Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/extracurricular-ai/codex-rewindnpx agentmods add skills/extracurricular-ai/codex-rewind/plugin-creatorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/extracurricular-ai/codex-rewind/plugin-creator)<a href="https://agentmods.dev/skills/extracurricular-ai/codex-rewind/plugin-creator"><img src="https://agentmods.dev/badge/skills/extracurricular-ai/codex-rewind/plugin-creator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/extracurricular-ai/codex-rewind/plugin-creator"><img src="https://agentmods.dev/badge/skills/extracurricular-ai/codex-rewind/plugin-creator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.02518 |
| Opus 5.5 | $0.00034 | $0.01007 |
| Sonnet 5.5 | $0.00017 | $0.00504 |
| Haiku 4.5 | $0.00009 | $0.00252 |
Grade A, and why
plugin-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to plugin-creator — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Creator
Quick Start
- Run the scaffold script:
# Plugin names are normalized to lower-case hyphen-case and must be <= 64 chars.
# The generated folder and plugin.json name are always the same.
# Run from the skill root (the directory containing this `SKILL.md`).
# By default creates in `~/plugins/<plugin-name>`.
python3 scripts/create_basic_plugin.py <plugin-name>
-
Edit
<plugin-path>/.codex-plugin/plugin.jsonwhen the request gives specific metadata. The scaffold starts with valid defaults and must not contain[TODO: ...]placeholders. -
Generate or update the personal marketplace entry when the plugin should appear in Codex UI ordering:
# Personal marketplace entries default to `~/.agents/plugins/marketplace.json`.
python3 scripts/create_basic_plugin.py my-plugin --with-marketplace
Only specify --marketplace-name <name> when the default personal marketplace name is already
taken or installed and you need to seed a different new marketplace file:
python3 scripts/create_basic_plugin.py my-plugin \
--with-marketplace \
--marketplace-name team-local
Only use a repo/team marketplace when the user specifically asks for that destination:
python3 scripts/create_basic_plugin.py my-plugin \
--path <repo-root>/plugins \
--marketplace-path <repo-root>/.agents/plugins/marketplace.json \
--with-marketplace
When the user specifies a marketplace path, make sure that marketplace is actually installed before
telling the user to reinstall from it. The default personal marketplace file at
~/.agents/plugins/marketplace.json is discovered implicitly, but other marketplace paths are not.
On Windows, use the equivalent path under the user profile.
- Generate/adjust optional companion folders as needed:
python3 scripts/create_basic_plugin.py my-plugin \
--path <parent-plugin-directory> \
--marketplace-path <marketplace-json-path> \
--with-skills --with-hooks --with-scripts --with-assets --with-mcp --with-apps --with-marketplace
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 339 B
- assets/plugin-creator-small.svg 1.3 KB
- assets/plugin-creator.png 1.5 KB
- references/installing-and-updating.md 5.9 KB
- references/plugin-json-spec.md 9.0 KB
- scripts/create_basic_plugin.py 11 KB runs code
- scripts/identifier_validation.py 784 B runs code
- scripts/read_marketplace_name.py 1.6 KB runs code
- scripts/update_plugin_cachebuster.py 3.0 KB runs code
- scripts/validate_plugin.py 21 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines 71b95b821964
- 1mo ago First seen · 244 lines · 86 tokens per session scan A 8fd56316b2c4
plugin-creator is a skill published in the GitHub repository extracurricular-ai/codex-rewind (56 stars, last pushed 28d ago), licensed Apache-2.0. It adds 86 tokens to every session and 2,518 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to plugin-creator, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
fast-resume
Search local coding-agent session history and identify safe resume commands. Use when the user asks to find, inspect, continue, or recover previous work from Claude Code, Codex, Pi, or another agent indexed by fast-resume.
agent-rollback
Use the agent-rollback MCP server or ar CLI to snapshot the workspace, list/show/diff checkpoints, and roll back unwanted changes. Use this skill whenever the user mentions checkpoints, rollback, undo, revert, restore, "go back to", "what changed", "I broke something", "this isn't working", or asks to inspect or…
temporal-debug
Use this skill when the user is debugging a bug, error, crash, or issue that might be tied to a specific point in time (e.g., "crash from 3 hours ago", "bug in v2.4.1", "last night's deploy"). It guides the agent to reconstruct the historical code state and analyze the bug in that context.
gate-release
Comprehensive pre-release review combining code quality, security audit, and production readiness checks.
gate-code
Review code implementation for security vulnerabilities, code quality, testing, and adherence to design specifications.
gate-design
Review technical design documents for API contracts, data models, component architecture, and technology decisions.