スキル plugin-creator
📦
plugin-creator
コンテンツリビジョン r1 安全 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス⚙️ 外部コマンド
Create Valid Codex Plugins
Manual plugin setup can produce invalid manifests and inconsistent marketplace entries. This skill scaffolds validated local plugins and manages personal marketplace metadata.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "plugin-creator" from https://skillstore.io/skills/plugin-creator.md and its manifest at https://skillstore.io/api/skills/plugin-creator/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「plugin-creator」を使用しています。 Create a personal plugin named Incident Tools with skills and scripts.
期待される結果:
- Normalized plugin name: incident-tools.
- Created the manifest, skills directory, and scripts directory.
- Added the local marketplace entry and completed validation.
「plugin-creator」を使用しています。 Validate the plugin in my current repository.
期待される結果:
Validation failed because the manifest lacks a default prompt and references a missing icon. No files were changed.
「plugin-creator」を使用しています。 Refresh the cachebuster for my local plugin.
期待される結果:
Updated the plugin version with one Codex cachebuster suffix. The remaining manifest content was preserved.
セキュリティ監査
安全v1 • 2026/8/17 バージョン別レポートを開く
The skill intentionally creates and updates plugin files, including hidden Codex configuration under the user home directory. URL, IP, reconnaissance, path traversal, and shell backtick alerts are false positives caused by examples, SVG data, known paths, or Markdown. No prompt injection or unsafe command execution was found.
9
スキャンされたファイル
1,701
解析済み行数
36
レビュー項目
0
誤検知を無視
機能レビュー項目 (36)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
中
Hidden file access
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"mcpServers": "./.mcp.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"apps": "./.app.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"mcpServers": "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
payload["mcpServers"] = "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
payload["apps"] = "./.app.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"Create or update <home>/.agents/plugins/marketplace.json by default. "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"Path to marketplace.json (defaults to <home>/.agents/plugins/marketplace.json). "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
2. Edit `<plugin-path>/.codex-plugin/plugin.json` when the request gives specific metadata.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
--marketplace-path <repo-root>/.agents/plugins/marketplace.json \
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Always creates `/<parent-plugin-directory>/<plugin-name>/.codex-plugin/plugin.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
リスク要因
🌐 ネットワークアクセス (9)
assets/plugin-creator-small.svg:2 references/plugin-json-spec.md:11 references/plugin-json-spec.md:13 references/plugin-json-spec.md:14 references/plugin-json-spec.md:28 references/plugin-json-spec.md:29 references/plugin-json-spec.md:30 references/plugin-json-spec.md:85 scripts/validate_plugin.py:268
📁 ファイルシステムへのアクセス (37)
references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/plugin-json-spec.md:126 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:19 references/plugin-json-spec.md:20 references/plugin-json-spec.md:74 references/plugin-json-spec.md:126 references/plugin-json-spec.md:127 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:199 scripts/create_basic_plugin.py:77 scripts/create_basic_plugin.py:79 scripts/create_basic_plugin.py:216 scripts/create_basic_plugin.py:225 SKILL.md:236 SKILL.md:26 SKILL.md:50 SKILL.md:84 SKILL.md:89 SKILL.md:106 SKILL.md:206 SKILL.md:20 SKILL.md:26 SKILL.md:44 SKILL.md:50 SKILL.md:84 SKILL.md:87 SKILL.md:89 SKILL.md:106 SKILL.md:206
⚙️ 外部コマンド (50)
scripts/create_basic_plugin.py:48 scripts/validate_plugin.py:60 scripts/validate_plugin.py:65 scripts/validate_plugin.py:68 scripts/validate_plugin.py:71 scripts/validate_plugin.py:79 scripts/validate_plugin.py:111 scripts/validate_plugin.py:117 scripts/validate_plugin.py:174 scripts/validate_plugin.py:180 scripts/validate_plugin.py:187 scripts/validate_plugin.py:192 scripts/validate_plugin.py:211 scripts/validate_plugin.py:226 scripts/validate_plugin.py:243 scripts/validate_plugin.py:253 scripts/validate_plugin.py:268 scripts/validate_plugin.py:282 scripts/validate_plugin.py:303 scripts/validate_plugin.py:304 scripts/validate_plugin.py:308 scripts/validate_plugin.py:320 scripts/validate_plugin.py:323 scripts/validate_plugin.py:326 scripts/validate_plugin.py:330 scripts/validate_plugin.py:333 scripts/validate_plugin.py:337 scripts/validate_plugin.py:341 scripts/validate_plugin.py:346 scripts/validate_plugin.py:349 scripts/validate_plugin.py:353 scripts/validate_plugin.py:354 scripts/validate_plugin.py:372 scripts/validate_plugin.py:401 scripts/validate_plugin.py:417 scripts/validate_plugin.py:422 scripts/validate_plugin.py:425 scripts/validate_plugin.py:429 scripts/validate_plugin.py:434 scripts/validate_plugin.py:437 scripts/validate_plugin.py:441 scripts/validate_plugin.py:445 scripts/validate_plugin.py:452 scripts/validate_plugin.py:474 scripts/validate_plugin.py:477 scripts/validate_plugin.py:480 scripts/validate_plugin.py:491 scripts/validate_plugin.py:511 scripts/validate_plugin.py:520 scripts/validate_plugin.py:527
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/plugin-creator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/plugin-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/plugin-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
openai. (2026). plugin-creator security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/plugin-creator/audits/1BibTeX形式の引用
@techreport{openai-plugin-creator-2026,
author = {openai},
title = {plugin-creator security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/plugin-creator/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "plugin-creator security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/plugin-creator/audits/1"
identifiers:
- type: other
value: "skillstore:plugin-creator:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 77
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Build a personal plugin
Create a personal plugin scaffold and register it in the default Codex marketplace.
Standardize team scaffolds
Create repository plugins with optional skills, hooks, scripts, assets, MCP, and app files.
Maintain local plugins
Validate manifests and refresh cachebuster versions during local development.
これらのプロンプトを試す
Create a basic plugin
Create a local plugin named [name] in my personal marketplace. Use default manifest values, then validate the result.
Add plugin components
Create [name] with skills, scripts, assets, MCP, and app companion files at [parent path]. Add it to my personal marketplace.
Create a team plugin
Scaffold [name] under [repository plugins path] and update [marketplace path]. Apply the requested installation policy, authentication policy, and category.
Update an existing plugin
Update the cachebuster for [plugin path], validate the plugin, and report contract failures. Preserve existing marketplace metadata and plugin content.
ベストプラクティス
- Specify whether the destination is personal or repository based before scaffolding.
- Review generated metadata before treating the plugin as complete.
- Run bundled validation after every manifest, skill, MCP, app, or asset change.
回避
- Do not use force when existing files or marketplace entries have not been reviewed.
- Do not add MCP or app manifest fields without creating their companion files.
- Do not hand-edit marketplace metadata during cachebuster updates.
よくある質問
Does this skill publish plugins remotely?
No. It creates and manages local plugin files and marketplace entries.
Which file is always created?
Every scaffold includes a plugin manifest under the required hidden plugin directory.
Can it create optional plugin components?
Yes. It can create skills, hooks, scripts, assets, MCP, and app structures when requested.
Will it overwrite existing files?
Existing files are preserved unless force is explicitly enabled. Existing marketplace entries also require force for replacement.
Can it create repository or team plugins?
Yes. Provide explicit plugin and marketplace paths for a repository or team workflow.
Does validation execute plugin code?
No. The validator parses manifests and metadata, checks paths, and verifies referenced local files.
開発者情報
作成者
openaiライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
bc37f12c64ad89ca965c1e90d44012af0469ec4e
メンテナンスの新しさ
2026/8/17
利用状況
0 ダウンロード · 0 閲覧