Wox is a native desktop launcher for macOS, Linux, and Windows that combines app and file search with keyboard-driven actions in one input. People use it to open applications, find files, run actions, and extend the launcher with plugins. The catalogue includes ten skills and one instruction for Wox.
Borrowing it
Nothing to install: this file belongs to Wox-launcher/Wox. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Wox-launcher/Wox/master/.agents/skills/wox-plugin-creator/SKILL.mdgit clone --depth 1 https://github.com/Wox-launcher/WoxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wox-launcher/wox/wox-plugin-creator)<a href="https://agentmods.dev/skills/wox-launcher/wox/wox-plugin-creator"><img src="https://agentmods.dev/badge/skills/wox-launcher/wox/wox-plugin-creator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wox-launcher/wox/wox-plugin-creator"><img src="https://agentmods.dev/badge/skills/wox-launcher/wox/wox-plugin-creator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 53 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.03144 |
| Opus 5 | $0.00063 | $0.01572 |
| Sonnet 5 | $0.00025 | $0.00629 |
| Haiku 4.5 | $0.00013 | $0.00314 |
Grade A, and why
wox-plugin-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
Licensed GPL-3.0
The repository is licensed GPL-3.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/iconify/copy.svg 701 B
- assets/iconify/open.svg 316 B
- assets/script_plugin_templates/template.js 10 KB runs code
- assets/script_plugin_templates/template.py 14 KB runs code
- assets/single_file_plugin_templates/template.js 1.3 KB runs code
- assets/single_file_plugin_templates/template.py 1.4 KB runs code
- references/icons.md 3.6 KB
- references/plugin_i18n.md 2.8 KB
- references/plugin_json_schema.md 18 KB
- references/plugin_overview.md 5.6 KB
- references/refinements.md 3.3 KB
- references/scaffold_nodejs.md 587 B
- references/scaffold_python.md 587 B
- references/sdk_nodejs.md 8.8 KB
- references/sdk_python.md 9.1 KB
- references/settings_patterns.md 7.3 KB
- scripts/scaffold_wox_plugin.py 8.6 KB runs code
- scripts/search_iconify.py 7.0 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 03deb389feeb
- yesterday Changed · +57 lines · +4 tokens per session e33ed231ea06
- 3d ago Changed · +3 lines · +9 tokens per session 30c28a35041a
- 4d ago Changed · +35 lines · +13 tokens per session 184d8fa200f3
- 9d ago First seen · 53 lines · 100 tokens per session scan A a26a730b396c
wox-plugin-creator is a skill published in the GitHub repository Wox-launcher/Wox (27,335 stars, last pushed today), licensed GPL-3.0. It adds 126 tokens to every session and 3,144 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
screen-ocr-operator
Use when you need to see and operate an Android screen through an OCR/vision model plus ADB. Optimized commander workflow: one model plan, batch ADB execution, minimal round-trips, verify at milestones.
device-shell
Use when you need to execute shell commands on an Android device from a Linux/proot environment. Covers the ADB channel and an optional local Shizuku HTTP shell bridge.
spatial-deconv
Load when deconvolving spot-level cell-type proportions on a Visium-style spatial AnnData using a labelled scRNA reference (FlashDeconv / Cell2location / RCTD / DestVI / Tangram / others). Skip when each spot is a single cell already (Xenium / MERFISH) (use spatial-annotate); tissue-domain detection (use…
glaze-byok-ai
Give Glaze app users a choice of AI engine - built-in Glaze AI (zero setup, uses their Glaze credits), their own free API key (Google Gemini free tier, optionally OpenRouter free models), or their local Claude Code CLI (their Claude subscription). Use whenever an app built with glaze-coder gets an AI feature, so end…
glaze-app-dev
Build, edit, run, and debug Glaze (Raycast) desktop apps directly from Claude Code, for free, using your own Claude subscription instead of Glaze's paid credits. Use whenever the user wants to create, modify, style, fix, or add features to a Glaze app, mentions Glaze, a Glaze app, or an app under Glaze's apps folder.
capminal
CAP Skills can help agents to interact with Cap Wallet, deploy tokens via Clanker, Liquid or Virtuals, claim rewards, manage limit/stop-loss/TWAP/DCA orders, bridge tokens between Base and Robinhood, and discover/call x402 APIs.