Skills plugin-forge

📦

plugin-forge

Name: plugin-forge
Author: softaworks

Content revision r1 High Risk 📁 Filesystem access🌐 Network access⚙️ External commands

Build Claude Code Plugins Faster

Claude Code plugin setup requires exact folders, manifests, and marketplace entries. Plugin Forge provides scripts and workflows that scaffold plugins, update versions, and guide local testing.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "plugin-forge" from https://skillstore.io/skills/softaworks-plugin-forge.md and its manifest at https://skillstore.io/api/skills/softaworks-plugin-forge/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/softaworks-plugin-forge.md Signed manifest GET /api/skills/softaworks-plugin-forge/manifest Signed lockfile GET /api/skills/softaworks-plugin-forge/lockfile

Test it

Using "plugin-forge". Create a plugin called api-helper for a local marketplace.

Expected outcome:

A new plugin folder is planned under the marketplace plugins directory.
The manifest and README template are created.
The marketplace entry is updated for local installation.

Using "plugin-forge". Bump my plugin after adding a new command.

Expected outcome:

The skill recommends a minor version update and checks both manifest locations for the same version.

Using "plugin-forge". Explain where hooks and MCP servers belong.

Expected outcome:

The response identifies the hooks configuration path, the MCP configuration file, and the rule that components live at the plugin root.

Security Audit

High Risk

v5 • 7/7/2026 Open versioned report

Most static findings are false positives from markdown code fences, placeholder URLs, or required .claude-plugin manifest paths. The scripts perform intended local file writes, and unvalidated plugin names create a path traversal risk if a crafted name is used. No prompt-injection or data-exfiltration intent was found.

Files scanned

1,175

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/create_plugin.py:17-29 scripts/create_plugin.py:43-45 scripts/bump_version.py:45-58

Unvalidated Plugin Name Path Traversal

The helper scripts build filesystem paths from the plugin_name argument without validating kebab-case or rejecting path separators. A crafted name can move writes outside the intended plugins directory.

The path components come directly from command-line plugin_name and are later used for mkdir or open writes. Exploitation requires passing a malicious name, so the confidence is high but context-dependent.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/bump_version.py:58

Python file write/append

with open(plugin_json_path, "w") as f:

The script writes plugin.json after deriving the target path from command-line inputs. This is intended functionality, but it is a real filesystem mutation that should be constrained to the marketplace tree.

Medium

scripts/bump_version.py:84

Python file write/append

with open(marketplace_json_path, "w") as f:

The script rewrites marketplace.json based on user-selected plugin and version inputs. This is expected release tooling, but it can alter marketplace metadata and should validate target paths.

Medium

scripts/create_plugin.py:44

Python file write/append

with open(plugin_json_path, "w") as f:

The script creates a plugin manifest at a path built from user-supplied marketplace root and plugin name. Without name validation, this write can affect unintended locations.

Medium

scripts/create_plugin.py:75

Python file write/append

with open(readme_path, "w") as f:

The script writes a README into the generated plugin directory using the same unvalidated path components. This is intended scaffolding, but it is a real local file write.

Medium

scripts/create_plugin.py:111

Python file write/append

with open(marketplace_json_path, "w") as f:

The script rewrites the marketplace manifest after adding a plugin entry. This is expected behavior, but it modifies local marketplace state and depends on unvalidated command-line input.

Risk Factors

📁 Filesystem access (13)

README.md:155 references/workflows.md:8 references/workflows.md:15 references/workflows.md:53 scripts/bump_version.py:58 scripts/bump_version.py:84 scripts/create_plugin.py:71 scripts/create_plugin.py:44 scripts/create_plugin.py:75 scripts/create_plugin.py:111 SKILL.md:66 SKILL.md:73 SKILL.md:193

🌐 Network access (1)

references/marketplace-schema.md:87

⚙️ External commands (44)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/softaworks-plugin-forge/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/softaworks-plugin-forge/security.svg)](https://skillstore.io/skills/softaworks-plugin-forge?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/softaworks-plugin-forge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/softaworks-plugin-forge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/softaworks-plugin-forge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

softaworks. (2026). plugin-forge security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/softaworks-plugin-forge/audits/5

BibTeX citation

@techreport{softaworks-softaworks-plugin-forge-2026,
  author = {softaworks},
  title = {plugin-forge security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/softaworks-plugin-forge/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "plugin-forge security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "softaworks"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/softaworks-plugin-forge/audits/5"
identifiers:
  - type: other
    value: "skillstore:softaworks-plugin-forge:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Internal Plugins

Scaffold plugins for team workflows and register them in a shared marketplace.

Maintain Plugin Releases

Synchronize semantic versions in plugin and marketplace manifests before publishing updates.

Learn Plugin Structure

Review supported component locations and local testing steps before building a plugin.

Try These Prompts

Create a Starter Plugin

Create a Claude Code plugin named <name> in my marketplace. Use author <name> and category <category>.

Add Plugin Components

Help me add a command and skill structure to my existing plugin. Explain which files I need and where they belong.

Prepare a Release

Review my plugin manifest and marketplace entry, then bump the version using semantic versioning for this change: <change summary>.

Audit a Marketplace Workflow

Analyze my plugin marketplace workflow for missing manifests, version drift, local testing gaps, and publish readiness.

Best Practices

Use kebab-case plugin names and reject path separators before running helper scripts.
Keep plugin.json and marketplace.json versions synchronized for every release.
Test plugins locally from a trusted marketplace worktree before publishing.

Avoid

Running scaffolding commands in an untrusted or unclear directory.
Editing only one manifest during a release.
Putting commands, hooks, or skills inside .claude-plugin instead of the plugin root.

Frequently Asked Questions

What does this skill create?

It creates plugin scaffolding, a plugin manifest, a README template, and a marketplace entry.

Does it publish plugins automatically?

No. It documents publishing steps, but users still control commits, pushes, and marketplace distribution.

Can it update existing plugin versions?

Yes. The version helper updates plugin and marketplace manifests using major, minor, or patch changes.

Does it work with Codex?

The documentation targets Claude Code plugins, but Codex can use the skill to edit files and run approved commands.

What should I check before running scripts?

Confirm the marketplace root, plugin name, author details, and expected files to be modified.

Does it generate complete plugin behavior?

No. It creates structure and templates. You still write the actual commands, skills, hooks, or agents.

Developer Details

Author

softaworks

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/softaworks/agent-toolkit/tree/main/skills/plugin-forge/

Ref

f93e9bb0daca99badb6a7e574b97737155d57cb3

Maintenance freshness

7/18/2026

Usage

29 downloads · 179 views

File structure

📁 references/

📄 marketplace-schema.md

📄 plugin-structure.md

📄 workflows.md

📁 scripts/

📄 bump_version.py

📄 create_plugin.py

📄 README.md

📄 SKILL.md

plugin-forge

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (1)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Create Internal Plugins

Maintain Plugin Releases

Learn Plugin Structure

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from softaworks

meme-factory

react-dev

humanizer

database-schema-designer

reducing-entropy

mermaid-diagrams

building-agents

agent-development

building-commands

analyzing-component-quality

creating-issues

plugin-creator

plugin-forge

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (1)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Create Internal Plugins

Maintain Plugin Releases

Learn Plugin Structure

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from softaworks

meme-factory

react-dev

humanizer

database-schema-designer

reducing-entropy

mermaid-diagrams

Related Skills

building-agents

agent-development

building-commands

analyzing-component-quality

creating-issues

plugin-creator