Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/oneworks-ai/app/create-pluginnpx skills add oneworks-ai/app --skill create-plugingit clone --depth 1 https://github.com/oneworks-ai/appWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.08605 |
| Opus 5 | $0.00036 | $0.04303 |
| Sonnet 5 | $0.00015 | $0.01721 |
| Haiku 4.5 | $0.00007 | $0.00860 |
Grade A, and why
create-plugin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 416 lines — stays where its author put it; the contents beside it link to each section on GitHub.
在用户描述“想创建一个插件”“想在界面里加一个入口 / 按钮 / tab / 搜索 / 调试面板 / 本地服务能力”,或明确要求“用 plugin 实现某个 UI 效果”时使用这个 skill。
工作目标
先理解用户真正想要的交互效果、入口位置和 runtime 能力,再把自然语言效果转换为一个可运行、可调试、可维护的 OneWorks plugin。优先落到 plugin manifest、前端 activatePlugin(ctx)、server activatePlugin(ctx) 和 scoped runtime 通道;不要把 plugin 需求改成宿主硬编码,除非现有 plugin 扩展点明显不足。
这是 OneWorks 内置的 create-plugin skill,只面向本仓库的 OneWorks plugin。不要套用 Codex 系统 $plugin-creator 的 .codex-plugin/plugin.json、.agents/plugins/marketplace.json、~/.codex/skills 或 marketplace 规则,也不要修改全局 Codex skill。
先读这些
开始写或改 plugin 前,先读取当前仓库里的插件规则和示例:
.oo/docs/usage/plugins.md.oo/docs/usage/plugins/ui-runtime.md.oo/docs/usage/plugins/server-runtime.mdpackages/plugins/demo/package.jsonpackages/plugins/demo/plugin.jsonpackages/plugins/demo/README.mdpackages/plugins/demo/README.zh-Hans.md
如果用户是在改已有 plugin,先读目标 plugin 自己的 plugin.json、README 多语言文件、client/ 和 server/ 入口,再决定最小修改点。
先理解效果
先把用户诉求拆成这些问题;用户已经给出时不要重复问:
- 入口在哪里:左侧导航、左侧更多菜单、chat header、下方面板
+菜单、右侧/下方 workbench tab、launcher 搜索、独立 plugin route。 - 点击后发生什么:打开页面、创建新 tab、执行命令、调用本地服务、跳转外链或展示状态。
- 展示在哪里:plugin route、可关闭 workbench tab、右侧抽屉 tab、toast、菜单项、launcher result。
- 是否需要 runtime:只需要前端 DOM,还是要 server command、scoped API、loopback 本地服务、文件监听或 manager / workspace runtime 通信。
- server 入口运行在哪里:普通工作区能力默认
workspace;设备级、launcher 级或跨 workspace 协调才使用manager。一台设备可以同时有多个 workspace server,不要假设只有一个 workspace endpoint。 - 是否需要开发态热更新:本地开发优先放在
packages/plugins/<name>并通过.oo.config.json显式声明;临时开发目录才放在.oo/plugins.dev/<name>,开启 watch。本地路径 plugin 的 client source 会通过宿主 Vite dev server 加载,不需要单独启动插件 Vite dev server。
如果缺失信息会改变入口、交互、数据来源、权限、本地服务、scope 或验证方式,先列出“不确定点”让用户确认。每个不确定点都要写清它会影响什么;可以给出推荐默认值,但不要在关键需求模糊时直接替用户拍板。只有名称、图标、文案这类低风险细节缺失时,才采用保守默认并在结果里说明。
扩展点选择
按效果选择 manifest 字段:
- 左侧固定入口:
plugin.contributions.navItems。默认路径是/plugins/<scope>/<id>;也可以给route或command。 - 左侧更多菜单:
navMoreMenu,支持command、route、href。 - 左侧底部「菜单」上方区域:
navFooterBefore,支持command、route、href。 - chat header 右上角按钮:
chatHeaderActions,用command触发 plugin 命令。 - chat header 更多菜单:
chatHeaderMoreMenu。 - chat 新建面板默认页操作卡片:
chatInteractionPanelEmptyActions,支持command、route、href,额外支持展示用shortcut。 - 通用路由 header 按钮:
routeHeaderActions,用targetRoute/targetRoutes限定宿主 route container,用command触发 plugin 命令。 - 通用路由折叠态 window bar 按钮:
routeWindowBarActions,通常和routeHeaderActions成对注册,也用targetRoute/targetRoutes限定宿主 route container。 - 通用路由更多菜单:
routeMoreMenuItems,支持command、route、href;其中route是点击后的跳转目标,不是宿主显示条件。 - 通用路由侧栏入口 / 列表右键菜单:
routeSidebarContextMenu,支持command、route、href;其中route是点击后的跳转目标,不是宿主显示条件。 - 独立页面:
routes+clientView,前端用ctx.views.register(viewId, render)提供内容。 - 下方面板或右侧抽屉 tab:
workbenchTabs或workspaceDrawerTabs,用placement: "bottom" | "right"决定位置。 - 下方面板
+菜单:workbenchAddMenu。如果要点击后创建 tab,设置tab指向workbenchTabs[].id。 - launcher 搜索:
launcherSearchProviders,桌面 launcher 使用 server-backedcommand;workspace client 可以再用ctx.launcher.registerSearchProvider注册本地搜索。 - chat 工具调用展示:
toolUsePresentations,用纯声明配置工具匹配、Material Symbol、国际化标题、摘要目标、输入字段和结果格式;不要为单个插件在聊天组件里新增 renderer 或注入 JSX/HTML。 - 插件间扩展点:拥有方用
extensionPoints或ctx.extensionPoints.register暴露<scope>/<id>;其他插件用ctx.extensionPoints.onAvailable('<scope>/<id>', point => ctx.extensionPoints.contribute(...))监听目标点出现后补充结构化能力。只有 manifest 里声明的静态贡献才用extensionContributions。 - 插件间纯前端 API:拥有方用
ctx.pluginApis.register({ id, inputSchema, outputSchema, handler })暴露 in-client 过程调用;调用方用await ctx.pluginApis.call('<scope>/<id>', input)。所有调用必须是 Promise,运行时会等待目标 API 注册并等待 handler 完成。 - 本地能力:server
ctx.registerCommand或ctx.registerApi;前端通过ctx.commands.execute或ctx.api.fetch调用。 - manager / workspace 通信:server
ctx.runtime.registerChannel和ctx.runtime.invokeChannel;前端通过ctx.runtime.invokeChannel调用当前 scope 的 server runtime channel。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 416 lines · 73 tokens per session scan A 36c279a24c96
create-plugin is a skill published in the GitHub repository oneworks-ai/app (18 stars, last pushed 2d ago), licensed MIT. It adds 73 tokens to every session and 8,605 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
spec-kitty-charter-doctrine
Run charter interview, generation, context, and sync workflows for project governance in Spec Kitty 3.x. Access doctrine artifacts programmatically via DoctrineService. Resolve agent profiles. Load action-scoped governance context iteratively, not all at once. Triggers: "interview for charter", "generate charter"…
superlint
This skill describes the mandatory standard operating procedure for using our internal SuperLint tool. Use this when tasks require fixing code quality issues according to corporate standards.
neo4j-document-import-skill
Ingests unstructured and semi-structured documents into Neo4j as a knowledge graph. Use when chunking PDFs, HTML, plain text, or Markdown; extracting entities and relationships from text with an LLM (SimpleKGPipeline, neo4j-graphrag); loading JSON via apoc.load.json; building Document→Chunk→Entity graph structures; or…
neo4j-modeling-skill
Design, review, and refactor Neo4j graph data models. Use when choosing node labels vs relationship types vs properties, migrating relational/document schemas to graph, detecting anti-patterns (generic labels, supernodes, missing constraints), designing intermediate nodes for n-ary relationships, enforcing schema with…
lov-env-management
统一管理平台、账号与多组 API Key,维护有效期和启用状态,安全同步到 zsh 或用户会话环境,并提供脱敏 Dashboard;用户说“管理环境变量”“rotate API keys”时使用。.
lov-deploy-to-vercel
Deploy frontend projects to Vercel with automatic custom domain setup. Handles Vite, Next.js, CRA, and static sites. Auto-configures Cloudflare DNS CNAME records and Vercel domain aliases. Supports SPA routing via vercel.json. Trigger when user says "deploy to vercel", "部署到 vercel", "vercel deploy", or mentions a…