Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shopwareLabs/ai-coding-tools --skill plugin-updatinggit clone --depth 1 https://github.com/shopwareLabs/ai-coding-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shopwarelabs/ai-coding-tools/plugin-updating)<a href="https://agentmods.dev/skills/shopwarelabs/ai-coding-tools/plugin-updating"><img src="https://agentmods.dev/badge/skills/shopwarelabs/ai-coding-tools/plugin-updating/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shopwarelabs/ai-coding-tools/plugin-updating"><img src="https://agentmods.dev/badge/skills/shopwarelabs/ai-coding-tools/plugin-updating.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 90 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01082 |
| Opus 5.5 | $0.00041 | $0.00433 |
| Sonnet 5.5 | $0.00020 | $0.00216 |
| Haiku 4.5 | $0.00010 | $0.00108 |
Grade A, and why
plugin-updating scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Updating
Handles plugin version management for the Shopware AI Coding Tools marketplace.
Template synchronization for templates/plugin-setup/ and shared shell scripts is covered by .claude/rules/template-sync.md, which activates automatically when a template or consumer file is touched.
Plugin Inventory
Current plugin names and versions:
for f in plugins/*/.claude-plugin/plugin.json; do
name=$(basename "$(dirname "$(dirname "$f")")")
ver=$(jq -r .version "$f" 2>/dev/null)
printf '%s: %s\n' "$name" "$ver"
done
Version Bump
When updating a plugin's version:
Step 1: Identify the plugin
Match the plugin name from the user's request against the names listed above. If the name does not appear there, stop and ask the user which plugin they mean.
Step 2: Determine version bump level
If the user specifies a target version, use it. Otherwise, reason about the changes to determine MAJOR, MINOR, or PATCH.
Core question: "Can users do something they could not do before?"
MAJOR — Consumer behavior must change to keep working
Plugin renamed or extracted
Skill invocation model changed
MCP tool surface rewritten
Agent names/roles replaced
Config files require migration
MINOR — New user-facing capability added
New skill, MCP tool, hook type, agent, command, or environment
Significant new parameters on existing tools
New independently-queryable test rule
PATCH — Everything else
Bug fixes, refinements, internal refactoring
Description/docs improvements
Validation/guard additions to existing features
Removing deprecated internals
Watch for these traps:
- "Added" does not always mean MINOR — adding validation to an existing feature is PATCH (same capability, better quality)
- "Breaking" in a description does not always mean MAJOR — if the orchestrator absorbs the change transparently, consumers are unaffected
- Batch additions that individually seem incremental can collectively warrant MINOR when they form a cohesive new capability
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed 7c9a317249d1
- 1mo ago First seen · 107 lines · 102 tokens per session scan A 76fdfda2927e
plugin-updating is a skill published in the GitHub repository shopwareLabs/ai-coding-tools (45 stars, last pushed 4d ago), licensed MIT. It adds 102 tokens to every session and 1,082 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release
This skill should be used when the user wants to create a new release — bump version, tag, push, create GitHub release, and publish to npm through the release workflow. Use when user says "release", "bump version", "publish", "cut a release", or "release candidate".
quick-pr
Split a minor change from the current work into a separate worktree and open a PR without interrupting your flow. Use when an unrelated small fix (typo, lint rule, config tweak) is sitting in a feature branch and the user wants it shipped on its own — "quick PR", "split this out", "ship this separately". Requires…
cut-release
Release one Foundry plugin when explicitly invoked. Bump its version and changelog in the plugin repository, push, then pin the pushed commit in the Foundry catalogs within the owner's authorization.
release
A release guide for publishing a software package, including projects with multiple independently versioned packages in one repository, called a monorepo. It determines the release unit, updates versions using Semantic Versioning, and prepares the related GitHub release steps after approval.
version-bump
Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. Ends with the agent running npm publish itself using the maintainer's npm…
batch
Research and plan a large-scale change, then execute it in parallel across 5–30 isolated worktree agents that each open a PR.