Codewhale Plugin Bundle Scaffolder

What it does

When your agent uses it

• Creating a new local Codewhale plugin bundle for a user or a workspace
• Adding a declarative skill, command, agent or hook to a plugin bundle
• Wiring an MCP server into a plugin bundle safely
• Reviewing a plugin bundle's trust surface before enabling it

Example prompts

• “Scaffold a new workspace plugin bundle called release-helper with one skill in it.”
• “Add a remote MCP server to my plugin bundle using an environment-backed bearer token.”
• “Review this plugin bundle's manifest for anything that needs explicit trust approval.”
• “Set up a namespaced skill under my-plugin so it doesn't collide with the built-in commands.”

Requirements

• A Codewhale installation with plugin support enabled

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

1. 1Pick a Codewhale-owned location
2. 2Normalize the bundle name to lowercase hyphen-case.
3. 3Create plugin.json (Agent Plugins v1.0.0; a legacy plugin.toml stays
4. 4Put each Skill under skills//SKILL.md; Codewhale finds
5. 5Add MCP servers in a sibling mcp.json only when the bundle needs an
6. 6Commands (commands/*.md), agents (agents/*.toml), and hooks
7. 7Validate and review without executing bundle content
8. 8Verify /skills inspect reports plugin provenance and /plugin list

What it can do on your machine

Read from SKILL.md and the folder at commit ad333fd. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are json).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • agent-plugins.org

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Codewhale Plugin Bundle Scaffolder loads about 1.2k tokens when it runs. Until then it costs about 33 tokens; SKILL.md has 570 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~33

When it runs · the whole SKILL.md, loaded when a task matches

~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from codewhale-hq/Codewhale at commit ad333fd, republished under its MIT licence (© codewhale-hq). 570 words, ~1,159 tokens.

name

plugin-creator

description

Scaffold a local Codewhale plugin bundle with a versioned manifest, namespaced Skills, and an explicit trust review.

{
  "$schema": "https://agent-plugins.org/schemas/plugin.json",
  "name": "my-plugin",
  "version": "0.1.0",
  "description": "What this bundle provides"
}

© codewhale-hq, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files in crates/tui/assets/skills/plugin-creator of codewhale-hq/Codewhale.

• SKILL.md
• SKILL.generation-13.md
• SKILL.generation-15.md
• SKILL.generation-16.md

Open the folder on GitHubat commit ad333fd