A plugin configuration example showing that an added skills path extends the default scan, while a commands path replaces the default command location. It also defines required API-key and working-directory settings.

Use it as a reference when configuring plugin skills, replacing command folders, or declaring sensitive and directory-based user settings.

It clarifies how plugin paths and user settings affect what the agent loads and where it operates.

declared — Plugin by codecast-sh

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Claude Code

/plugin marketplace add codecast-sh/codecast

agentmods

npx agentmods add plugins/codecast-sh/codecast/declared

Clone the repo

git clone --depth 1 https://github.com/codecast-sh/codecast

Made for: Claude Code.

Per session not measured What this adds to a session before it is invoked.

When invoked not measured Not applicable: nothing here is loaded into a session.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Security

Grade A, and why

declared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/cli/src/capabilities/__fixtures__/manifests/plugins/declared/.claude-plugin/plugin.json · 11 lines

What it actually says

{
  "name": "declared",
  "description": "Synthetic: skills path ADDS to the default scan, commands path REPLACES it.",
  "skills": ["./extra/added-skill"],
  "commands": ["./custom-commands"],
  "userConfig": {
    "apiKey": { "type": "string", "title": "API key", "sensitive": true, "required": true },
    "workdir": { "type": "directory", "title": "Working directory" }
  }
}

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 11 lines scan A c8d768894afb

Subscribe to this mod's changes

declared is a plugin published in the GitHub repository codecast-sh/codecast (30 stars, last pushed yesterday), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs agents claude claude-code codex cursor gemini

entire-dev-tools

Plugin marketplace listing 2 plugins: e2e, agent-integration.

entireio/cli · not measured

e2e

E2E test triage, debugging, and fix implementation toolkit.

entireio/cli · not measured

ctx

Plugin marketplace listing 1 plugin: ctx.

ctxrs/ctx · not measured

ai-dev-kit

DEPRECATED — the databricks-ai-dev-kit plugin is no longer published. Install skills via install.sh or databricks aitools install, which installs the official databricks plugin (Claude Code/Codex/Copilot) or raw skill files (Cursor/OpenCode/Antigravity). Not a move away from plugins. See .claude-plugin/DEPRECATED.m.

databricks-solutions/ai-dev-kit · not measured

notify-me

Calls you back when an agent needs you. The moment an agent gets blocked waiting on your decision, notify-me pushes a notification to your phone (via ntfy) and/or plays a sound on your computer — so you can step away and still know when you're needed. Works with any agent that supports plugin hooks. No account, no…

jovesun-lab/whetstone · not measured

alpha

alpha. A cli tool for evaluating coding agent plugins with a multi-tier approach.

bitwise-media-group/evolve · not measured