Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hornfisk/plugindev-plugin/plugindevnpx skills add Hornfisk/plugindev-plugin --skill plugindevgit clone --depth 1 https://github.com/Hornfisk/plugindev-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00126 | $0.04596 |
| Opus 5 | $0.00063 | $0.02298 |
| Sonnet 5 | $0.00025 | $0.00919 |
| Haiku 4.5 | $0.00013 | $0.00460 |
Grade C, and why
plugindev scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
# Install VST3 (rm -rf first!) How it starts
The opening of the file, as written. The whole thing — 321 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Development (nih-plug + egui)
Prime directive
If your project already has a working plugin codebase, grep it before designing any new subsystem:
rg -l <topic> src/
Copy existing idioms and adapt names. This saves re-deriving RT-safety, thread sync, and persistence patterns.
For deeper reference on any topic below, see references/patterns.md in this skill's directory.
Real-time safety (audio thread)
nih-plug's assert_process_allocs panics on any heap allocation during process(). Keep the feature on — it catches real bugs. Wrap known false positives:
use nih_plug::util::permit_alloc;
// parking_lot mutex drop (unlock_slow may allocate)
permit_alloc(|| drop(shared));
// Arc clone/drop
permit_alloc(|| { voice.sample = Some(Arc::clone(sample)); });
permit_alloc(|| { self.data = None; }); // Arc::drop
// thread spawn, channel bounded, HashSet insert — all need permit_alloc
Rule of thumb: any op touching an allocator (Arc refcount, Vec growth, HashMap, spawn, formatted tracing) must be wrapped. Plain scalar/atomic ops are free.
Audio <-> GUI sync (three layers)
-
Hot state -> atomics. Wrap in
Arc<SyncStruct>shared with GUI. UseAtomicUsize/AtomicBool/AtomicU8for step pos, playing, trigger counts, tempo (BPM*10 as u32). Lock-free both directions. -
Bulk state ->
Arc<parking_lot::Mutex<SharedState>>. Audio thread usestry_lock(), neverlock(). If contended, skip MIDI/sequencer for this buffer — a few ms gap is inaudible vs blocking the RT thread. Alwayspermit_alloc(|| drop(guard)). -
GUI render -> DisplaySnapshot. Per frame: brief lock, copy metadata + waveforms into a plain struct, drop the lock, render from snapshot. No lock held during egui layout.
Handoff of large results (scanned library, loaded preset) -> crossbeam-channel::bounded(1), try_recv() in process().
DAW persistence
#[persist = "plugin-state"]
pub plugin_state: Arc<parking_lot::Mutex<String>>, // JSON blob
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 321 lines · 126 tokens per session scan C ed21c879a4e0
plugindev is a skill published in the GitHub repository Hornfisk/plugindev-plugin (4 stars, last pushed 3mo ago), licensed MIT. It adds 126 tokens to every session and 4,596 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
design-taste-frontend-v1
The original v1 taste-skill, preserved for projects depending on its exact behavior. The current default is design-taste-frontend (v2 experimental), which is a substantial rewrite. Use this v1 install name only if you need exact backward compatibility.
brandkit
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional…
high-end-visual-design
Teaches the AI to design like a high-end agency. Defines the exact fonts, spacing, shadows, card structures, and animations that make a website feel expensive. Blocks all the common defaults that make AI designs look cheap or generic.
gpt-taste
Elite UX/UI & Advanced GSAP Motion Engineer. Enforces Python-driven true randomization for layout variance, strict AIDA page structure, wide editorial typography (bans 6-line wraps), gapless bento grids, strict GSAP ScrollTriggers (pinning, stacking, scrubbing), inline micro-images, and massive section spacing.
video-frames
Extract a single frame from a local video at the first frame, a timestamp, or a zero-based frame index using FFmpeg.
p5js
Production pipeline for interactive and generative visual art using p5.js. Creates browser-based sketches, generative art, data visualizations, interactive experiences, 3D scenes, audio-reactive visuals, and motion graphics — exported as HTML, PNG, GIF, MP4, or SVG. Covers: 2D/3D rendering, noise and particle systems…