Plugin and skill search is now gated by a HIPAA-specific policy check that denies it outright under HIPAA mode
A new capability check, allow_plugin_skill_search, controls whether plugin and skill search is available. It is explicitly denied under HIPAA, an org policy mode for healthcare-regulated accounts. The underlying check also denies search when the feature is explicitly turned off by the organization, when it's latched to a previous decision, when it's unregistered, or when HIPAA mode is on; otherwise it falls back to a normal read/eligibility check.
This adds an explicit compliance gate so accounts under HIPAA policy cannot have Claude Code perform plugin or skill search, on top of the scope and policy checks already in place around search.