AI Guides › Step-by-step guides

Install One Claude Code Plugin Pack, Then Audit What It Added

By Nigel Guy · 5 min read

The usual way to adopt a famous Claude Code setup is to install everything on day one and hope. You end up with hundreds of skills, a pile of hooks and a session that starts with extra context you never asked for, and you cannot tell which part helped or which part broke something. This guide uses the popular open-source "Everything Claude Code" repository, now branded ECC, as the worked example, but the method suits any plugin pack.

Before you start

• What it is. A public GitHub repo by a single maintainer (affaan-m) that bundles subagents, skills, slash commands, rules, hooks and MCP configs for coding agents. Its README describes it as MIT-licensed. The repo has been renamed, so you may see both "everything-claude-code" and "ECC" in older write-ups.
• What the README lists. At the time of checking: 68 agents, 293 skills, 94 commands. These counts change often, so treat them as a sense of scale, not a spec.
• Hackathon claim. The README says its security scanner, AgentShield, was built at a Claude Code hackathon run by Cerebral Valley and Anthropic in February 2026. I could not independently confirm that the author "won", so this guide does not rely on it. Judge the repo on what is in it.
• Cost. The repo itself is free. You still need a way to run Claude Code (a Claude plan or API usage). Check the £ price on Anthropic's page at checkout, because plans change. The README also mentions a paid GitHub App, ECC Pro, for private repositories; you do not need it.
• You need: Claude Code installed, a terminal, and a throwaway project to try this in first.

Step 1 — Confirm you have the official source

Install only from github.com/affaan-m/ECC, the npm packages ecc-universal or ecc-agentshield, or the maintainer's own site. The README warns that third-party mirrors may contain malware. Because a pack can run hooks and MCP servers on your machine, a lookalike repo is a real risk, not a theoretical one.

Step 2 — Pick exactly one install path

The README says to pick one path per tool and not stack methods; stacking duplicates skills, hooks and commands. Your options for Claude Code:

For a first run, use the from-source path with the minimal profile. The README describes profiles named minimal, core and full; full --enable-hooks is the everything option and not where to begin.

If you use the plugin route, Claude Code's own docs say /plugin install opens a details pane first. Read the "Will install" list there, then choose a scope. "Install for you, in this repo only" (local scope) is the cautious choice while you test.

Step 3 — Add rules by hand, and only the ones you use

Claude Code plugins cannot bundle rules, so the README has you copy them yourself:

mkdir -p ~/.claude/rules/ecc && cp -R rules/common ~/.claude/rules/ecc/

Add rules/common plus one language pack you actually write in. Rules are always loaded, so every extra pack costs context on every session.

Step 4 — Start with one workflow

The README's advice is to start with the workflow you need, not the whole catalogue. Two entry points it names: /ecc:plan for planning a feature, and the tdd-workflow skill for test-driven development. Pick one, use it on the throwaway project for a few sessions, and ignore the rest.

Step 5 — Scan the setup itself

The "security layer" is AgentShield, a scanner for agent configuration rather than your application code. The README says it checks secrets, permissions, hooks, MCP server risk and agent files. Run it from the project folder:

agentshield scan --path .

Treat the output as a prompt to read, not a certificate. A scanner cannot tell you whether a hook's intent is good.

Step 6 — Measure what it costs you

Two checks, both from official sources:

1. The ECC README says session start can inject up to 8,000 characters of extra context. You can tune it with ECC_SESSION_START_MAX_CHARS or switch it off with ECC_SESSION_START_CONTEXT=off.
2. For plugin installs, run claude plugin details <name> in your shell. Claude Code's docs say the Always-on line is the tokens the plugin adds to every session, with a per-component breakdown.

Check it worked

• Type / in Claude Code and confirm you can see the one workflow you chose, and that nothing appears twice.
• claude plugin list (plugin route) shows the pack with its scope and status.
• The agent-scan runs and you have read every finding, even the ones you dismiss.
• A fresh session on the throwaway project behaves the way it did before, plus your one new workflow.

If commands appear twice, you stacked two install methods. The README's fix is npx ecc-universal uninstall, then reinstall using one path.

What to skip

• The full profile and --enable-hooks on day one.
• The beta adapters for other tools (Cursor, Gemini, Zed and others) unless you actually use them. The README names Claude Code as the stable, primary target.
• Every language rule pack except the one you write in.
• Copying someone's whole setup because they won something. Install what answers a problem you have this week.
• Installing straight into a client project or a repo with production credentials nearby.

Guardrails

• This will not make Claude Code smarter. It adds workflow, structure and automation. It does not fix a vague brief.
• Hooks run code on your machine. Read hook files before enabling them, and prefer project or local scope while you are learning.
• Counts, versions and commands move. The maintainer ships often. Re-check the README before you paste a command from this guide.
• A scan is not an audit. If the setup will touch customer data or a team's repositories, get a human with security responsibility to review it.
• Unverified here: the hackathon "win", and any benefit claims. Test the pack against your own work.

Sources

• ECC (Everything Claude Code) on GitHub
• ECC README (raw)
• Claude Code docs: install and manage plugins
• Claude Code docs: plugin security and trust

All 751 AI guides · JulieMango plans from £17/mo