Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/get-bb/bb/submit-a-pluginnpx skills add get-bb/bb --skill submit-a-plugingit clone --depth 1 https://github.com/get-bb/bbWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.00565 |
| Opus 5 | $0.00032 | $0.00282 |
| Sonnet 5 | $0.00013 | $0.00113 |
| Haiku 4.5 | $0.00006 | $0.00056 |
Grade A, and why
submit-a-plugin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Submit a plugin
Submit a public plugin to the BB Community marketplace. The marketplace stores plugin metadata. The plugin code stays in its Git repository or npm package.
Choose the task
If the user asks only for instructions, explain the process without remote changes.
If the user asks for a submission, prepare and validate everything possible. Ask only for information that the plugin, Git, npm, GitHub, or marketplace cannot supply.
A submission request does not approve a release. Before the first Git push, tag, npm publication, or other release mutation, show the exact account, repository, commit, package, version, source, and commands. Get approval for that release.
Do not expose credentials, private URLs, or local secrets.
Read current contracts
The marketplace contract can change independently from BB releases. Read these files from the default branch of https://github.com/get-bb/marketplace:
- README.md
- schema/marketplace.schema.json
- icons/README.md
- At least two current files in entries/
Treat those files as the contract. Use this skill for workflow and quality rules.
Workflow
- Read repository instructions, package.json, Git state, and release state.
- Validate the plugin with its package manager and bb plugin build.
- Select and verify one public release source.
- Get separate approval before any release mutation.
- Create one marketplace entry and a vendored icon.
- Validate the marketplace repository.
- Commit only the entry and icon.
- Open a pull request from the submitter account.
Read these references as the task reaches each stage:
- Read references/plugin-release.md before validating or releasing a plugin.
- Read references/marketplace-entry.md before creating the entry or icon.
- Read references/pull-request.md before cloning, validating, or submitting the marketplace repository.
Use scripts/derive-plugin-id.mjs to calculate the same plugin ID that BB uses:
node /PATH/TO/THIS/SKILL/scripts/derive-plugin-id.mjs /PATH/TO/PLUGIN/package.json
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 71 lines · 64 tokens per session scan A 4b544c164572
submit-a-plugin is a skill published in the GitHub repository get-bb/bb (2,762 stars, last pushed 2d ago), licensed MIT. It adds 64 tokens to every session and 565 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
emil-design-eng
This skill encodes Emil Kowalski's philosophy on UI polish, component design, animation decisions, and the invisible details that make software feel great.
cradle-cli
Use whenever you need to read, inspect, wait on, or mutate Cradle-owned state or workflows, including issues, delegation, sessions, awaits, CI/review waits, timed waits, Work inspection, workspaces and git inspection, Chronicle, automations, usage, observability, skills, agents, profiles, providers, preferences…
elysiajs
Create backend with ElysiaJS, a type-safe, high-performance framework.
transitions-dev
Production-ready CSS transitions for web apps. Use when implementing notification badges, dropdowns, modals, panel reveals, page transitions, card resizes, number pop-ins, text swaps, icon swaps, success checks, avatar group hovers, or error state shakes. Triggers on "add a transition", "animate the dropdown", "make…
userinterface-wiki
UI/UX best practices for web interfaces. Use when reviewing animations, CSS, audio, typography, UX patterns, prefetching, or icon implementations. Covers 11 categories from animation principles to typography. Outputs file:line findings.
cradle-observability-debugger
Debug Cradle local observability data by querying SQLite events/incidents/timeline, runtime snapshots, metrics, and server logs.