create-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-plugin (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Follow the create-plugin skill workflow to scaffold a new Claude Code plugin.
$ARGUMENTS — optional plugin name in kebab-case. Omit to start with discovery.$ARGUMENTS provides a plugin name, use it to seed Phase 1plan component table (skills / commands / agents / hooks / MCP), ask clarifying questions per component, scaffold directory structure and plugin.json, implement each component using the appropriate sub-skill, validate, test, and document
.claude-plugin/plugin.json.skills list.agents list.commands list.hooks list.plugin.json is finalized, scaffold a plugin.yaml at the plugin root for hermes-agent compatibility. Format: name: <plugin-name>
version: <version>
description: "<description>"
author: <author>
kind: backend # or standalone (no Python scripts)
platforms:
- linux
- macos
- windows
provides_tools: # list script basenames (no .py) that expose callable tools
- script_name
skills: # list skill directory names under skills/
- skill-namekind: standalone — plugin has no Python scripts that hermes calls directlykind: backend — plugin has scripts in scripts/ that hermes invokes as toolsprovides_tools if scripts/ contains callable tool scriptsskills/scripts/, scaffold a root-level __init__.py with a register(ctx) function following this pattern: from __future__ import annotations
from pathlib import Path
_HERE = Path(__file__).resolve().parent
def register(ctx) -> None:
# Register skills
ctx.register_skill(
name="<skill-name>", # bare name only — hermes auto-prefixes plugin name as namespace
path=_HERE / "skills" / "<skill-name>",
)
# Register tools (if scripts expose callable tools)
# ctx.register_tool(name, toolset, schema, handler)
# Register hooks (if plugin needs lifecycle hooks)
# ctx.register_hook("post_tool_call", handler)register_skill() calls for every skill in the pluginregister_tool() if the plugin provides callable Python toolsregister_hook() if the plugin needs lifecycle hooks__init__.py, hermes shows "No __init__.py" warning and the plugin won't activatePlugin directory with .claude-plugin/plugin.json, component directories, README.md, and a .claude/settings.json stub for reliable local discovery.
$ARGUMENTS is empty: begin with Phase 1 discovery — do not pre-fill plugin namecreate-mcp-integration for each one/agent-scaffolders:audit-plugin to validate structureWhen a skill needs to call a Python helper script that is shared across skills in the same plugin, always create a file-level symlink in the skill's scripts/ folder pointing to the canonical copy at the plugin root — never duplicate the file.
Standard pattern:
plugins/<plugin>/scripts/<canonical_name>.py ← canonical source (real file)
plugins/<plugin>/skills/<skill>/scripts/<name>.py ← symlink → ../../../scripts/<canonical_name>.pyThe symlink name and target name may differ (e.g. execute.py → exploration_optimizer_execute.py). The bridge installer resolves all symlinks to physical copies when deploying via the marketplace.
Creating symlinks correctly:
# From the skill's scripts/ directory:
ln -s ../../../scripts/<canonical_name>.py <symlink_name>.py
# Or via symlink_manager.py:
python plugins/dev-utils/scripts/symlink_manager.py create \
--src plugins/<plugin>/scripts/<canonical_name>.py \
--dst plugins/<plugin>/skills/<skill>/scripts/<symlink_name>.py⚠️ Windows / core.symlinks warning: If git config core.symlinks is false, git checks out symlinks as plain-text "stand-in" files. These are silently broken — the bridge installer copies the path string, not the script. After checkout on Windows or any machine where symlinks may have degraded, run:
python plugins/dev-utils/scripts/bulk_symlink_fixer.py plugins/<plugin-name>Then manually verify: find plugins/<plugin-name>/skills -path "*/scripts/*" -type f ! -type l should return nothing (all script references should be real symlinks, not plain files).
When this plugin will be distributed via a marketplace.json, the marketplace entry defaults to strict: true, which requires the plugin to have its own plugin.json. A missing plugin.json silently prevents the entire plugin from loading.
Always:
.claude-plugin/plugin.json inside the plugin directory (this skill does this by default)"strict": true — never rely on the defaultmanage-marketplace skill for the correct marketplace entry formatreferences/ADRs/. Always consult them for standards on plugin architecture, shared scripts, cross-plugin dependencies, symlinking, and loose coupling to avoid repeating yourself.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.