技能 plugin-creator
📦
plugin-creator
内容修订 r1 安全 🌐 网络访问📁 文件系统访问⚙️ 外部命令
Create Valid Codex Plugins
Manual plugin setup can produce invalid manifests and inconsistent marketplace entries. This skill scaffolds validated local plugins and manages personal marketplace metadata.
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "plugin-creator" from https://skillstore.io/skills/plugin-creator.md and its manifest at https://skillstore.io/api/skills/plugin-creator/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“plugin-creator”。 Create a personal plugin named Incident Tools with skills and scripts.
预期结果:
- Normalized plugin name: incident-tools.
- Created the manifest, skills directory, and scripts directory.
- Added the local marketplace entry and completed validation.
正在使用“plugin-creator”。 Validate the plugin in my current repository.
预期结果:
Validation failed because the manifest lacks a default prompt and references a missing icon. No files were changed.
正在使用“plugin-creator”。 Refresh the cachebuster for my local plugin.
预期结果:
Updated the plugin version with one Codex cachebuster suffix. The remaining manifest content was preserved.
安全审计
安全v1 • 2026/8/17 打开版本化报告
The skill intentionally creates and updates plugin files, including hidden Codex configuration under the user home directory. URL, IP, reconnaissance, path traversal, and shell backtick alerts are false positives caused by examples, SVG data, known paths, or Markdown. No prompt injection or unsafe command execution was found.
9
已扫描文件
1,701
分析行数
36
复核项
0
已忽略误报
能力复核项 (36)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
高
Hidden file in home directory
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references or updates the hidden Codex marketplace file under the user home directory.
中
Hidden file access
`~/.agents/plugins/marketplace.json`. On Windows, use the equivalent path under the user profile.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json`. You do not need `codex plugin marketplace add` for that
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"mcpServers": "./.mcp.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"apps": "./.app.json",
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"mcpServers": "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin in `~/.agents/plugins/marketplace.json`: `./plugins/<plugin-name>`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Example: with `~/.agents/plugins/marketplace.json`, `./plugins/<plugin-name>` resolves to
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal plugin: `~/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
payload["mcpServers"] = "./.mcp.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
payload["apps"] = "./.app.json"
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"Create or update <home>/.agents/plugins/marketplace.json by default. "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
"Path to marketplace.json (defaults to <home>/.agents/plugins/marketplace.json). "
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
2. Edit `<plugin-path>/.codex-plugin/plugin.json` when the request gives specific metadata.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
--marketplace-path <repo-root>/.agents/plugins/marketplace.json \
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json` is discovered implicitly, but other marketplace paths are not.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json`, with plugins generally being stored in
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Always creates `/<parent-plugin-directory>/<plugin-name>/.codex-plugin/plugin.json`.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
- Personal-marketplace creation defaults to `~/.agents/plugins/marketplace.json`. Here,
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
中
Hidden file access
`~/.agents/plugins/marketplace.json` path.
The workflow intentionally references, creates, or validates hidden plugin and marketplace files.
风险因素
🌐 网络访问 (9)
assets/plugin-creator-small.svg:2 references/plugin-json-spec.md:11 references/plugin-json-spec.md:13 references/plugin-json-spec.md:14 references/plugin-json-spec.md:28 references/plugin-json-spec.md:29 references/plugin-json-spec.md:30 references/plugin-json-spec.md:85 scripts/validate_plugin.py:268
📁 文件系统访问 (37)
references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/installing-and-updating.md:48 references/installing-and-updating.md:65 references/plugin-json-spec.md:126 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:19 references/plugin-json-spec.md:20 references/plugin-json-spec.md:74 references/plugin-json-spec.md:126 references/plugin-json-spec.md:127 references/plugin-json-spec.md:170 references/plugin-json-spec.md:173 references/plugin-json-spec.md:198 references/plugin-json-spec.md:199 scripts/create_basic_plugin.py:77 scripts/create_basic_plugin.py:79 scripts/create_basic_plugin.py:216 scripts/create_basic_plugin.py:225 SKILL.md:236 SKILL.md:26 SKILL.md:50 SKILL.md:84 SKILL.md:89 SKILL.md:106 SKILL.md:206 SKILL.md:20 SKILL.md:26 SKILL.md:44 SKILL.md:50 SKILL.md:84 SKILL.md:87 SKILL.md:89 SKILL.md:106 SKILL.md:206
⚙️ 外部命令 (50)
scripts/create_basic_plugin.py:48 scripts/validate_plugin.py:60 scripts/validate_plugin.py:65 scripts/validate_plugin.py:68 scripts/validate_plugin.py:71 scripts/validate_plugin.py:79 scripts/validate_plugin.py:111 scripts/validate_plugin.py:117 scripts/validate_plugin.py:174 scripts/validate_plugin.py:180 scripts/validate_plugin.py:187 scripts/validate_plugin.py:192 scripts/validate_plugin.py:211 scripts/validate_plugin.py:226 scripts/validate_plugin.py:243 scripts/validate_plugin.py:253 scripts/validate_plugin.py:268 scripts/validate_plugin.py:282 scripts/validate_plugin.py:303 scripts/validate_plugin.py:304 scripts/validate_plugin.py:308 scripts/validate_plugin.py:320 scripts/validate_plugin.py:323 scripts/validate_plugin.py:326 scripts/validate_plugin.py:330 scripts/validate_plugin.py:333 scripts/validate_plugin.py:337 scripts/validate_plugin.py:341 scripts/validate_plugin.py:346 scripts/validate_plugin.py:349 scripts/validate_plugin.py:353 scripts/validate_plugin.py:354 scripts/validate_plugin.py:372 scripts/validate_plugin.py:401 scripts/validate_plugin.py:417 scripts/validate_plugin.py:422 scripts/validate_plugin.py:425 scripts/validate_plugin.py:429 scripts/validate_plugin.py:434 scripts/validate_plugin.py:437 scripts/validate_plugin.py:441 scripts/validate_plugin.py:445 scripts/validate_plugin.py:452 scripts/validate_plugin.py:474 scripts/validate_plugin.py:477 scripts/validate_plugin.py:480 scripts/validate_plugin.py:491 scripts/validate_plugin.py:511 scripts/validate_plugin.py:520 scripts/validate_plugin.py:527
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/plugin-creator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/plugin-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/plugin-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/plugin-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
openai. (2026). plugin-creator security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/plugin-creator/audits/1BibTeX 引用
@techreport{openai-plugin-creator-2026,
author = {openai},
title = {plugin-creator security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/plugin-creator/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "plugin-creator security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "openai"
date-released: "2026-08-17"
url: "https://skillstore.io/skills/plugin-creator/audits/1"
identifiers:
- type: other
value: "skillstore:plugin-creator:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 77
架构
85
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
Build a personal plugin
Create a personal plugin scaffold and register it in the default Codex marketplace.
Standardize team scaffolds
Create repository plugins with optional skills, hooks, scripts, assets, MCP, and app files.
Maintain local plugins
Validate manifests and refresh cachebuster versions during local development.
试试这些提示
Create a basic plugin
Create a local plugin named [name] in my personal marketplace. Use default manifest values, then validate the result.
Add plugin components
Create [name] with skills, scripts, assets, MCP, and app companion files at [parent path]. Add it to my personal marketplace.
Create a team plugin
Scaffold [name] under [repository plugins path] and update [marketplace path]. Apply the requested installation policy, authentication policy, and category.
Update an existing plugin
Update the cachebuster for [plugin path], validate the plugin, and report contract failures. Preserve existing marketplace metadata and plugin content.
最佳实践
- Specify whether the destination is personal or repository based before scaffolding.
- Review generated metadata before treating the plugin as complete.
- Run bundled validation after every manifest, skill, MCP, app, or asset change.
避免
- Do not use force when existing files or marketplace entries have not been reviewed.
- Do not add MCP or app manifest fields without creating their companion files.
- Do not hand-edit marketplace metadata during cachebuster updates.
常见问题
Does this skill publish plugins remotely?
No. It creates and manages local plugin files and marketplace entries.
Which file is always created?
Every scaffold includes a plugin manifest under the required hidden plugin directory.
Can it create optional plugin components?
Yes. It can create skills, hooks, scripts, assets, MCP, and app structures when requested.
Will it overwrite existing files?
Existing files are preserved unless force is explicitly enabled. Existing marketplace entries also require force for replacement.
Can it create repository or team plugins?
Yes. Provide explicit plugin and marketplace paths for a repository or team workflow.
Does validation execute plugin code?
No. The validator parses manifests and metadata, checks paths, and verifies referenced local files.
开发者详情
作者
openai许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
bc37f12c64ad89ca965c1e90d44012af0469ec4e
维护新鲜度
2026/8/17
使用量
0 次下载 · 0 次浏览