# Plugin Discovery

> Internal FastGPT community plugin intake helper. Detects candidate plugin metadata and prepares registry intake notes for this repository.

- Skill: `labring/plugin-discovery` (Agent Skill)
- Install (CLI): `npx skillmds@latest add labring/plugin-discovery`
- Raw SKILL.md: https://api.skillmd.com/api/skills/labring/plugin-discovery/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: labring (https://skillmd.com/u/labring)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/labring/plugin-discovery

---


# FastGPT Plugin Discovery

Use this skill for internal plugin onboarding only. It is not a public marketplace UI and it does not approve releases by itself.

## Goal

Given a candidate plugin repository or local path, produce a reviewable intake bundle:

- candidate `plugins.json` entry matching `schemas/registry.ts`
- suggested `git submodule add` command
- suggested `pnpm run plugin -- add --from packages/tools/<pluginId>` command
- detected plugin root path
- build/check/pack command plan
- hard-gate risk report
- AI policy review recommendation: `pass`, `warn`, or `fail`
- expected PR review comment content
- expected publish/revoke event evidence
- reviewer checklist

## Required Inputs

- Source repo URL or local path
- Desired `pluginId`
- Source commit SHA
- Optional nested plugin path, default `.`

## Output Contract

The registry patch must match the runtime schema in `schemas/registry.ts`. Do not copy field rules into this skill; read the schema before generating an entry.

Example:

```json
{
  "pluginId": "weatherTool",
  "version": "0.1.0",
  "type": "tool",
  "source": "https://github.com/example/weatherTool",
  "commit": "abcdef1234567890",
  "submodule": "packages/tools/weatherTool",
  "path": ".",
  "status": "pending",
  "support": "community"
}
```

Do not include a `review` field in registry entries. Review findings should be posted as GitHub PR comments. If publish automation needs a machine-readable verdict, pass it directly with `--review-verdict` and `--review-summary`. The JSON shape in `schemas/review.ts` is only for internal automation handoff:

```json
{
  "pluginId": "weatherTool",
  "version": "0.1.0",
  "verdict": "pass",
  "summary": "No blocking policy risks found.",
  "generatedAt": "2026-06-05T00:00:00.000Z"
}
```

## Hard Gates

Mark the intake as blocked if any of these are found:

- invalid registry entry
- missing `package.json`
- missing `index.ts`
- build/check/pack failure
- suspected secret or private key
- process execution through `child_process`
- destructive filesystem removal
- package checksum mismatch

## AI Policy Verdict

- `pass`: eligible for autonomous publish after deterministic gates pass
- `warn`: do not publish; place in periodic review queue
- `fail`: do not publish; require remediation

## Review Report Template

```markdown
## Plugin Review: <pluginId>@<version>

Source: <repo>
Commit: <sha>
Path: <path>
Verdict: pass | warn | fail

## Detected Plugin Shape
- package:
- entry:
- manifest:

## Hard Gates
- registry:
- source layout:
- build/check/pack:
- policy scan:

## AI Policy Review
- license:
- secrets:
- network:
- filesystem/process:
- dependency risk:

## GitHub Comment
- target PR:
- top-level comment posted:
- inline comments posted:

## Publish Evidence
- package:
- sha256:
- receipt:

## Reviewer Checklist
- [ ] Source repo and commit match registry
- [ ] Plugin repository has its own `packageManager` and `pnpm-lock.yaml`
- [ ] Plugin dependencies do not use `catalog:` or `workspace:`
- [ ] `.pkg` was rebuilt from pinned source
- [ ] Findings were posted to the GitHub PR when a PR exists
- [ ] Publish event contains package checksum and marketplace release id after publish
- [ ] Revoke action can mark the registry entry revoked and write a revoke event
```