skills/creating-plugins/SKILL.md
Packages repository skills as installable Copilot plugins: marketplace registration, `plugin.json` manifests, generated skill copies, and the sync check CI enforces. Use when bundling one or more skills for installation, when adding a plugin to the marketplace, or when `npm run lint` reports that a plugin copy has drifted from its source skill.
npx skillsauth add jaktestowac/awesome-copilot-for-testers creating-pluginsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill when a skill or a small group of skills should be installable as a unit rather than copied by hand.
The rule that governs everything here: skills/ at the repository root is the source of truth, and everything under plugins/*/skills/ is generated output that happens to be committed. The generator is npm run plugin:materialize; the guard is scripts/check-plugin-sync.js, which CI runs as part of npm run lint. Editing a plugin copy directly produces a drift error and loses the edit on the next materialize.
npm run lint reports a plugin copy that does not match its source skillskills/<name>/ and flows outward.skills/ at the repository root. That is why the copies exist.A plugin ships one skill, or a small group used together.
| Shape | Justified when |
| --- | --- |
| One skill | It stands alone, and nothing else is needed to use it |
| A skill plus its quick variant | The pair covers routine and deep use of the same capability, like writing-unit-tests |
| Several cooperating skills | A user reaching for one reliably reaches for the others in the same session |
Not justified: grouping by topic. "All the testing skills" is a directory listing, not a plugin. The user installs it, gets fifteen descriptions competing for the same triggers, and picks worse than they would have with three.
Before bundling, confirm the skills are distinct enough to coexist. Two skills whose descriptions overlap will collide harder inside one plugin than they do in a repository, because the user installed both deliberately.
npm run plugin:generate -- planning-exploratory-testing
scripts/generate-plugins.js writes the entry into .github/plugin/marketplace.json, taking the
description from plugins/<name>/.github/plugin/plugin.json if the plugin folder already exists,
otherwise from the frontmatter of skills/<name>/SKILL.md. Entry order is preserved and new
entries are appended, so the file stays readable in diffs.
| Command | Does |
| --- | --- |
| npm run plugin:generate -- <name> | add the entry for one plugin or root skill |
| npm run plugin:generate -- <name> --description='...' | add it with a written description instead of the skill's |
| npm run plugin:generate | backfill entries for every plugin folder missing one |
| npm run plugin:generate:all | register every root skill, refreshing existing entries from their SKILL.md |
| npm run plugin:generate -- --dry-run | print what would change, write nothing |
| npm run plugin:generate -- --no-overwrite | report drift instead of rewriting an entry |
| npm run plugin:generate -- --verbose | list every item instead of a count |
| node scripts/generate-plugins.js --check | fail if a plugin folder has no entry (CI, part of npm run lint) |
Which file wins. The pipeline flows one way, and each step overwrites what is downstream of it:
skills/<name>/SKILL.md → marketplace.json → plugins/<name>/ → README.md
(frontmatter) (the registry) (plugin.json, (the tables)
README description)
plugin:generate:all therefore rewrites an existing entry's description from the skill's
frontmatter - a marketplace description edited by hand does not survive it. Write the listing
description in the skill's frontmatter, or use --description= per plugin, or pass
--no-overwrite to keep what is there and have the drift reported instead. A version somebody
bumped is never reset by a refresh; only --version= changes it.
plugin:generate:all packages the repository in bulk. It skips a skill another plugin already
ships, and it skips <name>-quick when skills/<name>/ exists, printing the plugin.json line
that bundles the quick variant with its parent instead. Pair it with --dry-run first, and read
Phase 0 before accepting the result: one plugin per skill is a defensible default, but a pair used
together belongs in one plugin. --check never demands a plugin for a root skill - an unpackaged
skill is a normal state - so bulk mode stays opt-in and CI stays quiet about it.
A description derived from the skill frontmatter is a starting point, not the finished entry - the generator says so when it uses one. Rewrite it as a marketplace listing, then continue.
The resulting entry, hand-written or generated:
{
"name": "planning-exploratory-testing",
"source": "plugins/planning-exploratory-testing",
"description": "Runs session-based exploratory testing: charters, timeboxed sessions, coverage heuristics, evidence-carrying notes, and debriefs that route every finding somewhere. Bundles the charter format with worked examples per context, the SFDIPOT and tour heuristics, a session note template with a coverage summary, and the PROOF debrief. Use when a feature needs testing before requirements settle, or when scripted cases keep passing while users hit problems.",
"version": "1.0.0"
}
The name matches the plugin directory under source. The description is what a user reads before installing, so it says what is inside and when to reach for it, in more detail than the skill's own description needs to.
npm run plugin:materialize
This does two things, per scripts/materialize-plugins.js:
Scaffold - creates the plugin directory, a .github/plugin/plugin.json, and a README.md for every marketplace entry with a local source, then rewrites the generated fields on every run so the plugin always matches its marketplace entry:
| File | Overwritten | Preserved |
| --- | --- | --- |
| plugin.json | name, description, version, author, repository, license | keywords and skills - curated by hand, and not derivable from the entry |
| README.md | the frontmatter description | the whole body, which is hand-written prose |
--force-readme rewrites plugin READMEs wholesale from the template, discarding that prose. Use it to reset a README the scaffolder generated, not one somebody wrote.
Materialize - copies each skill declared in each plugin.json from skills/ into the plugin, and prunes copies no longer declared. A copy that already matches its source is left alone, so the output names only what changed.
The generated tree:
plugins/<plugin-name>/
.github/plugin/plugin.json
README.md
skills/<skill-name>/
SKILL.md
resources/...
The scaffolder writes a plugin.json; fill in what it cannot know.
{
"name": "planning-exploratory-testing",
"description": "...",
"version": "1.0.0",
"author": { "name": "jaktestowac.pl" },
"repository": "https://github.com/jaktestowac/awesome-copilot-for-testers.git",
"license": "MIT",
"keywords": [
"exploratory testing", "session-based testing", "charters",
"test heuristics", "SFDIPOT", "tours", "manual testing", "QA"
],
"skills": ["./skills/planning-exploratory-testing/"]
}
skills paths are relative to the plugin root and resolve to skills/<name>/ at the repository root during materializekeywords are how a user finds the plugin; include the terms they would search, including the ones the skill's own description does not needkeywords and skills are the two fields a re-materialize leaves alone - edit them heredescription and version come from the marketplace entry and are rewritten on every materialize; change them there, not hereThe body is yours to write and survives every re-materialize; the frontmatter description is
taken from the marketplace entry, so change it there. Then:
The resource list matters more than it looks. It is the difference between "a skill about exploratory testing" and "the charter format, the SFDIPOT heuristics, the note template, and the PROOF debrief", and it is what tells a user whether the plugin is worth installing.
Use ./resources/plugin-readme.template.md.
npm run plugin:materialize # regenerate the copies
npm run generate # regenerate the repository README tables
npm run check # verify the README is in sync
npm run lint # frontmatter, orchestration, plugin sync
check-plugin-sync.js performs two checks:
plugin.json has a materialized copy with a SKILL.mdA drift error means a plugin copy was edited directly, or a root skill changed without a re-materialize. Both are fixed by editing the root skill and running npm run plugin:materialize.
The recurring rule for anyone changing a skill that a plugin vendors:
Edit
skills/<name>/. Then runnpm run plugin:materialize && npm run generate.
Add it to the pull request habit. The lint catches it, but catching it in CI costs a round trip that a one-line habit avoids.
plugins/*/skills/, which fails the sync check and is lost on the next materializeplugin.json declaring a skill that does not exist at the repository rootdescription or version in plugin.json, which the next materialize overwrites from the marketplace entryplugin:generate:all, which takes the skill's frontmatter back./resources/plugin-manifest.template.md - plugin.json and marketplace entry, annotated field by field, with a worked example./resources/plugin-readme.template.md - README structure, the resource-listing pattern, and a worked example./resources/plugin-packaging-checklist.md - pre-ship checks and the drift-error troubleshooting tablecreating-skills - for the skill that the plugin ships; the skill has to be good before packaging matterscreating-orchestration-packs - when the thing being packaged is a pack of agents rather than skillscreating-custom-agents - when the capability belongs in an agentdocumenting-test-suites - for the same instinct applied to a test suite: say what is inside and how to startThis skill is complete when:
plugin.json carries author, repository, license, searchable keywords, and correct relative skill pathsplugins/*/skills/ was hand-editednpm run plugin:materialize, npm run generate, npm run check, and npm run lint all passplugin.json and the marketplace entrytesting
Tests the customization assets themselves - skills, prompts, custom agents, instructions - the way a product is tested: activation cases that check an asset fires when it should and stays quiet when it should not, output-contract cases, safety cases, collision cases between assets competing for the same trigger, a weighted rubric scored blind, and a baseline-versus-candidate gate before an edit ships. Use when a skill is edited and nobody knows whether behaviour changed, when two skills fight over the same request, when a description is being tuned for discoverability, when a collection has grown past manual spot-checking, or when the request mentions skill evals, prompt regression, or "does this skill actually work".
development
Shapes QA output for the person who has to act on it: result and blocker in the first two lines, one decision per report, findings ordered by what they cost, the long artifact in a file and the decisions in the message, and magnitude stated in units the reader can count. Use when a report is accurate but nobody acts on it, when a finding set is too long to read under time pressure, when the same findings must be retold for a developer, a release manager, and an on-call engineer, or when the request mentions "too long", "make this readable", "just tell me what to do", "so what", or "summarize this for stakeholders". Pairs with unslop-answers, which makes the same report honest.
testing
Verifies that the lines and branches a change actually touched are executed by tests, using LCOV or Cobertura diff coverage instead of whole-repo percentages, and escalates uncovered high-risk changes into a blocking finding. Use when a pull request needs a coverage gate that unrelated tests cannot satisfy, when total coverage looks healthy but the diff is untested, when wiring diff coverage into CI, or when someone claims a change is covered because the suite is green.
development
Cuts AI tells from test code: tests that pass without proving anything, tautological assertions, mock-only tests, hardcoded waits, coverage theater, vague names, swallowed errors, retries used as fixes. Use whenever test code is written, changed, or reviewed, including tests produced as a side effect of a feature task, and when the request mentions "review these tests", "are these tests any good", "this test always passes", "this suite is flaky", or "clean up these tests". Must always apply to test code.