Habilidades plugin-creator
📦
plugin-creator
Revisión del contenido r1 Seguro 🌐 Acceso a red📁 Acceso al sistema de archivos⚙️ Comandos externos
Create Valid Codex Plugins
Manual plugin setup can produce invalid manifests and inconsistent marketplace entries. This skill scaffolds validated local plugins and manages personal marketplace metadata.
Compatible con: Claude Codex Code(CC)
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "plugin-creator" from https://skillstore.io/skills/plugin-creator.md and its manifest at https://skillstore.io/api/skills/plugin-creator/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "plugin-creator". Create a personal plugin named Incident Tools with skills and scripts.
Resultado esperado:
- Normalized plugin name: incident-tools.
- Created the manifest, skills directory, and scripts directory.
- Added the local marketplace entry and completed validation.
Usando "plugin-creator". Validate the plugin in my current repository.
Resultado esperado:
Validation failed because the manifest lacks a default prompt and references a missing icon. No files were changed.
Usando "plugin-creator". Refresh the cachebuster for my local plugin.
Resultado esperado:
Updated the plugin version with one Codex cachebuster suffix. The remaining manifest content was preserved.
Auditoría de seguridad
Segurov1 • 17/8/2026 Abrir el informe versionado
The skill intentionally creates and updates plugin files, including hidden Codex configuration under the user home directory. URL, IP, reconnaissance, path traversal, and shell backtick alerts are false positives caused by examples, SVG data, known paths, or Markdown. No prompt injection or unsafe command execution was found.
9
Archivos escaneados
1,701
Líneas analizadas
36
Elementos de revisión
0
Falsos positivos ignorados
Elementos de revisión de capacidades (36)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Alto
Hidden file in home directory
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
Medio
Hidden file access
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
"mcpServers": "./.mcp.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
"apps": "./.app.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
"mcpServers": "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
payload["mcpServers"] = "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
payload["apps"] = "./.app.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
"Create or update <home>/.agents/plugins/marketplace.json by default. "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
"Path to marketplace.json (defaults to <home>/.agents/plugins/marketplace.json). "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
2. Edit `<plugin-path>/.codex-plugin/plugin.json` when the request gives specific metadata.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
--marketplace-path <repo-root>/.agents/plugins/marketplace.json \
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Always creates `/<parent-plugin-directory>/<plugin-name>/.codex-plugin/plugin.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Medio
Hidden file access
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
Factores de riesgo
🌐 Acceso a red (9)
assets/plugin-creator-small.svg:2 references/plugin-json-spec.md:11 references/plugin-json-spec.md:13 references/plugin-json-spec.md:14 references/plugin-json-spec.md:28 references/plugin-json-spec.md:29 references/plugin-json-spec.md:30 references/plugin-json-spec.md:85 scripts/validate_plugin.py:268
📁 Acceso al sistema de archivos (37)
references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/plugin-json-spec.md:126 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:19 references/plugin-json-spec.md:20 references/plugin-json-spec.md:74 references/plugin-json-spec.md:126 references/plugin-json-spec.md:127 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:199 scripts/create_basic_plugin.py:77 scripts/create_basic_plugin.py:79 scripts/create_basic_plugin.py:216 scripts/create_basic_plugin.py:225 SKILL.md:236 SKILL.md:26 SKILL.md:50 SKILL.md:84 SKILL.md:89 SKILL.md:106 SKILL.md:206 SKILL.md:20 SKILL.md:26 SKILL.md:44 SKILL.md:50 SKILL.md:84 SKILL.md:87 SKILL.md:89 SKILL.md:106 SKILL.md:206
⚙️ Comandos externos (50)
scripts/create_basic_plugin.py:48 scripts/validate_plugin.py:60 scripts/validate_plugin.py:65 scripts/validate_plugin.py:68 scripts/validate_plugin.py:71 scripts/validate_plugin.py:79 scripts/validate_plugin.py:111 scripts/validate_plugin.py:117 scripts/validate_plugin.py:174 scripts/validate_plugin.py:180 scripts/validate_plugin.py:187 scripts/validate_plugin.py:192 scripts/validate_plugin.py:211 scripts/validate_plugin.py:226 scripts/validate_plugin.py:243 scripts/validate_plugin.py:253 scripts/validate_plugin.py:268 scripts/validate_plugin.py:282 scripts/validate_plugin.py:303 scripts/validate_plugin.py:304 scripts/validate_plugin.py:308 scripts/validate_plugin.py:320 scripts/validate_plugin.py:323 scripts/validate_plugin.py:326 scripts/validate_plugin.py:330 scripts/validate_plugin.py:333 scripts/validate_plugin.py:337 scripts/validate_plugin.py:341 scripts/validate_plugin.py:346 scripts/validate_plugin.py:349 scripts/validate_plugin.py:353 scripts/validate_plugin.py:354 scripts/validate_plugin.py:372 scripts/validate_plugin.py:401 scripts/validate_plugin.py:417 scripts/validate_plugin.py:422 scripts/validate_plugin.py:425 scripts/validate_plugin.py:429 scripts/validate_plugin.py:434 scripts/validate_plugin.py:437 scripts/validate_plugin.py:441 scripts/validate_plugin.py:445 scripts/validate_plugin.py:452 scripts/validate_plugin.py:474 scripts/validate_plugin.py:477 scripts/validate_plugin.py:480 scripts/validate_plugin.py:491 scripts/validate_plugin.py:511 scripts/validate_plugin.py:520 scripts/validate_plugin.py:527
Auditado por: codex
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/plugin-creator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/plugin-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/plugin-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
openai. (2026). plugin-creator security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/plugin-creator/audits/1Cita BibTeX
@techreport{openai-plugin-creator-2026,
author = {openai},
title = {plugin-creator security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/plugin-creator/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "plugin-creator security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/plugin-creator/audits/1"
identifiers:
- type: other
value: "skillstore:plugin-creator:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 77
Arquitectura
85
Mantenibilidad
87
Contenido
65
Comunidad
91
Cumplimiento de la especificación
Lo que puedes crear
Build a personal plugin
Create a personal plugin scaffold and register it in the default Codex marketplace.
Standardize team scaffolds
Create repository plugins with optional skills, hooks, scripts, assets, MCP, and app files.
Maintain local plugins
Validate manifests and refresh cachebuster versions during local development.
Prueba estos prompts
Create a basic plugin
Create a local plugin named [name] in my personal marketplace. Use default manifest values, then validate the result.
Add plugin components
Create [name] with skills, scripts, assets, MCP, and app companion files at [parent path]. Add it to my personal marketplace.
Create a team plugin
Scaffold [name] under [repository plugins path] and update [marketplace path]. Apply the requested installation policy, authentication policy, and category.
Update an existing plugin
Update the cachebuster for [plugin path], validate the plugin, and report contract failures. Preserve existing marketplace metadata and plugin content.
Mejores prácticas
- Specify whether the destination is personal or repository based before scaffolding.
- Review generated metadata before treating the plugin as complete.
- Run bundled validation after every manifest, skill, MCP, app, or asset change.
Evitar
- Do not use force when existing files or marketplace entries have not been reviewed.
- Do not add MCP or app manifest fields without creating their companion files.
- Do not hand-edit marketplace metadata during cachebuster updates.
Preguntas frecuentes
Does this skill publish plugins remotely?
No. It creates and manages local plugin files and marketplace entries.
Which file is always created?
Every scaffold includes a plugin manifest under the required hidden plugin directory.
Can it create optional plugin components?
Yes. It can create skills, hooks, scripts, assets, MCP, and app structures when requested.
Will it overwrite existing files?
Existing files are preserved unless force is explicitly enabled. Existing marketplace entries also require force for replacement.
Can it create repository or team plugins?
Yes. Provide explicit plugin and marketplace paths for a repository or team workflow.
Does validation execute plugin code?
No. The validator parses manifests and metadata, checks paths, and verifies referenced local files.
Detalles del desarrollador
Autor
openaiLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
bc37f12c64ad89ca965c1e90d44012af0469ec4e
Actualidad del mantenimiento
17/8/2026
Uso
0 descargas · 0 vistas
Estructura de archivos