plugin-publish

plugin-publish is a skill for Claude Code, Codex from zhinjs/zhin. It costs 58 tokens per session (2,030 once invoked), scanned A, original, MIT.

A release guide for publishing Zhin.js plugins to npm, the JavaScript package registry, and to the Zhin plugin marketplace. It covers package metadata, versioning, release checks, and submission requirements.

In plain words
What is it for?
Use it to prepare a plugin for release, verify package.json and published files, manage versions, and submit the plugin to npm and the Zhin marketplace.
Why use it?
It reduces the chance that a plugin is rejected or published with missing files, incorrect metadata, or incompatible framework information. It also provides checks before sharing the package with other developers.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to prepare a plugin for release, verify package.json and published files, manage versions, and submit the plugin to npm and the Zhin marketplace.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/zhinjs/zhin/plugin-publish
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add zhinjs/zhin --skill plugin-publish
Clone the repo
git clone --depth 1 https://github.com/zhinjs/zhin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for plugin-publish

README.md
[![agentmods](https://agentmods.dev/badge/skills/zhinjs/zhin/plugin-publish/github.svg)](https://agentmods.dev/skills/zhinjs/zhin/plugin-publish)
Your own site
<a href="https://agentmods.dev/skills/zhinjs/zhin/plugin-publish"><img src="https://agentmods.dev/badge/skills/zhinjs/zhin/plugin-publish/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for plugin-publish

Your own site · 80×15
<a href="https://agentmods.dev/skills/zhinjs/zhin/plugin-publish"><img src="https://agentmods.dev/badge/skills/zhinjs/zhin/plugin-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,030 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00058 $0.02030
Opus 5.5 $0.00023 $0.00812
Sonnet 5.5 $0.00012 $0.00406
Haiku 4.5 $0.00006 $0.00203

Measured 1mo ago against content hash c04d68558d58, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

plugin-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/toolkit/create-zhin/template/skills/plugin-publish/SKILL.md · 222 lines

How it starts

The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Zhin 插件发布

引导将 Zhin.js 插件发布到 npm 和 Zhin 插件市场,确保包结构、元数据和质量符合社区标准。

适用场景

  • 用户说"发布插件"、"提交到插件市场"、"准备发版"
  • 插件开发完成需要分享给社区
  • 需要检查插件是否满足发布条件

发布前检查清单

第 1 步:包元数据检查

验证 package.json 必需字段:

{
  "name": "zhin.js-{name}",          // ✅ 社区前缀
  "version": "0.1.0",                 // ✅ 语义化版本
  "type": "module",                    // ✅ ESM
  "description": "插件简介",           // ✅ 非空描述
  "main": "./lib/index.js",           // ✅ 入口指向编译产物
  "types": "./lib/index.d.ts",        // ✅ 类型声明
  "exports": {
    ".": {
      "types": "./lib/index.d.ts",
      "development": "./src/index.ts", // ✅ 开发条件导出
      "import": "./lib/index.js"
    },
    "./package.json": "./package.json"
  },
  "files": [                           // ✅ 发布文件白名单
    "src", "lib", "client", "dist",
    "skills", "tools",
    "README.md", "CHANGELOG.md"
  ],
  "keywords": ["zhin.js", "plugin"],   // ✅ 包含 zhin.js 关键词
  "peerDependencies": {
    "zhin.js": ">=x.x.x"              // ✅ 声明框架兼容版本
  },
  "license": "MIT",                    // ✅ 开源协议
  "repository": { "url": "..." },      // 推荐:仓库地址
  "homepage": "...",                    // 推荐:文档地址
  "author": "..."                       // 推荐:作者信息
}

插件市场识别条件:

  • name 以 zhin.js- 开头(社区)或 @zhin.js/ 开头(官方)
  • keywords 包含 zhin.js
  • peerDependencies 包含 zhin.js

第 2 步:代码质量检查

# 1. 类型检查
pnpm build            # 确保 tsc 编译通过,无类型错误

# 2. 运行测试
pnpm test             # 确保所有测试通过

# 3. 覆盖率检查
pnpm test:coverage    # 确保覆盖率达标

质量底线:

  • tsc 编译零错误
  • 所有测试通过
  • 语句覆盖率 ≥ 60%
  • 无 any 类型滥用
  • 无未处理的 TODO/FIXME 阻塞发布

第 3 步:文档检查

README.md 必须包含:

  • 插件功能简介
  • 安装步骤(pnpm add zhin.js-{name})
  • 配置说明(配置项及默认值)
  • 命令列表(如有)
  • AI 工具说明(如有)
  • 使用示例

CHANGELOG.md 必须包含:

关键词: 有 skills/ 目录时,确认 SKILL.md 的 description 准确描述插件能力。

第 4 步:构建产物检查

# 确保 lib/ 目录存在且完整
ls lib/

# 检查将要发布的文件
npm pack --dry-run

确认 npm pack 输出的文件列表:

  • ✅ 包含 lib/(编译后的 JS + d.ts)
  • ✅ 包含 src/(源码,供开发模式使用)
  • ✅ 包含 skills/(AI 技能描述)
  • ✅ 包含 README.md、CHANGELOG.md
  • ❌ 不包含 node_modules/、tests/、.env
  • ❌ 不包含 coverage/、.DS_Store

Read the full file on GitHub · 222 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 222 lines · 58 tokens per session scan A c04d68558d58

Subscribe to this mod's changes

plugin-publish is a skill published in the GitHub repository zhinjs/zhin (136 stars, last pushed 2d ago), licensed MIT. It adds 58 tokens to every session and 2,030 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.