> ## Documentation Index > Fetch the complete documentation index at: https://docs.decimal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Claude Code Plugin > Search and install agent skills ranked by measured effectiveness, from inside Claude Code. Three slash commands, no account, no API key. Most skill directories rank by stars or downloads. DecimalAI ranks by evidence: a with-vs-without benchmark against a no-skill baseline, a safety scan, and an LLM intent review. This plugin puts that registry behind three slash commands, so the evidence is in front of you at the moment you are deciding what to install. ## Install ```text theme={null} /plugin marketplace add decimal-labs/decimalai-claude-plugins /plugin install decimalai@decimalai ``` About three seconds for the pair. No account, no API key, nothing to `pip install`. The plugin adds \~104 tokens to a session and ships no hooks and no MCP server — three command prompts, and nothing runs until you type one. ## The three commands ### `/decimalai:search ` Searches the public registry and ranks by measured effectiveness. Each row carries a SkillScore, the verified lift with the model and case count it was measured on, the safety band, and how many agents currently have it installed. Searching for `sql injection` surfaces `detecting-sql-injection-via-waf-logs` — +54.6 points over 22 cases on `gemini-3.6-flash`, safety **Passed**. ### `/decimalai:install ` Writes `.claude/skills//SKILL.md` plus the skill's attachments, stamped with `source` and `source_sha256` provenance frontmatter so you can tell later exactly what you installed and from which version. Pass the `url_slug` that search printed, not the `name` — a registry `name` may be namespaced (`owner/skill`), and a `/` is neither a URL path segment nor a directory name. ### `/decimalai:check` Writes the two files behind the [regression-check Action](/guides/regression-check): the manifest-extraction entry point `scripts/init_for_decimal.py`, and the workflow `.github/workflows/decimal-regression-check.yml`, with your repo's real `agent_name` filled in. The workflow it writes needs a `DECIMAL_API_KEY` repo secret — the check runs against your own production traces — and adding that secret is still yours to do. ## The command that refuses The registry indexes skills scraped from public repositories, and some of them are hostile. Search for `sql injection` and one of the matches is `performing-second-order-sql-injection`. That skill is the reason the two checks are separate. Its pattern scan came back **clean** — no secrets, no reverse shell, no exfiltration step. The intent review rejected it anyway, with the summary *"provides actionable instructions and commands for performing second-order SQL injection attacks, including database exploitation and credential extraction."* Scan passed; judge caught it. `/decimalai:search` lists it last, under a heading saying it will not install, with the reason — visible, never pickable. Listing it rather than hiding it is deliberate: you searched for something, and you are entitled to know a match exists and why it is withheld. `/decimalai:install` refuses it outright, and asks before writing anything banded **Caution** or **Not yet reviewed**. That refusal is a prompt in your own session, not a boundary the model cannot cross. Treat it as a convenience rather than a control — [why that distinction matters](/guides/trust-safety/what-scanning-cant-catch). The band on the skill's page is the check; the tooling is not. ## What leaves your machine The search query and the skill slug, as anonymous GETs to `api.decimal.ai`. No account is created and nothing is stored against you; those requests appear in server logs as described in §1.4 of the [privacy policy](https://app.decimal.ai/privacy). The plugin sends no telemetry of its own. DecimalAI has no record that you installed anything — which is also why a local install never feeds the effectiveness numbers you just used to choose the skill. In this registry's [vocabulary](/guides/vocabulary) that makes it an **Export**, whatever the command is called. ## Not using Claude Code? This is one of five routes from the registry to disk, and the only one that is Claude Code-specific — `/decimalai:install` writes to `.claude/skills/`. Web copy-paste, `decimalai skills pull`, raw URLs and the MCP server all work anywhere, and the MCP server in particular serves Cursor, Windsurf and anything else that speaks MCP. Side-by-side comparison of all five: [Use skills without the SDK](/guides/use-skills-without-the-sdk). ## Source [`decimal-labs/decimalai-claude-plugins`](https://github.com/decimal-labs/decimalai-claude-plugins) — MIT, and the command prompts are readable markdown, so you can see exactly what each one instructs Claude to do before you install it.