Codex Plugin Builder
Scaffold, validate, and maintain standards-shaped plugins for Codex.
The skill scopes default writes to local plugin and personal-marketplace paths, requires confirmation for non-default marketplace writes, discourages unintended overwrite, and exposes --force; no malware, credential theft, or covert exfiltration is evident. Points are deducted because it directly writes to ~/plugins and ~/.agents/plugins/marketplace.json without transactional rollback, and it does not fully document sensitive-file handling, data flow, or external command side effects.
The scripts, references, and validator are broadly consistent about naming, manifests, marketplaces, cachebusters, and readable error reporting. Points are deducted because static review cannot reproduce the key paths, no core-path test suite is shown, scaffold creation can leave partial state if marketplace updating fails, cachebuster writes are not atomic, and PyYAML availability is not explicitly documented.
Invocation scenarios, parameters, personal versus team marketplace boundaries, Windows path handling, and the update flow are relatively clear. Points are deducted for limited non-fit and compatibility guidance, no Chinese-language documentation or error messaging, and no file-level evidence that installation or updating is reachable from mainland-China networks; the core capability depends on a locally available Codex CLI.
The documentation uses quick start, workflow, reference specification, and validation sections, with substantial naming, defaults, schema, limitation, and update guidance; the repository supplies an Apache-2.0 license and verified OpenAI provenance. Points are deducted because skill-specific versioning policy, changelog, named maintenance responsibility, and explicit update channel are absent, while recovery examples for common failures are limited.
The skill supplies direct scripts for scaffolding plugins, generating marketplace entries, updating cachebusters, and validating manifests, so the intended output should be directly usable and reduce manual editing errors. Points are deducted because this review is static and does not verify generated output, CLI compatibility, or representative execution; users may still need to resolve permissions, installation state, and cleanup after failures.
The committed Python implementations, validator, reference schemas, and command examples provide auditable primary evidence for limited static tracing. Points are deducted because no dedicated tests covering the skill's key paths or independent execution evidence is provided, so reproducibility and cross-source corroboration remain thin.
- Before first use, confirm the target paths and the scope of --force; a later marketplace failure may leave the scaffolded plugin directory behind.
- Static review did not verify Codex CLI availability, PyYAML installation, platform paths, or actual reachability from mainland-China networks.
- Do not pass sensitive paths, marketplace configuration, or plugin contents to unreviewed external commands; the update flow has no automatic rollback.
What it does & when to use it
Plugin Creator is a Codex-focused scaffolding skill for creating plugin directories with the required `.codex-plugin/plugin.json`. It can also initialize optional skills, hooks, scripts, assets, MCP, and app structures, while managing personal marketplace entries. For existing local plugins, it provides a cachebuster update flow and validation command. Personal-marketplace support is the default; repository or team marketplaces are opt-in.
Runs scripts/create_basic_plugin.py to normalize a plugin name into lowercase hyphen-case, create the plugin root and a valid plugin.json, and optionally create companion folders and .mcp.json or .app.json. With --with-marketplace, it creates or updates the default ~/.agents/plugins/marketplace.json. It can read marketplace names, validate generated plugins with scripts/validate_plugin.py, and update an existing local plugin with scripts/update_plugin_cachebuster.py.
- A developer needs a personal Codex plugin scaffold with a valid manifest.
- A plugin author wants optional skills, hooks, scripts, or assets initialized together.
- A Codex user wants a new plugin added to the personal marketplace.
- A developer is iterating on a local plugin and needs the documented cachebuster update flow.
- A maintainer wants to validate a plugin structure before handing it back.
Pros & cons
- Generates the required manifest and plugin structure automatically.
- Provides explicit defaults for plugin names, marketplace entries, and policy fields.
- Supports personal marketplaces plus explicitly configured repository or team marketplaces.
- Includes validation and local-plugin cache update scripts.
- No standalone skill-installation workflow is documented.
- Requires Python 3 and local filesystem writes.
- Targets Codex plugin packaging, so other platforms require adaptation.
- The supplied material provides no test suite or cross-platform verification results.
How to install
The supplied material does not document a standalone installation command for this skill. The file is located at codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md in the repository. To use it with Codex, install Codex CLI as described in the README, for example with npm install -g @openai/codex, then run codex.
How to use
From the skill root containing SKILL.md, run python3 scripts/create_basic_plugin.py my-plugin. To add a personal marketplace entry, run python3 scripts/create_basic_plugin.py my-plugin --with-marketplace; add --with-skills, --with-hooks, --with-scripts, --with-assets, --with-mcp, or --with-apps for optional structures. Before delivery, run python3 scripts/validate_plugin.py <plugin-path>. The supplied material does not define an end-user trigger prompt.