We audited Anthropic's knowledge-work-plugins. Descriptions are 4.44% of skill bytes.

anthropics/knowledge-work-plugins is Anthropic's open-source collection of plugins for knowledge workers, from sales and legal to finance and small business. We cloned it at a pinned commit, walked every plugin offline, installed one skill into .claude/skills, and measured what an agent has to read to pick a skill. At the pin there are 123 marketplace plugins and 225 skill files, and the frontmatter descriptions add up to 86,182 bytes against 1,942,449 bytes of skill bodies, or 4.44%. The catch is that these are bytes on disk, and one of the MCP URLs the plugins point at returns 404.

The catch

We count bytes, which is a different thing from billed tokens. Treat 4.44% as a shape, small descriptions and large bodies, and measure tokens with your own tokenizer before you plan a context budget around it.

Counts depend on who is counting. The skills CLI --list against the same clone reports "Found 218 skills", while our per-plugin directory walk finds 225 SKILL.md files. The lab asserts the walk totals.

The marketplace also points outside the repo. Only 22 of the 123 plugins are local, and the plugins wire in remote MCP servers. Upstream's keyless URL probe, which we copied into scripts/upstream-check-mcp-urls.sh, ran on October 13, 2026 with 154 PASS and 1 FAIL. The failure was the data plugin's definite server at https://api.definite.app/v3/mcp/http, which returned 404. That probe runs on a schedule, outside the PR gate, and upstream counts 401, 403, 405 and 5xx as alive, so a pass means only that the server answered. Upstream's own scan-plugins.yml needs Anthropic Workload Identity Federation, so we left it out.

What we ran (keyless)

export DISABLE_TELEMETRY=1 DO_NOT_TRACK=1
bash scripts/vendor-upstream.sh
bun install
bunx tsc --noEmit
bun test
bun audit
test ! -e .cursor/skills && test ! -e .agents/skills
bun bin/kwp-audit.ts --json > audit.json
bun run report

From reports/kwp-plugin-audit.json, run on October 14, 2026, the green run took 17.8 s with 7 tests passing and 0 failing. The ten plugins with the most skills:

small-business alone carries 44 skills and 34,239 description bytes. bun audit found no vulnerabilities across 13 packages.

How it is wired

An agent with these plugins installed sees each skill's name and description first, picks one, and only then loads that SKILL.md. Our lab skill, pick-the-right-playbook, tells the agent to decide from descriptions and then load one body. The audit CLI exits 1 on structural errors in plugin.json or skill frontmatter, so a broken plugin fails CI before an agent ever reads it.

Minilab (open source)

The lab pins anthropics/knowledge-work-plugins at 02ffa99f (29,678 stars, Apache-2.0, Python, as of October 14, 2026) and commits one upstream skill, code-review. Re-run bash scripts/vendor-upstream.sh, bun install and bun run report, then try bun bin/kwp-audit.ts --top 10 on a newer commit to see how the budget moves.

bash scripts/vendor-upstream.sh && bun install && bun run report