Create Plugin
v0.1.0Create minimal, convention-matching plugins or extensions for an existing codebase. Use when the user asks for a plugin, extension, custom module, integratio...
⭐ 0· 109·0 current·0 all-time
byYi@hyharry
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the content: the skill is an instruction workflow for writing minimal, convention-matching plugins. It does not request unrelated credentials, binaries, or installs.
Instruction Scope
Runtime instructions focus on reading the target repository/docs, planning, implementing, testing, and documenting a plugin. It does not instruct the agent to read unrelated system files, harvest environment variables, or send data to unexpected endpoints. It does reference using the DeepWiki MCP skill when available, which is relevant for public-repo source queries.
Install Mechanism
No install spec or code files are present (instruction-only), so there is no on-disk install risk. This is the lowest-risk install posture.
Credentials
The skill requires no environment variables, credentials, or config paths. It does not ask for secrets or unrelated service tokens.
Persistence & Privilege
always is false and the skill does not request permanent system presence or modifications to other skills or system-wide settings. Autonomous invocation is allowed (platform default) but is not coupled with broad privileges.
Assessment
This skill is an instruction-only workflow for producing small, repo-specific plugins and appears internally consistent. Before installing or invoking: (1) Be aware it recommends reading target GitHub repos and (if available) calling the DeepWiki MCP skill — evaluate whether you trust DeepWiki and whether the agent should access that external service. (2) The skill does not request credentials; if you ask it to work on private repositories, the agent or platform may need repo access credentials separately — the skill itself won't request or store them. (3) Because it's autonomous-invocation-capable (the platform default), consider whether you want the agent to call it without confirmation in workflows that might expose private code. (4) If you plan to have the skill produce patches to upstream repos or create PRs, explicitly instruct it to do so and verify any commits before merging. If you want a deeper risk check, provide the target repository and whether it is public or private and whether DeepWiki MCP is available/authorized; that will let a more specific review of the planned operations change the assessment.Like a lobster shell, security has layers — review code before you run it.
latestvk97313rwnma458ehpwjnqqd41n83b0pq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
