Agent Skills › Hmbown/CodeWhale › plugin-creator

plugin-creator

GitHub

用于在本地创建 Codewhale 插件包，包含版本清单、命名空间技能及信任审查。遵循 v0.9.1+ 规范，支持混合组件的按组件兼容性激活，确保未受信任或不受支持的组件保持库存状态。

crates/tui/assets/skills/plugin-creator/SKILL.md Hmbown/CodeWhale

Trigger Scenarios

用户需要创建本地 Codewhale 插件包初始化插件结构并配置 plugin.toml 验证和审查插件包的信任状态

Install

npx skills add Hmbown/CodeWhale --skill plugin-creator -g -y

More Options

Non-standard path

npx skills add https://github.com/Hmbown/CodeWhale/tree/main/crates/tui/assets/skills/plugin-creator -g -y

Use without installing

npx skills use Hmbown/CodeWhale@plugin-creator

指定 Agent (Claude Code)

npx skills add Hmbown/CodeWhale --skill plugin-creator -a claude-code -g -y

安装 repo 全部 skill

npx skills add Hmbown/CodeWhale --all -g -y

预览 repo 内 skill

npx skills add Hmbown/CodeWhale --list

SKILL.md

Frontmatter

{
    "name": "plugin-creator",
    "description": "Scaffold a local Codewhale plugin bundle with a versioned manifest, namespaced Skills, and an explicit trust review."
}

Plugin Creator

Use this skill when a user wants a local Codewhale plugin bundle. Codewhale v0.9.1 has a deliberately bounded loader: trusted and enabled bundles may add declarative Skills and MCP servers through the existing engines. Other component kinds are inventory-only.

Workflow

Pick a Codewhale-owned location:
- User bundle: ~/.codewhale/plugins/<plugin-name>/
- Workspace bundle: <workspace>/.codewhale/plugins/<plugin-name>/
Normalize the bundle name to lowercase hyphen-case.
Create plugin.toml:

schema_version = 1

[plugin]
name = "my-plugin"
version = "0.1.0"
description = "What this bundle provides"

[skills]
path = "skills"

Put each Skill under skills/<skill-name>/SKILL.md. Codewhale exposes it as my-plugin:<skill-name>, never as an unqualified command.
Add [mcp_servers.<name>] only when the bundle needs an existing MCP engine. Keep stdio commands and paths inside the bundle. Map local environment values only as exact ${SOURCE_ENV} references. For remote MCP, use HTTPS (or loopback HTTP), forbid URL user information/query/fragment, use only environment-backed headers or bearer tokens, and declare the exact normalized endpoint host set in [capabilities].network_hosts. Never place credentials in the manifest.
Declare commands, agents, hooks, LSP, native extensions, filesystem roots, or lifecycle mutation only when inventorying future work. Codewhale shows them as inactive and still activates reviewed Skills and MCP from the same bundle. A bundle that only declares those unsupported surfaces cannot be enabled.
Validate and review without executing bundle content:
- /plugin validate <plugin-name>
- /plugin show <plugin-name>
- /plugin enable <plugin-name> to open the content/capability review
- run the exact /plugin trust ... confirmation shown, then enable again
Verify /skills inspect reports plugin provenance and /plugin list reports the expected trust and activation state. Trust stages the reviewed content but does not activate it; enablement rebuilds the current workspace's Skill/MCP catalogue immediately.

Every user and workspace bundle starts untrusted and disabled. Do not add a marketplace, downloader, updater, compatibility scan, executable extension runtime, or automatic trust flow; those surfaces are outside v0.9.1.