Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add doodledood/manifest-devnpx agentmods add plugins/doodledood/manifest-dev/manifest-dev-toolsgit clone --depth 1 https://github.com/doodledood/manifest-devGrade A, and why
manifest-dev-tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "manifest-dev-tools",
"version": "6.1.3",
"description": "Tools for prompts and PRs alongside the manifest workflow. Includes collaborative PR walkthroughs, autonomous PR review with independent per-gate manifest verification, author-side PR babysitting that forwards /do verification policy, gap-calibrated prompt engineering, cross-boundary context handoff, incremental teaching, and an eli5 explainer that renders any topic as big pictures and few words.",
"keywords": [
"post-processing",
"manifest",
"pr-review",
"walk-pr",
"walkthrough",
"autonomous-review",
"review-loop",
"babysit-pr",
"pr-lifecycle",
"prompt-engineering",
"prompts",
"handoff",
"context-handoff",
"teaching",
"teach-me",
"learning",
"session-explanation",
"eli5",
"explainer"
]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 27 lines scan A a9fb65e124fa
manifest-dev-tools is a plugin published in the GitHub repository doodledood/manifest-dev (72 stars, last pushed 3d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
dco-guard
PostToolUse hook that catches commits missing the Signed-off-by trailer — fires after every git command, stays silent in repositories that don't sign off, and suggests git rebase --signoff to repair.
ai-git
AI-powered git automation - Intelligent git skills that streamline version control workflows with .gitignore generation, commit-push-PR workflow, and a Codex Code Review loop that drives a PR to clean review.
monorepo-extras
Monorepo extras pack.
claude-bestpractice
Enforcement, memory and parallel-session coordination for solo founders running several Claude Code sessions on one repository.
codeops
Universal AI-development workflow: planning, requirements engineering, reverse-engineering, disambiguation, preflight audits, architecture docs, roadmaps, upgrades, and git commit flows. Ported from codeops-mcp.
code-quality
OxLint, Biome, and Prettier configuration, linting skills, and pre-commit hooks for consistent code quality.