plugin-builder SKILL.md skillA
plugin-builder from aidotnet/nextcowork is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add aidotnet/nextcowork/plugin-builder@git:20260921.30e46b6Pins git:20260921.30e46b6 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- aidotnet/nextcowork
- Path
resources/skills/plugin-builder/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260921.30e46b6, committed Sep 21, 2026
- First version recorded
- Sep 18, 2026
- Size
- 9,708 bytes
- Repository stars
- 640
- License
- Apache-2.0
Author, package, and debug NextCoWork plugins — the single entry point. Covers the manifest (package.json) and the permission model with per-call capability gates, every contribution point (commands, menus, keybindings, custom editors, views, web apps, agent tools, card views, configuration, bundled Skills) including which install cleanly but do nothing yet, the ncw:doc document channel, result / live-progress / interactive cards, the nextcowork runtime API namespaces, the sandbox and…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# NextCoWork Plugin Builder Build plugins that extend the NextCoWork desktop app and its AI agent. A plugin is a self-contained package that runs **sandboxed** and talks to the host over a small, permissioned RPC surface. ## Read the reference you need — this page is the map The details live in `references/`, next to this `SKILL.md`. Read the file that matches the task; this page alone is not enough to write a working plugin. | Task | Reference | |---|---| | **Every `contributes` key, what it does, and which ones do nothing yet** | `references/contribution-points.md` | | Manifest fields, the permission model, what needs which capability | `references/manifest-permissions.md` | | Method → permission, one row per RPC | `references/permission-map.md` | | Taking over file types (custom editors), views, the document channel | `references/custom-editors.md` | | Contributing agent tools, result / live / interactive cards | `references/agent-tools.md` | | Runtime API namespaces (workspace / net / process / storage / secrets / window / tabs / …) | `references/runtime-api.md` | | Build, ZIP layout, installer checks, market publish | `references/packaging.md` | …
Read the whole file at its exact version.
How to install
mdr add aidotnet/nextcowork/plugin-builder@sha256:4146226bd97940a8The line at the top of this page pins the label git:20260921.30e46b6, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_poinshxdrxvqbswp)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 18, 2026 and Sep 21, 2026, about one every day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260921.30e46b6 latest | 2026-09-21 | 30e46b6 | 9,708 B | A | view · diff |
| git:20260920.1831b6a | 2026-09-20 | 1831b6a | 9,489 B | A | view · diff |
| git:20260918.45676f4 | 2026-09-18 | 45676f4 | 18,579 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9708 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
aidotnet/nextcowork · 640 stars · license Apache-2.0 · pushed 2026-10-17 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_poinshxdrxvqbswp GET https://markdownregistry.com/api/v1/resolve?ref=aidotnet/nextcowork/plugin-builder GET https://markdownregistry.com/api/v1/blob/4146226bd97940a89371c39fdf2cf59be3fdf4a17e91fbe7619e07f17b9ea80e
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from aidotnet/nextcowork
Every file in aidotnet/nextcowork