claude-code - 💡(How to fix) Fix Show provenance/origin of slash commands (native, plugin, skill, author) [1 participants]

Summary

When browsing available slash commands (via / autocomplete or /help), there's no way to tell where a command comes from or who created it. As the ecosystem of plugins and skills grows, this becomes a real gap — both for discoverability and security/auditing.

Problem

A typical session might have 50+ slash commands from mixed sources:

• Native CLI commands built by Anthropic (/help, /config, /compact)
• Plugin skills from third parties (vercel:deploy, gstack:browse)
• Project-local skills from .claude/skills/
• User-global skills from ~/.claude/skills/

Today, the only way to tell them apart is by naming convention (namespaced prefixes) or by manually inspecting SKILL.md files. There's no metadata in the UI, no author field in skill frontmatter, and no visual distinction in the command list.

Proposed Solution

1. Show provenance in the / autocomplete and /help output — a tag or grouping like [native], [plugin: vercel], [skill: project], [skill: user]
2. Add optional author and source fields to skill frontmatter so skill creators can declare who made them:

   ---
   name: my-skill
   description: Does a thing
   author: "Anthropic"
   source: "plugin:vercel"
   ---

3. Group or filter commands by source — e.g., /help --source plugin or visual grouping in the autocomplete menu

Why This Matters

• Security/auditing: In team environments, knowing whether a command was added by a trusted plugin vs. an unknown skill is important. Skills execute with full agent capabilities.
• Discoverability: When you have 50+ commands, knowing which are native vs. plugin-provided helps users understand what's available and why.
• Debugging: When a slash command behaves unexpectedly, knowing its source is the first step to investigating.
• Trust signals: As the skill/plugin ecosystem grows, users need to know what they're running — similar to how VS Code shows extension publishers.

Current Workarounds

• Namespaced commands (e.g., vercel:deploy) hint at the source, but this is convention, not enforced
• Manually reading SKILL.md files or checking .claude/plugins/ directories
• Memorizing which commands are built-in vs. third-party

🤖 Generated with Claude Code