│   └── wealthior-vercel/
│       ├── .claude-plugin/plugin.json
│       └── skills/<skill>/SKILL.md
│
├── private/                       ← PRIVATE plugins (gitignored locally)
│   ├── .claude-plugin/
│   │   └── marketplace.json
│   └── wealthior-brand/
│       └── ...
│
├── apps/web/                      ← Next.js UI
├── supabase/migrations/           ← DB schema
└── vercel.ts                      ← Vercel config

Public plugins need no auth. One marketplace add, one install — both persist across sessions.

/plugin marketplace add Wealthior-Group/marketplace
/plugin install wealthior-vercel@marketplace
/plugin list

• Wealthior-Group/marketplace = the GitHub repo path.
• wealthior-vercel = the plugin name from plugin.json.
• @marketplace = the marketplace name from marketplace.json.

Skills auto-load when their description matches the task — no further action needed.

Private plugins live in a separate GitHub repo (Wealthior-Group/marketplace-private). They need a personal access token with read access.

1. Create a fine-grained PAT

github.com/settings/tokens → new token → repository access: only Wealthior-Group/marketplace-private → permissions: Contents · Read-only.

2. Export it

# bash / zsh
export GH_PAT=github_pat_yourTokenHere

# powershell
$env:GH_PAT = "github_pat_yourTokenHere"

3. Add the private marketplace

/plugin marketplace add Wealthior-Group/marketplace-private --token=$GH_PAT
/plugin install wealthior-brand@marketplace-private

1. Decide name (kebab-case, prefixed wealthior-).
2. Create plugins/wealthior-<name>/.
3. Add .claude-plugin/plugin.json.
4. Write at least one SKILL.md under skills/<skill-name>/.
5. Add README.md and LICENSE (MIT).
6. Append your entry to plugins/.claude-plugin/marketplace.json.
7. Run pnpm validate-marketplace — must pass.
8. Commit + push → webhook indexes within 30s.

Full SKILL.md template:

---
name: your-skill-name
description: Use when [trigger]. Covers [scope]. Skip when [exclusion].
---

# Display Title

Short intro.

## When to use
Concrete triggers.

## Rules
The actual content.

## Anti-patterns
What NOT to do.

Same as public, but lives under private/<plugin>/ and gets pushed to Wealthior-Group/marketplace-private instead. The local private/ folder is gitignored — push it to the private repo separately (or set it up as a git submodule).

# 1. Clone the private repo once (sibling folder works)
git clone git@github.com:Wealthior-Group/marketplace-private.git ../marketplace-private

# 2. Sync your changes
cp -r private/* ../marketplace-private/

# 3. Commit + push
cd ../marketplace-private
git add .
git commit -m "feat(plugins): add <plugin-name>"
git push origin main

• /plugin list shows the plugin as enabled.
• The skill triggers when you describe a matching task in a fresh conversation.
• The web detail page exists at market.wealthior-group.ch/plugins/<name> (public only).

Bump the version field in both plugin.json and the marketplace.json entry. Use semver. Commit + push. Users pull the update with:

/plugin update wealthior-<name>

# author side
rm -rf plugins/wealthior-<name>
# edit plugins/.claude-plugin/marketplace.json — delete the entry
pnpm validate-marketplace
git commit -am "chore(plugins): remove wealthior-<name>"
git push

# user side
/plugin uninstall wealthior-<name>

• Plugin not found: wrong marketplace name in @<name> — check the name field in marketplace.json.
• Access denied: PAT missing or expired. Regenerate, re-export, retry.
• Skill doesn't trigger: description too vague. Rewrite with specific trigger phrases.
• Validate fails: read the Zod error — it points to the wrong field.

For each repo (public + private): create on GitHub, push this monorepo or the private/ contents, configure a webhook at:

Payload URL: https://market.wealthior-group.ch/api/webhooks/github
Content type: application/json
Secret: same as GITHUB_WEBHOOK_SECRET env var
Events: just Pushes

Import Wealthior-Group/marketplace at vercel.com/new. Add env vars from .env.example. Assign domain market.wealthior-group.ch. Run the SQL from supabase/migrations/0001_initial.sql in your Supabase project. Done.