package-author

package-author is a skill for Claude Code, Codex from Pinvou/pinvou-agent. It costs 133 tokens per session (1,945 once invoked), scanned A, original, MIT.

A packaging guide for turning scripts, skills, or an MCP service into a standard plugin package. MCP is a way for an AI assistant to connect to external tools.

In plain words
What is it for?
It helps create plugin manifests, organise skills and MCP servers, add missing icons, and prepare a directory or ZIP package.
Why use it?
It ensures the package has the required files, metadata, layout, naming, and icon so it can be uploaded or shared correctly.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit It helps create plugin manifests, organise skills and MCP servers, add missing icons, and prepare a directory or ZIP package.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/pinvou/pinvou-agent/package-author
About the project

Pinvou/pinvou-agent is an open-source desktop workspace where an AI agent helps with work, visual design, and software development. People use it to work with files and knowledge, create editable visual artifacts, connect coding agents to projects, and extend the workspace with tools, MCP servers, skills, and workflows; the catalogue skills add capabilities to that environment.

Pinvou/pinvou-agent · 1,712 stars · on GitHub · pinvou.com

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Pinvou/pinvou-agent --skill package-author
Clone the repo
git clone --depth 1 https://github.com/Pinvou/pinvou-agent

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for package-author

README.md
[![agentmods](https://agentmods.dev/badge/skills/pinvou/pinvou-agent/package-author/github.svg)](https://agentmods.dev/skills/pinvou/pinvou-agent/package-author)
Your own site
<a href="https://agentmods.dev/skills/pinvou/pinvou-agent/package-author"><img src="https://agentmods.dev/badge/skills/pinvou/pinvou-agent/package-author/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for package-author

Your own site · 80×15
<a href="https://agentmods.dev/skills/pinvou/pinvou-agent/package-author"><img src="https://agentmods.dev/badge/skills/pinvou/pinvou-agent/package-author.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 133 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,945 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00133 $0.01945
Opus 5 $0.00067 $0.00972
Sonnet 5 $0.00027 $0.00389
Haiku 4.5 $0.00013 $0.00194

Measured today against content hash da8f8cf03e24, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

package-author scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

pinvou3-app/src-tauri/resources/common/skill-marketplace/package-author/SKILL.md · 139 lines

How it starts

The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.

插件包标准化(package-author)

把用户给的工具/技能/脚本,整理成 pinvou 应用商店可导入的标准插件包。规范以 docs/plugin-package-spec.md 为准,本文件内置完整规则,可直接照做、不依赖文档可达。

何时用 / 何时不用

  • ✅ 用:用户要打包/标准化一个工具,给了文件/目录/脚本/SKILL.md/manifest.json/zip,或口头描述要一个插件包。
  • ❌ 不用:用户只是"写个脚本"/"写个技能内容"而没说要打包;或是在装/卸载/开关某个已存在的工具。

先弄清三件事(问清再动手,别猜)

  1. 输入在哪:用户给的是目录路径、粘贴的代码、还是 zip?文件类型是什么?
  2. 包类型:纯技能?纯 MCP?还是 MCP+技能组合?(见 §类型判定)
  3. 输出形态:要一个目录(可直接 zip),还是直接产出 zip

若用户没给 id/名称,按内容起一个语义化小写 id(如 weather-insight),并告诉用户可改。


类型判定(决定布局)

用户给的东西 类型 标准布局
只有 SKILL.md 或技能目录 纯技能 Skill skills/<name>/SKILL.md
一个 MCP server(脚本 + 描述) 纯 MCP Mcp mcp/manifest.json + mcp/server.py
MCP + 配套使用引导技能 组合 Bundle mcp/ + skills/<name>/ 同时存在

标准包结构(必须落成这样)

<id>/
├── plugin.json                 ← 权威声明(见下)
├── mcp/                        ← 纯 MCP / 组合包才有
│   ├── manifest.json
│   └── server.py
├── skills/<name>/              ← 纯技能 / 组合包才有
│   └── SKILL.md
└── icon.svg | icon.png         ← 图标(缺失则生成,见 §图标)

plugin.json(schema v1)

{
  "manifest_version": 1,                // 必填,=1
  "id": "weather-insight",              // 必填,[a-z0-9-_]{1,64} 全小写
  "name": "天气洞察",                    // 必填,展示名
  "version": "1.0.0",                   // 可选(当前为预留字段,不驱动升级;更新包内容需更换包 id,或先删除 ~/.pinvou3/bundles/<id>/ 再导入)
  "description": "聚合天气查询与解读",     // 可选
  "icon": "icon.svg",                   // 可选,相对根,icon.svg/icon.png
  "components": {                       // 多组件用
    "mcp_servers": [ { "id": "weather", "dir": "mcp" } ],
    "skills":      [ { "id": "weather-interpret", "dir": "skills/weather-interpret" } ]
  }
}

硬规则:

  • id 全小写 [a-z0-9-_],禁 ./../路径分隔符;name 可任意可读文本。
  • components.mcp_servers[].dir "mcp"(扁平单 server);skills 的 dir"skills/<name>",且 <name> 必须等于该 SKILL.md frontmatter 的 name
  • 纯单组件可省略 plugin.json(导入走结构回退),但标准化输出一律补上(自描述)。
  • 未知字段别乱加;当前只认 components{mcp_servers,skills}

MCP 组件:mcp/manifest.json

本地 stdio server(最常见):

Read the full file on GitHub · 139 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed da8f8cf03e24
  2. 9d ago First seen · 139 lines · 133 tokens per session scan A f809b1475e7e

Subscribe to this mod's changes

package-author is a skill published in the GitHub repository Pinvou/pinvou-agent (1,712 stars, last pushed today), licensed MIT. It adds 133 tokens to every session and 1,945 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

skill-creator

A skill for creating, editing, improving, and testing skills for coding agents.

PM-Shawn/Abu-Cowork · 47 tokens

algorithmic-art

Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright…

PM-Shawn/Abu-Cowork · 62 tokens

docx

Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when…

PM-Shawn/Abu-Cowork · 168 tokens

claude-api

Build apps with the Claude API or Anthropic SDK. TRIGGER when: code imports anthropic/@anthropic-ai/sdk/claudeagentsdk, or user asks to use Claude API, Anthropic SDKs, or Agent SDK. DO NOT TRIGGER when: code imports openai/other AI SDK, general programming, or ML/data-science tasks.

PM-Shawn/Abu-Cowork · 84 tokens

doc-coauthoring

Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers.…

PM-Shawn/Abu-Cowork · 77 tokens

canvas-design

Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.

PM-Shawn/Abu-Cowork · 59 tokens