Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• I can reproduce this bug with the latest version of Claude Code

Bug Description

tl;dr - plugins need individual folders and individual .claude-plugin/plugin.json to be respected.

When a marketplace defines multiple plugins from the same source directory, disabling one plugin has no effect - all skills from the entire directory are loaded regardless of enable/disable settings.

Reproduction

marketplace.json (from anthropic-agent-skills):

{
  "plugins": [
    {
      "name": "document-skills",
      "source": "./",
      "skills": ["./skills/xlsx", "./skills/docx", "./skills/pptx", "./skills/pdf"]
    },
    {
      "name": "example-skills", 
      "source": "./",
      "skills": [
        "./skills/algorithmic-art",
        "./skills/brand-guidelines",
        "./skills/canvas-design",
        ... (12 skills total)
      ]
    }
  ]
}

settings.json:

{
  "enabledPlugins": {
    "example-skills@anthropic-agent-skills": false,  // DISABLED
    "document-skills@anthropic-agent-skills": true
  }
}

Expected: Only xlsx, docx, pptx, pdf skills loaded (the 4 from document-skills)

Actual: ALL 16 skills loaded, including document-skills:algorithmic-art, document-skills:canvas-design, etc. from the disabled example-skills plugin

Root Cause Analysis

The skills array in marketplace.json appears to be completely ignored. Claude Code seems to:

1. See that document-skills is enabled with source: "./"
2. Recursively scan the entire ./ directory for any SKILL.md files
3. Load everything it finds, ignoring the explicit skills array whitelist

Impact

1. Plugin settings are meaningless - Users can't control which skills are loaded
2. Contributes to skill truncation - Extra unwanted skills push useful skills past the 30-skill limit (see [BUG] Skills truncated at 30 makes remaining skills undiscoverable #13343)
3. Confusing UI - Plugins appear as separate items in the UI but toggling them does nothing
4. Broken architecture - The marketplace.json schema implies fine-grained control that doesn't exist

Environment

• Claude Code version: 2.0.60 (Homebrew)
• OS: macOS
• Affected marketplace: anthropic-agent-skills (but likely affects any marketplace with multiple plugins sharing a source directory)

Expected Behavior

Either:

1. Respect the skills array - Only load skills explicitly listed for enabled plugins
2. Or require separate source directories - If sharing source directories isn't supported, enforce separate directories per plugin

Workaround

None currently. Disabling plugins in settings.json has no effect.