Skip to content
Back to skills

Pluginstaller

ASecurity

Add a Codex plugin from a GitHub repo to a repo or personal marketplace using the current Codex plugin layout and marketplace metadata.

  • 3 stars
  • 0 votes
  • 0 copies
  • 6 views
  • Added September 12, 2026
ai-agentsgogit

Works with

  • mcp

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned September 12, 2026

npx -y skills add thedixitjain/the-mega-skill-library --skill pluginstaller --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Pluginstaller?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Pluginstaller
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/thedixitjain-pluginstaller/badge)](https://www.skillsdirectory.com/skills/thedixitjain-pluginstaller)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: pluginstaller
description: "Add a Codex plugin from a GitHub repo to a repo or personal marketplace using the current Codex plugin layout and marketplace metadata."
category: ai-agents-and-harness
source_repo: am-will/codex-skills
source_path: "skills/pluginstaller/SKILL.md"
source_url: https://github.com/am-will/codex-skills/blob/HEAD/skills/pluginstaller/SKILL.md
---


# Pluginstaller

Use when the user gives a GitHub repo for a Codex plugin and wants it available in Codex.

Follow the current Codex plugin docs. Do not invent alternate install flows.

## Inputs

- GitHub repo URL or `owner/repo`
- Install scope: `repo` or `personal`
- If the repo contains more than one plugin root, ask which plugin folder to install.

## Workflow

0. If the user does not specify whether the plugin should be repo-scoped or personal, stop and ask.
1. Fetch the repo and locate the plugin root by finding `.codex-plugin/plugin.json`.
2. Read `.codex-plugin/plugin.json` and validate the canonical structure:
   - `name`, `version`, and `description` should exist.
   - Bundled paths such as `skills`, `apps`, and `mcpServers` should be relative to the plugin root and start with `./`.
   - Only `plugin.json` should live inside `.codex-plugin/`.
3. Prefer the built-in `@plugin-creator` skill when the task is to scaffold a new local plugin or add an existing local plugin to a marketplace. Use the manual path below when you are wiring up a repo the user already provided.
4. Copy the entire plugin directory, not just `SKILL.md`, into a marketplace-visible location. Default to the documented standard locations unless the repo already uses a different valid marketplace-relative path:
   - `repo`: `$CWD/plugins/<plugin-name>` and `$CWD/.agents/plugins/marketplace.json`
   - `personal`: `~/.codex/plugins/<plugin-name>` and `~/.agents/plugins/marketplace.json`
5. Preserve the full bundle at the plugin root, including sibling `skills/`, `.app.json`, `.mcp.json`, `assets/`, and any other plugin files. Do not move those files under `.codex-plugin/`.
6. Create or update the marketplace file with the documented schema:
   - top-level marketplace `name`
   - optional `interface.displayName`
   - plugin entry `name`
   - `source.source = "local"`
   - `source.path` relative to the marketplace root:
     - `repo`: `./plugins/<plugin-name>`
     - `personal`: `./.codex/plugins/<plugin-name>`
   - `policy.installation`
   - `policy.authentication`
   - `category`
7. Use marketplace values that match the docs unless the user says otherwise:
   - `policy.installation = "AVAILABLE"`
   - `policy.authentication = "ON_INSTALL"`
   - `category` from `interface.category` when present, otherwise `Productivity`
8. Merge into any existing marketplace file instead of replacing it.
9. Restart Codex and verify the plugin appears in `/plugins`.
10. Report the runtime behavior accurately:
   - The marketplace entry points to the source plugin directory.
   - Codex installs the plugin into `~/.codex/plugins/cache/<marketplace>/<plugin>/<version>/`.
   - For local plugins, the installed cache version is `local`.
   - Plugin enabled or disabled state is stored in `~/.codex/config.toml`.

## Rules

- Prefer the terms `repo marketplace` and `personal marketplace` over `workspace` and `global`.
- Do not present copying into `plugins/` as the complete install. The marketplace entry is what makes the plugin discoverable in Codex.
- Do not flatten or rename the plugin bundle.
- Keep the plugin `name` stable and consistent across folder, manifest, and marketplace entry.
- Keep manifest and marketplace paths relative and `./`-prefixed where the docs require it.
- Treat the documented repo and personal plugin directories as defaults, not absolute requirements, as long as the marketplace `source.path` remains valid and stays inside the marketplace root.
- If the repo already ships a marketplace file, prefer it as the source of truth for marketplace ordering and metadata, and only add or update the plugin entry that is needed.
- If the manifest is missing required basics or uses invalid root-relative paths, fix the plugin structure before claiming installation is complete.

## Scope guide

Use `repo` when the plugin should live with one repo or be shared through that repo's marketplace. Use `personal` when the plugin should be available from the user's own Codex setup across projects.

---

**Source:** [`am-will/codex-skills`](https://github.com/am-will/codex-skills) → `skills/pluginstaller/SKILL.md`

Files in this skill

  • SKILL.md4.4 KB
  • agents/openai.yaml324 B
  • references/install-scope.md1.1 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.