minecraft-plugin-development — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited minecraft-plugin-development (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for Minecraft server plugin work in the Paper, Spigot, and Bukkit ecosystem.
This skill is especially useful for gameplay-heavy plugins such as combat systems, wave or boss encounters, war or team modes, arenas, kit systems, cooldown-based abilities, scoreboards, and config-driven game rules.
For grounded implementation patterns drawn from real Paper plugins, load these references as needed:
references/project-patterns.md for high-level architecture patterns seen in real gameplay pluginsreferences/bootstrap-registration.md for onEnable, command wiring, listener registration, and shutdown expectationsreferences/state-sessions-and-phases.md for player session modeling, game phases, match state, and reconnect-safe logicreferences/config-data-and-async.md for config managers, database-backed player data, async flushes, and UI refresh tasksreferences/maps-heroes-and-feature-modules.md for map rotation, hero or class systems, and modular feature growthreferences/minigame-instance-flow.md for arena instances, countdowns, loot refreshes, wave systems, visibility isolation, and entity-to-game ownershipreferences/persistent-progression-and-events.md for long-running PvP servers with profiles, perks, buffs, quests, economy, custom domain events, and extension registriesreferences/build-test-and-runtime-validation.md for Maven or Gradle packaging, shaded dependencies, generated resources, soft dependencies, config validation commands, and first-round server test plansplugin.yml, commands, tab completion, listeners, schedulers, configs, permissions, Adventure text, player state, minigame flow, arena instances, map copies, loot, waves, persistent profiles, perks, buffs, quests, economy, and PvP/PvE game loopsIf the user says "Minecraft plugin" but the stack is unclear, first determine whether the project is Paper/Spigot/Bukkit or a modding stack.
When this skill triggers:
plugin.yml, the main plugin class, and command or listener registration.If the plugin is gameplay-heavy or stateful, read references/project-patterns.md and references/state-sessions-and-phases.md before editing.
If the task touches arena isolation, map instances, chest or resource refills, wave spawning, route voting, spectator visibility, or game-specific chat, also read references/minigame-instance-flow.md.
If the task touches persistent player progression, profile saves, economy rewards, perks, buffs, quests, custom combat events, or long-running shared PvP servers, also read references/persistent-progression-and-events.md.
If the task touches build files, plugin.yml metadata, shaded dependencies, generated resource output, deployment to a test server, optional plugin integrations, or release validation, also read references/build-test-and-runtime-validation.md.
Check these first when present:
plugin.ymlpom.xml, build.gradle, or build.gradle.ktsJavaPluginconfig.yml, messages, kits, arenas, or custom YAML filestarget/classes, build/resources, or copied plugin jarsWhen adding commands, permissions, or listeners, update the relevant registration points in the same change:
plugin.ymlonEnableFor gameplay plugins, prefer explicit state objects over duplicated flags:
When the feature affects match-heavy minigames or persistent-brawl gameplay, look for hidden state transitions first before patching symptoms.
For multi-arena plugins, isolate per-game visibility, chat recipients, scoreboards, loot, and entity ownership. Do not let one arena observe or mutate another arena by accident.
When the feature includes damage, cooldowns, rewards, durations, messages, map settings, or toggles:
For new commands:
plugin.ymlPlayerMinimal registration shape:
commands:
arena:
description: Join or leave an arena
usage: /arena <join|leave>@Override
public void onEnable() {
ArenaCommand command = new ArenaCommand(gameService);
PluginCommand arena = getCommand("arena");
if (arena != null) {
arena.setExecutor(command);
arena.setTabCompleter(command);
}
}For event listeners:
For timers, rounds, countdowns, cooldowns, or periodic checks:
Main-thread handoff shape:
Bukkit.getScheduler().runTaskAsynchronously(plugin, () -> {
PlayerData data = repository.load(playerId);
Bukkit.getScheduler().runTask(plugin, () -> {
Player player = Bukkit.getPlayer(playerId);
if (player != null && player.isOnline()) {
scoreboard.update(player, data);
}
});
});For per-player or per-match state:
PlayerUUID for persistent tracking unless a live player object is strictly neededWhen the project uses Adventure or MiniMessage:
Pay extra attention when editing:
onDisableWhen implementing or revising plugin code:
plugin.yml, config files, build files, or resourcesWhen the requested change touches plugin startup, async data, match flow, class systems, or rotating maps, consult the matching reference file before editing.
Before finishing, verify as many of these as the task allows:
plugin.yml matches the implemented behaviorCommandSender to Player without checkingplugin.ymlPlayer objects as long-lived map keys when UUID is safertarget/classes or build/resources instead of source files under src/main/resourcesFor substantial requests, structure work like this:
For small requests, keep the answer concise but still mention any needed plugin.yml, config, or lifecycle updates.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.