anybox-plugin-development

anybox-plugin-development is a skill for Claude Code, Codex from fanfan-de/anybox. It costs 82 tokens per session (2,135 once invoked), scanned A, original, MIT.

A skill for creating, reviewing, and checking Anybox third-party plugin packages. A plugin package bundles an add-on's metadata and optional skills, connectors, scripts, documentation, or assets.

In plain words
What is it for?
Use it to create plugin manifests, add plugin tools or skills, define connectors, package metadata, and verify that the catalog can find the plugin.
Why use it?
It provides the repository-specific structure and checks needed for the runtime to discover and install plugins correctly.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fanfan-de/anybox/anybox-plugin-development
Any agent
npx skills add fanfan-de/anybox --skill anybox-plugin-development
Clone the repo
git clone --depth 1 https://github.com/fanfan-de/anybox

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for anybox-plugin-development

README.md
[![agentmods](https://agentmods.dev/badge/skills/fanfan-de/anybox/anybox-plugin-development.svg)](https://agentmods.dev/skills/fanfan-de/anybox/anybox-plugin-development)
Your own site
<a href="https://agentmods.dev/skills/fanfan-de/anybox/anybox-plugin-development"><img src="https://agentmods.dev/badge/skills/fanfan-de/anybox/anybox-plugin-development.svg" alt="Measured on agentmods" height="20"></a>
Per session 82 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,135 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00082 $0.02135
Opus 5 $0.00041 $0.01068
Sonnet 5 $0.00016 $0.00427
Haiku 4.5 $0.00008 $0.00214

Measured 6d ago against content hash b7f1f86b86d1, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

anybox-plugin-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.anybox/skills/anybox-plugin-development/SKILL.md · 221 lines

How it starts

The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Anybox 插件开发

使用这个 skill 来为当前仓库的插件运行时创建插件包。遇到文档和代码不一致时,以运行代码为准。

参考来源:

  • 完整指南:../../../docs/anybox-third-party-plugin-development.md
  • 运行时事实来源:../../../packages/anyboxagent/src/plugin/plugin.ts
  • 回归测试和示例:../../../packages/anyboxagent/Test/plugin.test.ts

工作流

  1. 明确插件能力:MCP 工具、随包 skill、插件自带 connector,或平台 connector requirement。
  2. 选择插件包结构。默认使用版本化目录。
  3. 编写 .anybox-plugin/plugin.json,必须是严格 JSON,只使用运行时支持的顶层字段。
  4. .anybox-plugin 同级添加运行文件,例如 skills/connectors/scripts/docs/assets/
  5. 使用 Plugin.listCatalog() 验证 catalog 能发现插件。
  6. 如果修改了插件系统运行时代码,运行 bun test Test/plugin.test.ts

插件包结构

新插件默认使用这个结构:

<install-root>/
  <plugin-id>/
    <version>/
      .anybox-plugin/
        plugin.json
      skills/
        <skill-name>/
          SKILL.md
      connectors/
      scripts/
      docs/
      assets/

注意:

  • <install-root> 是包含一个或多个插件包目录的父目录;开发新插件时优先把它作为 ANYBOX_PLUGIN_LOCAL_DIR
  • 当前运行时用 ANYBOX_PLUGIN_LOCAL_DIR 发现固定本地插件仓库,未设置时默认是 Agent data 目录下的 plugins/local。这个目录逻辑上等价于 GitHub 插件仓库,只提供可安装候选项,不受卸载流程删除。
  • ANYBOX_PLUGIN_INSTALL_DIR 是受管理安装根目录,用于网络下载或从本地仓库安装时复制出来的插件包。这里的插件逻辑上属于已安装插件,运行时使用这里的副本,卸载时可能删除对应插件包。
  • 运行时只读取 .anybox-plugin/plugin.json;新插件必须写 .anybox-plugin/plugin.json
  • skillsconnectorsscriptsdocsassets 应放在 .anybox-plugin 同级,不要放进 .anybox-plugin 里。
  • 插件 ID 使用稳定的小写名称。目录名和 manifest name 尽量保持一致。

Manifest 规则

最小 manifest:

{
  "name": "my-plugin",
  "version": "0.1.0",
  "description": "My first Anybox plugin."
}

支持的顶层字段包括:

  • nameversiondescription
  • authorhomepagerepositorylicensekeywords
  • interface
  • mcpServers
  • skills
  • connectorRequirements
  • connectors
  • apps,仅用于旧兼容
  • commandsagents,当前是保留字段

未知顶层字段会被拒绝。

使用 interface 配置 catalog 展示信息:

{
  "interface": {
    "displayName": "Hello Anybox",
    "shortDescription": "A minimal plugin for learning plugin development.",
    "longDescription": "This plugin demonstrates a local stdio MCP server and a bundled Agent skill.",
    "developerName": "Your Name",
    "category": "Automation",
    "capabilities": ["demo", "mcp"],
    "logo": "HA",
    "brandColor": "#2563EB"
  }
}

Read the full file on GitHub · 221 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 221 lines · 82 tokens per session scan A b7f1f86b86d1

Subscribe to this mod's changes

anybox-plugin-development is a skill published in the GitHub repository fanfan-de/anybox (58 stars, last pushed 23d ago), licensed MIT. It adds 82 tokens to every session and 2,135 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens

chronicle

Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…

microsoft/vscode · 72 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens