Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/rube-de/cc-skillsnpx agentmods add skills/rube-de/cc-skills/plugin-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rube-de/cc-skills/plugin-dev)<a href="https://agentmods.dev/skills/rube-de/cc-skills/plugin-dev"><img src="https://agentmods.dev/badge/skills/rube-de/cc-skills/plugin-dev.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00496 |
| Opus 5 | $0.00024 | $0.00248 |
| Sonnet 5 | $0.00010 | $0.00099 |
| Haiku 4.5 | $0.00005 | $0.00050 |
Grade A, and why
plugin-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Plugin Development Tools
On-demand validation and hook auditing for the cc-skills marketplace.
Triggers
Use this skill when the user says: "validate plugins", "check plugin", "hook audit", "validate skills", "audit hooks", "check skill frontmatter", "plugin validation".
Available Tools
1. Plugin Validation
Validates all registered plugins: JSON Schema, source paths, orphan detection, and SKILL.md frontmatter.
bun scripts/validate-plugins.mjs
What it checks:
- marketplace.json conforms to JSON Schema
- All plugin
sourcepaths exist on disk - No orphaned plugin directories (dirs without marketplace entries)
- SKILL.md frontmatter has valid
name(kebab-case) and non-emptydescription - Every plugin has at least one component directory (skills/, hooks/, commands/, agents/)
2. Hook Audit
Scans hook and script files for silent failure patterns.
bash plugins/plugin-dev/scripts/audit-hooks.sh
What it checks:
- Shell scripts (
.sh):mkdir/cp/mv/rmwithout error handling (unlessset -eis active) - Python scripts (
.py): bareexcept: passorexcept Exception: pass - Optional: ShellCheck integration (skipped with message if not installed)
Exit codes: 0 = clean, 1 = findings
Workflow
When the user asks to validate or audit:
- Run
bun scripts/validate-plugins.mjsfor plugin validation - Run
bash plugins/plugin-dev/scripts/audit-hooks.shfor hook auditing - Report results clearly — separate passing checks from failures
- For failures, suggest specific fixes
Scaffolding
To scaffold a new plugin interactively, use the command:
/plugin-dev:create [plugin-name]
This is a separate slash command — not part of this skill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 66 lines · 49 tokens per session scan A d84e2a0d34f8
plugin-dev is a skill published in the GitHub repository rube-de/cc-skills (10 stars, last pushed yesterday), licensed MIT. It adds 49 tokens to every session and 496 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
java-best-practices
Java coding best practices. Use when writing or reviewing Java code (17+). Covers modern features, error handling, and patterns.
great_cto
Use when the CTO describes a feature, task, or project goal. Orchestrates the full SDLC pipeline automatically based on project type.
vertical-real-estate
Residential-proptech domain knowledge so architect / pm aren't naive when speccing real-estate products (listings, lead-crm, transaction-coordination, property-mgmt). Codifies MLS/IDX reality, listing status lifecycle + syndication canonical-source, long-cycle lead nurture, transaction-coordination as the high-pain…
skeptical-triage
Reusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of 4 extra LLM turns.
vertical-hr-recruiting
Domain-knowledge primer for the HR & recruiting vertical (ATS, onboarding, workforce scheduling, engagement). Applied by architect/pm during spec authoring so they aren't naive about hiring pipelines, the admitted offer→onboard data-carry gap, EEO/I-9 compliance, and shift-coverage rules. Stops the four products from…
anti-patterns
Catalogue of known SDLC anti-patterns that greatcto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).