Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add echoVic/blade-code --skill plugin-lifecycle-and-marketplacegit clone --depth 1 https://github.com/echoVic/blade-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/echovic/blade-code/plugin-lifecycle-and-marketplace)<a href="https://agentmods.dev/skills/echovic/blade-code/plugin-lifecycle-and-marketplace"><img src="https://agentmods.dev/badge/skills/echovic/blade-code/plugin-lifecycle-and-marketplace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/echovic/blade-code/plugin-lifecycle-and-marketplace"><img src="https://agentmods.dev/badge/skills/echovic/blade-code/plugin-lifecycle-and-marketplace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00184 | $0.03116 |
| Opus 5.5 | $0.00074 | $0.01246 |
| Sonnet 5.5 | $0.00037 | $0.00623 |
| Haiku 4.5 | $0.00018 | $0.00312 |
Grade A, and why
knowledge-extension-ecosystem-plugin-lifecycle-and-marketplace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Module Structure
插件域把可执行资源的来源校验、不可变安装、工作区发现、兼容性降级和 Session 前资源投影串成一条生命周期；HTTP、Slash Command、TUI 与 Web 只负责把用户意图送入同一协调层。
Directory Layout
packages/cli/src/plugins/— 插件清单、加载器、注册表、安装器、来源策略、兼容性与资源集成packages/cli/src/config/pluginSettings.ts— 启停作用域和来源策略输入归一化packages/cli/src/server/routes/plugins.ts— Web/HTTP 插件、Marketplace 与策略接口packages/cli/src/slash-commands/plugins.ts— CLI、Headless 与 ACP 共用的/plugins管理入口packages/cli/src/ui/components/PluginsManager.tsx— TUI 插件状态、更新和卸载界面packages/cli/web/src/components/settings/PluginPanel.tsx— Web 插件、来源策略与 Marketplace 管理面板docs/reference/workspace-plugin-lifecycle.md— 工作区插件生命周期行为契约packages/cli/tests/unit/services/plugin-package-manager.test.ts— 包存储、依赖事务和安全边界回归packages/cli/tests/integration/real-api/plugin-marketplace-trajectory.test.ts— 跨 ACP/Web 与新旧 Session 的真实轨迹验证
Key Entry Points
setWorkspacePluginEnabled()inpackages/cli/src/plugins/PluginLifecycle.ts— 持久化指定层级并重新协调注册表installWorkspacePlugin()inpackages/cli/src/plugins/PluginLifecycle.ts— 经过信任与来源策略后安装并刷新工作区投影PluginInstaller.install()inpackages/cli/src/plugins/PluginInstaller.ts— 物化依赖闭包并提交内容寻址安装记录PluginRegistry.initialize()inpackages/cli/src/plugins/PluginRegistry.ts— 按来源优先级发现插件并应用启停、策略和兼容性PluginIntegrator.integrateAll()inpackages/cli/src/plugins/PluginIntegrator.ts— 将全部活跃插件作为一个集合投影到命令、Skill、Agent 与 Hook
Gotchas
- 向
global、project或local写入成功不等于请求状态最终生效，因为更具体层级仍可覆盖它；调用方必须展示返回的effectiveEnabled与effectiveScope，不能只回显写入值 (packages/cli/src/plugins/PluginLifecycle.ts,packages/cli/src/config/ConfigManager.ts,git:16b3d6d) - 未受信任工作区的项目配置只能收紧插件状态：其中的
false会生效，true会被忽略，同时项目插件目录完全不参与发现 (packages/cli/src/config/ConfigManager.ts,packages/cli/src/plugins/PluginRegistry.ts) --plugin-dir插件不受enabledPlugins开关控制且不能持久化切换，但仍会经过来源策略和兼容性检查，因此“invocation-scoped”不等于绕过安全校验 (packages/cli/src/plugins/PluginLifecycle.ts,packages/cli/src/plugins/PluginRegistry.ts)- 修改插件状态或升级包只更新工作区注册表和后续 Session；已运行 Session 持有命令、Skill、Agent 与 Hook 的不可变快照，必须新建 Session 才能观察变化 (
packages/cli/src/agent/resources/WorkspaceAgentResources.ts,packages/cli/tests/integration/real-api/plugin-lifecycle-trajectory.test.ts) - Marketplace 刷新只替换目录快照，不会自动升级已经安装的插件；必须随后显式执行插件 update，旧 Session 仍继续读取旧内容根 (
packages/cli/src/plugins/PluginInstaller.ts,packages/cli/tests/integration/real-api/plugin-marketplace-trajectory.test.ts) - 自动 update/uninstall 只适用于包存储中有安装记录的受管插件；手工放入用户级或项目级插件目录的插件只能通过文件系统管理 (
packages/cli/src/plugins/PluginInstaller.ts,packages/cli/src/ui/components/PluginsManager.tsx) - 若
.blade-plugin/plugin.json存在但内容非法，解析会直接失败而不会回退到.claude-plugin/plugin.json；回退只发生在前一个清单不存在时 (packages/cli/src/plugins/PluginManifest.ts) - 可选资源的坏文件不一定让整个插件失败：单个命令、Agent、Skill 会被警告后跳过，非法 Hook/MCP 配置可能退化为未加载该资源，排障时不能只看插件总体
active状态 (packages/cli/src/plugins/PluginLoader.ts) - 禁用、缺失、版本不匹配或来源策略拦截的依赖会通过固定点计算继续把所有上游依赖者降为
error；只修复顶层插件不会恢复依赖链 (packages/cli/src/plugins/PluginCompatibility.ts,packages/cli/tests/unit/services/plugin-registry-compatibility.test.ts) - 收紧来源策略会重新检查已发现插件并可立即把现有插件置为
error，不是只约束下一次安装 (packages/cli/src/plugins/PluginLifecycle.ts,packages/cli/src/plugins/PluginRegistry.ts) - Git 主机通配符
*.example.test只匹配子域，不匹配example.test本身，也不会接受evilexample.test这类后缀混淆 (packages/cli/src/plugins/PluginSourcePolicy.ts,packages/cli/tests/unit/services/plugin-source-policy.test.ts) - 卸载只移除账本投影并清理三个可编辑配置层的残留开关，不删除历史内容寻址目录；这是为仍引用旧根的活动 Session 保留的行为 (
packages/cli/src/plugins/PluginLifecycle.ts,packages/cli/tests/unit/services/plugin-package-manager.test.ts)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 184 tokens per session scan A f485a2c23b15
knowledge-extension-ecosystem-plugin-lifecycle-and-marketplace is a skill published in the GitHub repository echoVic/blade-code (181 stars, last pushed 3d ago), licensed MIT. It adds 184 tokens to every session and 3,116 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
clinical-reports
Write comprehensive clinical reports including case reports (CARE guidelines), diagnostic reports (radiology/pathology/lab), clinical trial reports (ICH-E3, SAE, CSR), and patient documentation (SOAP, H&P, discharge summaries). Full support with templates, regulatory compliance (HIPAA, FDA, ICH-GCP), and validation…
clinical-decision-support
Generate professional clinical decision support (CDS) documents for pharmaceutical and clinical research settings, including patient cohort analyses (biomarker-stratified with outcomes) and treatment recommendation reports (evidence-based guidelines with decision algorithms). Supports GRADE evidence grading…
gget
Fast CLI/Python queries to 20+ bioinformatics databases. Use for quick lookups: gene info, BLAST searches, AlphaFold structures, enrichment analysis. Best for interactive exploration, simple queries. For batch processing or advanced BLAST use biopython; for multi-database Python workflows use bioservices.
immunology-assays
Computational analysis of immunology experimental data. ATAC-seq differential accessibility, immune cell tracking from microscopy, ELISA data processing with 4-parameter logistic fitting, immunohistochemistry quantification, antibody titer analysis, and cell cycle phase duration estimation. For flow cytometry use…
molecular-cloning
Molecular cloning simulation and design. PCR amplicon prediction, restriction enzyme digestion, Golden Gate and Gibson assembly simulation, primer design, CRISPR sgRNA design, and plasmid annotation. For protein-level sequence analysis use biopython or esm; for database lookups use gene-database or ensembl-database.
geo-database
Access NCBI GEO for gene expression/genomics data. Search/download microarray and RNA-seq datasets (GSE, GSM, GPL), retrieve SOFT/Matrix files, for transcriptomics and expression analysis.