Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marko-php/marko --skill create-plugingit clone --depth 1 https://github.com/marko-php/markoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marko-php/marko/create-plugin)<a href="https://agentmods.dev/skills/marko-php/marko/create-plugin"><img src="https://agentmods.dev/badge/skills/marko-php/marko/create-plugin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marko-php/marko/create-plugin"><img src="https://agentmods.dev/badge/skills/marko-php/marko/create-plugin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.01616 |
| Opus 5.5 | $0.00048 | $0.00646 |
| Sonnet 5.5 | $0.00024 | $0.00323 |
| Haiku 4.5 | $0.00012 | $0.00162 |
Grade A, and why
create-plugin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create a Marko Plugin
This skill is the canonical specification for a Marko plugin. Do not inspect existing plugins in this project to infer structure — siblings may have drifted from spec. Copy the templates from
assets/verbatim, substitute placeholders, and stop.
A plugin is a class that intercepts the input or output of a public method on any
other class — without replacing that class. Plugins are Marko's fine-grained
extensibility primitive. They are auto-discovered from any module's src/
directory; no manual registration is needed.
When to use
Use a plugin when the user wants to modify arguments to, or the result from, a public method on a class without rewriting or subclassing it. Common cases:
- Enrich a return value
- Validate or transform inputs before the method runs
- Short-circuit (cache hit, guard, redirect)
- Log or observe calls
- Chain transformations across modules
For total replacement of a class, use a Preference instead — that is a separate
skill (marko-create-preference). Plugins and Preferences are complementary; only
Preferences swap entire implementations.
Plugin model — two timings only
Marko supports exactly two plugin types. A third type that wraps the call is intentionally absent — anything it could do is expressed as a Before (short-circuit) or After (result transformation), keeping the call stack debuggable.
| Attribute | When | What it does |
|---|---|---|
#[Before] |
Before the target method | Modify args, short-circuit, or pass through |
#[After] |
After the target method | Receive and modify the return value |
Before return semantics
| Return value | Effect |
|---|---|
null |
Pass-through — original method runs with original args |
array |
Replace arguments — original method runs with these args |
| Any other non-null value | Short-circuit — original method is NOT called |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 154 lines · 119 tokens per session scan A 1f1e9604eb02
create-plugin is a skill published in the GitHub repository marko-php/marko (397 stars, last pushed 7d ago), licensed MIT. It adds 119 tokens to every session and 1,616 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
php
Use when writing, reviewing or modernizing PHP (8.3-8.5) outside Laravel — strict types, union and intersection types, readonly classes, backed enums, property hooks and asymmetric visibility, the pipe operator and clone-with, Composer with PSR-4, PER-CS style, PSR interop, and the quality toolchain (PHPStan, Pint…
system-inspect
How to query the Zolinga system's runtime state — merged manifest cache, API service stubs, configuration layers, and log files — using jq, grep, tail, and PHP.
system-web-components
ALWAYS use when creating, modifying, or reviewing ANY front-end web components, widgets, or custom elements in this repository. Mandatory for all web component work — creating new components, modifying existing ones, registering in zolinga.json, writing component docs, or debugging component…
system-create-mcp-resource
Use when creating or updating MCP resources — static files exposed to MCP clients via resources/list and resources/read. Covers .meta.json descriptors, URI rewriting, dynamic resources via mcp:resources/list event hook, and the mcp-system scheme.
system-create-mcp-tool
Use when exposing a Zolinga event handler as an MCP (Model Context Protocol) tool — i.e. a method clients can invoke via JSON-RPC tools/call. Covers handler class, manifest binding, JSON Schemas, the Tools\CallEvent contract, and the schema.response requirement enforced by McpToolsListHandler::collectTools().
system-events-client
Use when working with the JavaScript client-side event system in Zolinga. Covers the Event class, Api gateway, dispatching events from JS to PHP, receiving broadcastBack responses, inter-component communication via BroadcastChannel, and web component integration.