Install
$ agentstack add skill-caozhangni-codex-plugin-discovery-codex-plugin-discovery ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Codex Plugin Discovery
Discover candidate Codex plugins from the official openai/plugins and openai/role-based-plugins GitHub repositories.
Core Rule
Use only metadata indexed from:
https://github.com/openai/plugins
https://github.com/openai/role-based-plugins
This boundary is intentional, even under deadline or coverage pressure. Do not read Codex .tmp marketplace caches, installed plugin caches, or active-session tool caches. Those sources are out of scope.
Do not auto-install plugins. Recommend candidates and explain the evidence only. Do not claim this covers the full Codex App Plugin Directory.
Workflow
- If the user asks what plugins are currently enabled/installed in this session, answer from the current session's available plugin list first. Keep it concise.
- If the user asks broadly what plugins are available, can be used, or exist in the marketplace, do not list every indexed plugin. State that this skill can search
openai/pluginsandopenai/role-based-plugins, explain the coverage limit, and ask for the task or category they care about. - If the user asks for recent, recently added, new, last-week, past-N-days, or 最近几天 plugins, route to
python3 scripts/list_recent_plugins.py. If the user provides a day count, pass--days N; otherwise use the default 7-day window. Ifindex/plugins-index.jsonis missing or stale, runpython3 scripts/build_index.pyfirst. For mixed requests that ask for both recency and task recommendation, do not combine recency filtering with task recommendation in this first version; answer recent additions first and offer a separate task search. - If the user asks for discoverable, installable, marketplace, or task-relevant plugins, use this skill's index.
- If
index/plugins-index.jsonis missing or stale, runpython3 scripts/build_index.py. - Search with a concrete query, such as
python3 scripts/search_index.py "summarize support tickets". - Present up to five candidates from the index.
- Explain matched fields and why each plugin may help.
- State that results only cover plugins present in
openai/pluginsandopenai/role-based-plugins.
stale means any stored source commit differs from git ls-remote HEAD for either configured repository.
Index Boundary
Index only direct plugin manifests:
plugins/*/.codex-plugin/plugin.json
Do not recursively include nested manifests such as plugins/plugin-eval/fixtures/...; valid fixture JSON is still test data, not a recommendable plugin.
Output Shape
For broad availability questions such as "what plugins can I use?", do not dump the full index. Answer with:
- The current-session plugin list if the user asked about enabled plugins
- A short note that discoverable candidates can be searched from
openai/pluginsandopenai/role-based-plugins - A request for the task, domain, or category to search
- At most five examples or categories if examples would help
For each recommendation, include:
- Plugin name and display name
- Category
- Why it matches
- Matched fields
- Repository or plugin path
- Confidence note
For recent-plugin results, include:
- Plugin name and display name
- Added date
- Category
- Description
- Repository or plugin path
- First-seen commit
- A note that results are scoped to
openai/pluginsandopenai/role-based-plugins
If no recent plugins match the requested window, say no additions were found in openai/plugins or openai/role-based-plugins for that period and suggest a wider window.
If no candidate is strong, say no strong match was found in the indexed repositories and suggest manually inspecting openai/plugins and openai/role-based-plugins or broadening the query.
Do Not
| Temptation | Required Response | | --- | --- | | "Use local caches for broader coverage" | Do not. This skill only indexes openai/plugins and openai/role-based-plugins. | | "Include fixture manifests for completeness" | Do not. Index only direct plugin manifests. | | "Auto-install high-confidence matches" | Do not. Recommend and explain only. | | "Claim this covers the Plugin Directory" | Do not. Say it only covers openai/plugins and openai/role-based-plugins. |
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: caozhangni
- Source: caozhangni/codex-plugin-discovery
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.