Skills building-plugins

📦

building-plugins

Name: building-plugins
Author: C0ntr0lledCha0s

v2.0.0 Content revision r1 Safe 🔑 Env variables⚙️ External commands🌐 Network access📁 Filesystem access⚡ Contains scripts

Build Claude Code Plugins

Creating Claude Code plugins requires correct structure, validation, documentation, and safe packaging. This skill guides users through plugin architecture, templates, validation, and publishing workflows.

Supports: Claude Codex Code(CC)

🥇 83 Gold

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "building-plugins" from https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-building-plugins/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/c0ntr0lledcha0s-building-plugins.md Signed manifest GET /api/skills/c0ntr0lledcha0s-building-plugins/manifest Signed lockfile GET /api/skills/c0ntr0lledcha0s-building-plugins/lockfile

Test it

Using "building-plugins". Create a minimal plugin for formatting project notes.

Expected outcome:

A proposed plugin structure with a manifest, one command, README sections, installation steps, and validation checklist.

Using "building-plugins". Validate this plugin before I publish it.

Expected outcome:

Manifest fields reviewed
Required files checked
Documentation gaps listed
Security recommendations summarized

Using "building-plugins". Turn these three commands into a reusable plugin.

Expected outcome:

A packaging plan that groups commands, names components consistently, adds metadata, and explains how to test installation.

Security Audit

Safe

v10 • 7/9/2026 Open versioned report

Static analysis flagged many high-risk patterns, but review found they are plugin-building documentation, safe templates, or defensive validation checks. No evidence found of credential exfiltration, malicious command execution, prompt injection, destructive filesystem behavior, or covert network activity.

Files scanned

3,551

Lines analyzed

Review items

False positives ignored

Risk Factors

🔑 Env variables (3)

references/plugin-architecture-guide.md:478 SKILL.md:173 SKILL.md:716

⚙️ External commands (50)

🌐 Network access (16)

references/plugin-distribution-guide.md:38 references/plugin-distribution-guide.md:107 references/plugin-distribution-guide.md:185 references/plugin-distribution-guide.md:187 references/plugin-distribution-guide.md:189 SKILL.md:113 SKILL.md:115 SKILL.md:116 SKILL.md:279 SKILL.md:281 SKILL.md:282 SKILL.md:574 SKILL.md:576 SKILL.md:578 templates/plugin-readme-template.md:24 templates/standard-plugin-template/README.md:33

📁 Filesystem access (16)

references/plugin-distribution-guide.md:41 references/plugin-distribution-guide.md:41 references/plugin-distribution-guide.md:41 SKILL.md:384 SKILL.md:259 SKILL.md:384 SKILL.md:384 templates/minimal-plugin-template/README.md:18 templates/minimal-plugin-template/README.md:18 templates/minimal-plugin-template/README.md:18 templates/plugin-readme-template.md:29 templates/plugin-readme-template.md:29 templates/plugin-readme-template.md:29 templates/standard-plugin-template/README.md:38 templates/standard-plugin-template/README.md:38 templates/standard-plugin-template/README.md:38

⚡ Contains scripts (1)

SKILL.md:722

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/c0ntr0lledcha0s-building-plugins/security.svg)](https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-building-plugins/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-building-plugins.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

C0ntr0lledCha0s. (2026). building-plugins security audit report (audit version 10) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins/audits/10

BibTeX citation

@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-building-plugins-2026,
  author = {C0ntr0lledCha0s},
  title = {building-plugins security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins/audits/10},
  note = {Author version 2.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "building-plugins security audit report (audit version 10)"
version: "2.0.0"
type: report
authors:
  - name: "C0ntr0lledCha0s"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/c0ntr0lledcha0s-building-plugins/audits/10"
identifiers:
  - type: other
    value: "skillstore:c0ntr0lledcha0s-building-plugins:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a first plugin

Generate a small plugin with a manifest, command, README, and installation guidance.

Package team automations

Bundle related agents, skills, commands, and hooks into one reusable plugin for a team.

Prepare marketplace release

Validate metadata, documentation, versioning, security notes, and distribution files before publishing.

Try These Prompts

Plan a simple plugin

Help me design a Claude Code plugin for [goal]. I want the simplest structure with one command and clear installation instructions.

Generate plugin files

Create a standard Claude Code plugin named [plugin-name] with a plugin.json manifest, README, one command, and one helper script.

Validate an existing plugin

Review my plugin directory for manifest errors, missing documentation, unsafe permissions, and publishing blockers.

Prepare a full release

Help me prepare [plugin-name] for marketplace release. Check versioning, marketplace metadata, security guidance, templates, examples, and migration notes.

Best Practices

Start with the smallest useful plugin and add components only when they share a clear purpose.
Keep permissions minimal and document any script, network, filesystem, or secret requirements.
Validate manifests, README content, examples, and installation steps before publishing.

Avoid

Do not bundle unrelated agents, commands, and hooks into one plugin only for convenience.
Do not pre-approve broad tools or destructive actions without a clear user-facing reason.
Do not publish templates that require hidden secrets or undocumented local configuration.