plugin-creator
Create Valid Codex Plugins
Manual plugin setup can produce invalid manifests and inconsistent marketplace entries. This skill scaffolds validated local plugins and manages personal marketplace metadata.
Π£ΡΡΠ°Π½ΠΎΠ²ΠΈΡΡ Ρ ΠΏΠΎΠΌΠΎΡΡΡ ΠΌΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°
Π‘ΠΊΠΎΠΏΠΈΡΡΠΉΡΠ΅ ΡΡΠΎΡ Π·Π°ΠΏΡΠΎΡ Π² ΡΠ²ΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°. ΠΠ½ ΡΠΎΠ΄Π΅ΡΠΆΠΈΡ ΠΊΠ°Π½ΠΎΠ½ΠΈΡΠ΅ΡΠΊΡΡ ΡΡΡΠ°Π½ΠΈΡΡ Skill ΠΈ ΠΌΠ°Π½ΠΈΡΠ΅ΡΡ.
Review the Skillstore skill "plugin-creator" from https://skillstore.io/skills/plugin-creator.md and its manifest at https://skillstore.io/api/skills/plugin-creator/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.ΠΠ°Ρ ΠΠ³Π΅Π½Ρ ΠΏΠΎ-ΠΏΡΠ΅ΠΆΠ½Π΅ΠΌΡ Π΄ΠΎΠ»ΠΆΠ΅Π½ ΠΏΠΎΠΊΠ°Π·Π°ΡΡ ΠΏΠ»Π°Π½ ΠΈ Π·Π°ΠΏΡΠΎΡΠΈΡΡ Π²ΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄Π΅Π½ΠΈΡ, ΡΡΠ΅Π±ΡΠ΅ΠΌΡΠ΅ ΠΏΠΎΠ»ΠΈΡΠΈΠΊΠΎΠΉ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ.
Π Π΅ΡΡΡΡΡ Π΄Π»Ρ AI-Π°Π³Π΅Π½ΡΠΎΠ²
ΠΡΠΏΠΎΠ»ΡΠ·ΡΠΉΡΠ΅ ΡΡΠΈ ΡΡΡΠ»ΠΊΠΈ, ΠΊΠΎΠ³Π΄Π° AI-Π°Π³Π΅Π½ΡΡ, crawler ΠΈΠ»ΠΈ script Π½ΡΠΆΠ΅Π½ ΡΠΈΡΡΡΠΉ ΠΊΠΎΠ½ΡΠ΅ΠΊΡΡ Π²ΠΌΠ΅ΡΡΠΎ ΠΏΠΎΠ»Π½ΠΎΠΉ ΡΡΡΠ°Π½ΠΈΡΡ.
ΠΡΠΎΡΠ΅ΡΡΠΈΡΠΎΠ²Π°ΡΡ
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«plugin-creatorΒ». Create a personal plugin named Incident Tools with skills and scripts.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
- Normalized plugin name: incident-tools.
- Created the manifest, skills directory, and scripts directory.
- Added the local marketplace entry and completed validation.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«plugin-creatorΒ». Validate the plugin in my current repository.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
Validation failed because the manifest lacks a default prompt and references a missing icon. No files were changed.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«plugin-creatorΒ». Refresh the cachebuster for my local plugin.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
Updated the plugin version with one Codex cachebuster suffix. The remaining manifest content was preserved.
ΠΡΠ΄ΠΈΡ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ
ΠΠ΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎThe skill intentionally creates and updates plugin files, including hidden Codex configuration under the user home directory. URL, IP, reconnaissance, path traversal, and shell backtick alerts are false positives caused by examples, SVG data, known paths, or Markdown. No prompt injection or unsafe command execution was found.
ΠΡΠ½ΠΊΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠ΅ΠΉ (36)
ΠΡΠΎ ΡΠ΅Π°Π»ΡΠ½ΡΠ΅ Π»ΠΎΠΊΠ°Π»ΡΠ½ΡΠ΅ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠΈ, ΠΊΠΎΡΠΎΡΡΠ΅ ΠΌΠΎΠ³ΡΡ ΠΎΠΆΠΈΠ΄Π°ΡΡΡΡ Π΄Π»Ρ ΡΡΠΎΠ³ΠΎ Π½Π°Π²ΡΠΊΠ°, ΠΏΠΎΡΡΠΎΠΌΡ ΠΎΠ½ΠΈ ΡΡΠ΅Π±ΡΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ, Π½ΠΎ Π½Π΅ ΡΡΠΈΡΠ°ΡΡΡΡ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠΌ Π²ΡΠ΅Π΄ΠΎΠ½ΠΎΡΠ½ΡΠΌ ΠΏΠΎΠ²Π΅Π΄Π΅Π½ΠΈΠ΅ΠΌ.
Π€Π°ΠΊΡΠΎΡΡ ΡΠΈΡΠΊΠ°
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ΅ΡΠΈ (9)
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅ (37)
βοΈ ΠΠ½Π΅ΡΠ½ΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ (50)
ΠΠΎΠ΄Π΅Π»ΠΈΡΡΡΡ ΠΈ ΡΠΈΡΠΈΡΠΎΠ²Π°ΡΡ ΡΡΠΎΡ ΠΎΡΡΠ΅Ρ
ΠΠ΅Π»ΠΈΡΠ΅ΡΡ Π²Π΅ΡΡΠΈΠΎΠ½Π½ΡΠΌ ΠΎΡΡΠ΅ΡΠΎΠΌ ΠΎΠ± ΠΎΡΠ΅Π½ΠΊΠ΅, Π½Π΅ΠΉΡΡΠ°Π»ΡΠ½ΡΠΌ Π·Π½Π°ΡΠΊΠΎΠΌ, Π²ΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠΎΠΉ ΠΊΠ°ΡΡΠΎΡΠΊΠΎΠΉ ΠΈ ΡΠΈΡΠ°ΡΠ°ΠΌΠΈ. Skillstore ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅Ρ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²Π°, Π½Π΅ ΡΠ΅ΡΠ°Ρ, Π±Π΅Π·ΠΎΠΏΠ°ΡΠ΅Π½ Π»ΠΈ ΡΡΠΎΡ Skill.
ΠΠΎΠΏΠΈΡΠΎΠ²Π°ΡΡ ΡΡΡΠ»ΠΊΡ Π½Π° ΠΎΡΡΡΡ
https://skillstore.io/skills/plugin-creator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportΠΠ½Π°ΡΠΎΠΊ Markdown
[](https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge)ΠΠ½Π°ΡΠΎΠΊ HTML
<a href="https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/plugin-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>ΠΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠ°Ρ ΠΊΠ°ΡΡΠΎΡΠΊΠ°
<iframe src="https://skillstore.io/embed/skills/plugin-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>ΠΠΊΠ°Π΄Π΅ΠΌΠΈΡΠ΅ΡΠΊΠΈΠ΅ ΡΡΡΠ»ΠΊΠΈ (APA Β· BibTeX Β· CFF)
Π¦ΠΈΡΠ°ΡΠ° APA
openai. (2026). plugin-creator security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/plugin-creator/audits/1Π¦ΠΈΡΠ°ΡΠ° BibTeX
@techreport{openai-plugin-creator-2026,
author = {openai},
title = {plugin-creator security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/plugin-creator/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "plugin-creator security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/plugin-creator/audits/1"
identifiers:
- type: other
value: "skillstore:plugin-creator:audit:1"
description: "Skillstore immutable audit report identifier"
ΠΡΠ΅Π½ΠΊΠ° Skillstore
ΠΠΎΡΠ΅ΠΌΡ ΡΠ°ΠΊΠ°Ρ ΠΎΡΠ΅Π½ΠΊΠ° ΠΠΎΡΡΠΎΠ²Π΅ΡΠ½ΠΎΡΡΡ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²: Π‘ΡΠ΅Π΄Π½ΠΈΠΉΠ§ΡΠΎ Π²Ρ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΠΏΠΎΡΡΡΠΎΠΈΡΡ
Build a personal plugin
Create a personal plugin scaffold and register it in the default Codex marketplace.
Standardize team scaffolds
Create repository plugins with optional skills, hooks, scripts, assets, MCP, and app files.
Maintain local plugins
Validate manifests and refresh cachebuster versions during local development.
ΠΠΎΠΏΡΠΎΠ±ΡΠΉΡΠ΅ ΡΡΠΈ ΠΏΡΠΎΠΌΠΏΡΡ
Create a local plugin named [name] in my personal marketplace. Use default manifest values, then validate the result.
Create [name] with skills, scripts, assets, MCP, and app companion files at [parent path]. Add it to my personal marketplace.
Scaffold [name] under [repository plugins path] and update [marketplace path]. Apply the requested installation policy, authentication policy, and category.
Update the cachebuster for [plugin path], validate the plugin, and report contract failures. Preserve existing marketplace metadata and plugin content.
ΠΡΡΡΠΈΠ΅ ΠΏΡΠ°ΠΊΡΠΈΠΊΠΈ
- Specify whether the destination is personal or repository based before scaffolding.
- Review generated metadata before treating the plugin as complete.
- Run bundled validation after every manifest, skill, MCP, app, or asset change.
ΠΠ·Π±Π΅Π³Π°ΡΡ
- Do not use force when existing files or marketplace entries have not been reviewed.
- Do not add MCP or app manifest fields without creating their companion files.
- Do not hand-edit marketplace metadata during cachebuster updates.
Π§Π°ΡΡΠΎ Π·Π°Π΄Π°Π²Π°Π΅ΠΌΡΠ΅ Π²ΠΎΠΏΡΠΎΡΡ
Does this skill publish plugins remotely?
Which file is always created?
Can it create optional plugin components?
Will it overwrite existing files?
Can it create repository or team plugins?
Does validation execute plugin code?
Π‘Π²Π΅Π΄Π΅Π½ΠΈΡ Π΄Π»Ρ ΡΠ°Π·ΡΠ°Π±ΠΎΡΡΠΈΠΊΠΎΠ²
ΠΠ²ΡΠΎΡ
openaiΠΠΈΡΠ΅Π½Π·ΠΈΡ
MIT
Π Π΅Π²ΠΈΠ·ΠΈΡ Skillstore
r1
ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ ΠΎ Π²Π΅ΡΡΠΈΠΈ
ΠΠ²ΡΠΎΡ Π½Π΅ ΡΠΊΠ°Π·Π°Π» Π²Π΅ΡΡΠΈΡ.
Π Π΅ΠΏΠΎΠ·ΠΈΡΠΎΡΠΈΠΉ
https://github.com/openai/codex/tree/e38290846c11424567c9c8226f2be8a2886c5929/codex-rs/skills/src/assets/samples/plugin-creatorΠ‘ΡΡΠ»ΠΊΠ°
bc37f12c64ad89ca965c1e90d44012af0469ec4e
ΠΠΊΡΡΠ°Π»ΡΠ½ΠΎΡΡΡ ΠΏΠΎΠ΄Π΄Π΅ΡΠΆΠΊΠΈ
17.08.2026
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅
0 Π·Π°Π³ΡΡΠ·ΠΎΠΊ Β· 0 ΠΏΡΠΎΡΠΌΠΎΡΡΠΎΠ²
Π‘ΡΡΡΠΊΡΡΡΠ° ΡΠ°ΠΉΠ»ΠΎΠ²
π agents/
π openai.yaml
π assets/
π plugin-creator.png
π references/
π installing-and-updating.md
π plugin-json-spec.md
π scripts/
π update_plugin_cachebuster.py
π validate_plugin.py
π SKILL.md