Agent skill

Plugin Workflow

by NanmiCoder in NanmiCoder/dsh-auto-mode

Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release.

MITAuto-check passedDevelopment

Install Plugin Workflow

skills CLI
$ npx skills add NanmiCoder/dsh-auto-mode --skill plugin-workflow -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install NanmiCoder/dsh-auto-mode plugin-workflow --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/NanmiCoder/dsh-auto-mode.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/plugin-workflow .claude/skills/plugin-workflow && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
plugin-workflow
GitHub stars
165
Used in
1 other repo
Token cost
~3k tokens
SKILL.md length
1,493 words
Files
5 (incl. scripts, references)
Skills in repo
10
Repo updated
First seen
Licence
MIT

At a glance

Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release.

  • Works in 4 steps: Read repository instructions and inspect… → Identify whether the target is the DSH… → Record the plugin source identity,… → …
  • A guided lifecycle workflow
  • SKILL.md covers Show the pre-run menu first, Continue with read-only…, Choose one workflow and Build the phase ledger, plus 3 more sections
  • Runs JavaScript scripts from its folder; calls node

What it does

Plugin Workflow is an agent skill from NanmiCoder/dsh-auto-mode. Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release. Use for a guided lifecycle workflow, a pre-run capability menu, or several DSH plugin operations with one status report. Preserve the user's selected scope and existing authorization across stages.

Its SKILL.md is about 3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts and reference files (for example `agents/openai.yaml` and `references/workflow-selection.schema.json`).

It sits in Development. It works with DeepSeek. The repository describes itself as: Safe automatic permissions for DeepSeek Harness. The licence is MIT.

When your agent uses it

  • A guided lifecycle workflow
  • A pre-run capability menu
  • Several DSH plugin operations with one status report

Example prompts

  • “/plugin-workflow”

Requirements

  • Node.js
  • Docker

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Read repository instructions and inspect Git status without changing it.
  2. Identify whether the target is the DSH monorepo, an external plugin source repository, an installed plugin, or a packed artifact.
  3. Record the plugin source identity, current DSH version, requested target version, package manager, available scripts, plugin surfaces, and…
  4. Mark missing inputs as unknown. Do not install dependencies, run package scripts, start containers, edit files, or query a remote registry…

What it can do on your machine

Read from SKILL.md and the folder at commit 907d663. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (JavaScript), which the agent can run.

    Shell commands in SKILL.md call:

    • node

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Plugin Workflow loads about 3k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 91 tokens; SKILL.md has 1,493 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~91
When it runs · the whole SKILL.md, loaded when a task matches
~3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from NanmiCoder/dsh-auto-mode at commit 907d663, republished under its MIT licence (© NanmiCoder). 1,493 words, ~2,998 tokens.

Download SKILL.mdSave it as .claude/skills/plugin-workflow/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
plugin-workflow
description
Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release. Use for a guided lifecycle workflow, a pre-run capability menu, or several DSH plugin operations with one status report. Preserve the user's selected scope and existing authorization across stages.

Coordinate the DSH Plugin Lifecycle

Act as the workflow controller. Let the user choose outcomes and optional proof before execution, route each selected stage to its owning Skill, preserve one phase ledger, and return one evidence-backed report. Do not copy the detailed rules of an owning Skill into this Skill.

Show the pre-run menu first

When the user has not explicitly selected a workflow, present the workflow and capability tables below before running any phase. Match the user's language, mark health-check as the recommended first-run choice, and wait for a selection. A recommendation is not a selection: do not silently default to health-check, start discovery, or execute a capability.

Accept a workflow number, workflow ID, or unambiguous natural-language outcome. Let the user add or remove capabilities in the same reply, for example 3 + docker-smoke + browser-check. Briefly identify which selected capabilities are read-only and which will later cross a confirmation boundary.

The bundled planner renders the same deterministic menu and remains read-only:

sh
node <plugin-workflow-skill>/scripts/plan-workflow.mjs
# Equivalent explicit form:
node <plugin-workflow-skill>/scripts/plan-workflow.mjs --menu

If the user already selected an outcome and supplied enough context, preserve that choice and continue without showing the menu again.

Continue with read-only discovery

Inspect only enough context to make the choices concrete:

  1. Read repository instructions and inspect Git status without changing it.
  2. Identify whether the target is the DSH monorepo, an external plugin source repository, an installed plugin, or a packed artifact.
  3. Record the plugin source identity, current DSH version, requested target version, package manager, available scripts, plugin surfaces, and existing naming declaration.
  4. Mark missing inputs as unknown. Do not install dependencies, run package scripts, start containers, edit files, or query a remote registry during discovery.

Choose one workflow

WorkflowOutcomeDefault stages
health-checkRead-only plugin and upgrade-risk reportdiscovery, optional DSH audit, seven-touchpoint scan
upgrade-targetUpgrade an installed plugin to an explicit versiondiscovery, upgrade, static checks, rollback record
compatibility-migrationAdapt plugin source to an exact DSH targetdiscovery, DSH audit, seven-touchpoint migration, static and runtime tests
test-onlyValidate an existing source tree or artifactdiscovery, selected test levels, report
naming-registryValidate identifiers and optionally check or register a cloud IDdiscovery, offline naming, registry query, optional registration
package-releasePrepare and optionally publish a releasediscovery, required test gates, pack, consumer smoke, optional publication
full-lifecycleMigrate, validate, name, package, and optionally publishall applicable stages in dependency order
runtime-debugDiagnose and fix Web Client runtime behaviorruntime diagnosis/fix, static, functional and browser proof, rollback
heavy-dependencyIntegrate a lazy-loaded Web Client dependencyintegration, static, functional and browser proof, rollback, package inspection

The last two workflows require the web-client surface. They can also be added as capabilities to a migration. Use health-check for a read-only investigation; a request to diagnose a symptom does not by itself select a fix workflow.

Then let the user include or exclude these capabilities. Recommend the smallest set that proves their stated outcome and state which recommended items are still unselected.

CapabilityChoiceDefault
DSH version compatibility auditdsh-auditOn for compatibility migration; otherwise off
Seven-touchpoint plugin scantouchpoint-scanOn for health checks and migrations
Typecheck, unit tests, and buildstatic-testsOn after source changes and before packaging
Exact-version Docker cold startdocker-smokeOn for migrations and release candidates when Docker is available
One real functional pathfunctional-probeOn for migrations and releases
Browser validationbrowser-checkOn only for Web Client or UI surfaces
Offline naming declaration validationnaming-localOn for new external plugins; otherwise opt-in
Central cloud registry lookupregistry-queryOff until selected; read-only
Central cloud ID registrationregistry-registerOff; requires reviewed external publication
Rollback rehearsal or reciperollbackRecipe on for every write workflow; rehearsal is opt-in
Build and inspect a package artifactpackage-artifactOn for package/release and full lifecycle workflows
Publish an artifact or releasereleaseOff unless external release intent is explicit
Diagnose and fix Web Client runtime behaviorruntime-debugOff unless selected; requires static, functional and browser proof plus rollback
Integrate a heavy browser dependencyheavy-dependencyOff unless selected; requires the same proof plus package inspection

After the user chooses, normalize the selection with the bundled read-only planner. Read references/workflow-selection.schema.json when another tool needs to produce the input JSON.

sh
node <plugin-workflow-skill>/scripts/plan-workflow.mjs \
  --workflow compatibility-migration \
  --include registry-query \
  --exclude browser-check \
  --surface ordinary-plugin

Use --format json for automation, or --selection <selection.json> for a persisted input that follows the schema. Calling the planner without a selection prints the menu instead of creating a default plan. The planner validates conflicts and required dependencies, emits deterministic phase IDs and confirmation boundaries, and never executes the selected phases. Treat its output as the initial ledger, not as user approval.

Do not treat registry-query as a reservation. Do not treat registry-register as required for local plugin use. A local plugin and the central registry may share a display name; only concrete identifiers on the same runtime surface can conflict, and the naming owner must report those exact matches.

Build the phase ledger

Create one row per selected or dependency-required stage before execution:

PhaseCapabilityOwnerStatusEvidence or blocker
P01discoveryplugin-workflowselectedtarget and source identity

Use only these status values:

  • selected: chosen and not yet completed;
  • completed: finished with evidence;
  • blocked: attempted or required but unable to proceed;
  • skipped: applicable but deliberately not run;
  • not_applicable: irrelevant to the detected plugin surface or workflow.

Never turn an unavailable or unselected check into completed. When a phase is blocked, mark dependent phases blocked or skipped with the dependency reason and continue only with independent, authorized phases.

Show full SKILL.md (600 more words)Show less

Route each stage to its owner

Before executing a stage, load and follow its owning Skill. If the owner is unavailable, mark the phase blocked; do not recreate its implementation from memory.

StageOwning SkillBoundary
Installed update or source compatibility migration$plugin-upgradeInspect first; check authorization for config, dependency, or source changes
New plugin code or offline naming declaration$plugin-writeFollow the exact target Harness contract
Static, runtime, Docker, functional, or browser validation$plugin-testSelect the minimum sufficient levels and preserve evidence
Package, release gates, publication, and release rollback$plugin-releaseCheck the publication destination and authorization
DSH host version-to-version evidence$dsh-upgrade-auditKeep generated evidence separate from plugin source changes
Web Client runtime diagnosis and repair$plugin-runtime-debugEstablish the exact host contract and reproduce the failing interaction
Lazy-loaded browser dependency integration$plugin-heavy-depOwn chunk loading, host route, fallback and markup handling

Keep one owner per phase. When runtime debugging and dependency integration overlap, record the diagnosed contract and let the integration owner consume it instead of starting a competing rewrite. Reuse the selected target version and source identity across owners. If a later owner changes source, dependencies or the package artifact, invalidate the earlier verification that depended on those inputs and rerun it.

Run stages in dependency order:

  1. discovery and source identity;
  2. DSH audit when selected;
  3. upgrade or implementation changes, then selected runtime repair or dependency integration;
  4. offline naming and optional registry query;
  5. static tests;
  6. Docker, functional, and browser proof;
  7. release preparation and artifact inspection;
  8. external registration or publication.

Skip stages that are not selected unless an owning Skill makes them a hard gate for a later selected stage. In that case, add the gate to the ledger, explain why it is required, and obtain any needed confirmation before running it.

Preserve authorization across three boundaries

Group planned actions by boundary and check each against the user's request and higher-priority instructions. Existing explicit authorization applies to the same scope when handing off to another Skill; do not ask again merely because the owner changed. A generated plan grants no authorization, and authorization for source edits does not implicitly authorize publication. Ask only when a required action is outside the authorization already supplied.

  1. Repository writes: show exact files, intended changes, and rollback scope before editing source, configuration, manifests, or lockfiles.
  2. Dependency and runtime execution: show package-manager commands, lifecycle-script risk, containers, services, browsers, credentials, and expected generated outputs before installs or nontrivial runtime tests. Ordinary read-only Git and file inspection does not need confirmation.
  3. External publication: identify the exact destination and payload for commits, tags, registry PRs, npm artifacts, or hub/collection changes, and confirm that this action is within the user's authorization.

If a selected phase crosses more than one boundary, check each boundary when it becomes actionable. Never request or expose secrets merely to complete a phase.

Maintain and report evidence

Update the ledger after every phase, including failures and explicit skips. Keep exact versions, source SHAs, commands, exit codes, report paths, and uncovered boundaries. Before finishing, verify that every selected capability has a terminal status.

Return one report containing:

  1. workflow and capability selection;
  2. source and target identities;
  3. final phase ledger;
  4. changes made and commits created;
  5. test and registry evidence;
  6. blocked, skipped, and unverified boundaries;
  7. rollback instructions limited to paths owned by this workflow;
  8. publication state, clearly distinguishing local validation, no reviewed registry match, reviewed registration, and released artifacts.

Do not summarize a partial cold start as functional compatibility, a registry no-match as a reserved ID, or a prepared artifact as published.

© NanmiCoder, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/plugin-workflow of NanmiCoder/dsh-auto-mode.

  • SKILL.md
  • agents/openai.yaml
  • references/workflow-selection.schema.json
  • scripts/plan-workflow.check.mjs
  • scripts/plan-workflow.mjs

Open the folder on GitHubat commit 907d663

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in NanmiCoder/dsh-auto-mode, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Plugin Workflow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Plugin Workflow compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Plugin Workflow this skillNanmiCoder/dsh-auto-mode1651 repos~3kAutomated safety check: PassMIT
Reviewccch1mneyyy/dsh-TUI4.1k—~1.3kAutomated safety check: PassMIT
Roo Conflict Resolutionzgsm-ai/costrict4.4k—~2.3kAutomated safety check: PassApache-2.0
Deepseek Automationzhu1090093659/deepseek-pp1.9k—~2.1kAutomated safety check: NotesApache-2.0
Deep Reviewdyad-sh/dyad22k—~1.4kAutomated safety check: PassCustom licence
Readable Verilog GeneratorEriemon/verilog-generator308—~5.4kAutomated safety check: PassApache-2.0

Similar skills

  • Review

    ccch1mneyyy/dsh-TUI

    Review or de-slop concrete changes in ccch1mneyyy/dsh-TUI at maintainer level: PR numbers or URLs, branches, commit ranges, patch files, staged or unstaged worktrees, and scoped repository-hygiene…

    4.1k GitHub stars~1.3k tokensUpdated today
    DevelopmentAuto-check passed
  • Roo Conflict Resolution

    zgsm-ai/costrict

    Provides comprehensive guidelines for resolving merge conflicts intelligently using git history and commit context.

    4.4k GitHub stars~2.3k tokensUpdated 7 days ago
    DevelopmentAuto-check passed
  • Deepseek Automation

    zhu1090093659/deepseek-pp

    A skill your agent uses when implementing, resuming, reviewing, or verifying the DeepSeek++ Codex-style automation feature in this repository.

    1.9k GitHub stars~2.1k tokensUpdated 1 mo ago
    DevelopmentAuto-check: notes
  • Deep Review

    dyad-sh/dyad

    Deep multi-agent code review run locally — a fleet of parallel finder agents reviews the diff from independent angles, then adversarial verifier agents reproduce each finding before it is reported.

    22k GitHub stars~1.4k tokensUpdated today
    DevelopmentAuto-check passed
  • Readable Verilog Generator

    Eriemon/verilog-generator

    A skill your agent uses when creating, writing, reviewing, annotating, repairing, refactoring, or validating readable Verilog RTL, including synthesizable Verilog-2001 .v files, existing-RTL…

    308 GitHub stars~5.4k tokensUpdated 1 mo ago
    DevelopmentAuto-check passed
  • Skillhone

    Tencent/SkillHone

    Local Issue, pull-request, and Wiki workbench for agent skills.

    168 GitHub stars~3.4k tokensUpdated 17 days ago
    DevelopmentAuto-check passed

More from NanmiCoder/dsh-auto-mode

All 10 skills in this repo
  • Dsh Upgrade Audit

    NanmiCoder/dsh-auto-mode

    Audit external compatibility between two DSH (DeepSeek Harness) versions and detect reverts, producing an upgrade-report directory; compares git tags with a source checkout, or published npm…

    165 GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed
  • Plugin Write

    NanmiCoder/dsh-auto-mode

    A skill your agent uses when creating a DeepSeek Harness plugin, choosing public names for a new external DSH plugin, validating a dsh-plugin.naming.json manifest, checking reviewed central…

    165 GitHub starsUsed in 1 repo~3.3k tokens
    Auto-check passed
  • Plugin Test

    NanmiCoder/dsh-auto-mode

    A skill your agent uses when writing or reviewing tests for DeepSeek Harness plugins, external DSH plugin packages, or package changes in the deepseek-harness repository.

    165 GitHub starsUsed in 1 repo~2.9k tokens
    Auto-check passed
  • Dsh Benchmark Case

    NanmiCoder/dsh-auto-mode

    A skill your agent uses when the user hands over a dsh plugin repository (or a real migration commit / version corridor) and wants its upgrade experience extracted into one auto-graded Harbor…

    165 GitHub starsUsed in 1 repo~2.7k tokens
    Auto-check: warnings
  • Plugin Release

    NanmiCoder/dsh-auto-mode

    Package, publish, and distribute DeepSeek Harness (DSH) plugins — npm pack artifact validation, GitHub/npm/hub release-track selection, tarball overrides installs for the unpublished cohort…

    165 GitHub starsUsed in 1 repo~1.6k tokens
    Auto-check: warnings
  • Plugin Heavy Dep

    NanmiCoder/dsh-auto-mode

    A skill your agent uses when adding a heavyweight browser dependency (diagram/chart renderers like mermaid, code editors, big wasm-adjacent libs) to a lightweight DSH Web plugin that must stay…

    165 GitHub starsUsed in 1 repo~1.4k tokens
    Auto-check passed

Works with

Categories

Questions about Plugin Workflow

What does Plugin Workflow do?

Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release. Plugin Workflow is an agent skill from NanmiCoder/dsh-auto-mode. Coordinate multiple DeepSeek Harness plugin Skills across inspection, migration, runtime debugging, heavy dependencies, testing, naming, and release.

When should I use Plugin Workflow?

Plugin Workflow fits situations like: A guided lifecycle workflow; A pre-run capability menu; several DSH plugin operations with one status report.

How do I install Plugin Workflow in Claude Code?

Run `npx skills add NanmiCoder/dsh-auto-mode --skill plugin-workflow -a claude-code`. Or copy the skill folder (skills/plugin-workflow in NanmiCoder/dsh-auto-mode) into .claude/skills/plugin-workflow in your project. Claude Code loads it when a task matches its description.

How do I install Plugin Workflow in Codex?

Run `npx skills add NanmiCoder/dsh-auto-mode --skill plugin-workflow -a codex`. Or copy the skill folder (skills/plugin-workflow in NanmiCoder/dsh-auto-mode) into .agents/skills/plugin-workflow in your project. Codex loads it when a task matches its description.

Can I use Plugin Workflow in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add NanmiCoder/dsh-auto-mode --skill plugin-workflow -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/plugin-workflow, .gemini/skills/plugin-workflow, .github/skills/plugin-workflow and .opencode/skills/plugin-workflow in your project.

What does Plugin Workflow need to run?

Going by SKILL.md and its folder, Plugin Workflow needs JavaScript for the scripts in its folder and the command-line tools its instructions call (node). Our summary lists: Node.js; Docker.

Does Plugin Workflow access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Plugin Workflow safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Plugin Workflow use?

Plugin Workflow is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Plugin Workflow use?

About 3k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 459 tokens, read only when the agent opens those files.

What are the alternatives to Plugin Workflow?

Skills that share tags, products or a category with Plugin Workflow: Review (ccch1mneyyy/dsh-TUI, 4.1k stars), Roo Conflict Resolution (zgsm-ai/costrict, 4.4k stars), Deepseek Automation (zhu1090093659/deepseek-pp, 1.9k stars) and Deep Review (dyad-sh/dyad, 22k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Plugin Workflow?

NanmiCoder (a GitHub user) maintains it in NanmiCoder/dsh-auto-mode, which has 165 GitHub stars. The repository holds 10 skills in this directory. The repository was last updated on September 29, 2026.

Source: NanmiCoder/dsh-auto-mode on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.