By SummerSec
Guides creating, validating, and reviewing Claude Code plugins with step-by-step workflows for agent, command, hook, skill, and MCP components, plus an interactive plugin creation wizard and review agents that catch issues early.
Use this agent when the user asks to "create an agent", "generate an agent", "build a new agent", "make me an agent that...", or describes agent functionality they need. Trigger when user wants to create autonomous agents for plugins. Examples: <example> Context: User wants to create a code review agent user: "Create an agent that reviews code for quality issues" assistant: "I'll use the agent-creator agent to generate the agent configuration." <commentary> User requesting new agent creation, trigger agent-creator to generate it. </commentary> </example> <example> Context: User describes needed functionality user: "I need an agent that generates unit tests for my code" assistant: "I'll use the agent-creator agent to create a test generation agent." <commentary> User describes agent need, trigger agent-creator to build it. </commentary> </example> <example> Context: User wants to add agent to plugin user: "Add an agent to my plugin that validates configurations" assistant: "I'll use the agent-creator agent to generate a configuration validator agent." <commentary> Plugin development with agent addition, trigger agent-creator. </commentary> </example>
Use this agent when the user asks to "validate my plugin", "check plugin structure", "verify plugin is correct", "validate plugin.json", "check plugin files", or mentions plugin validation. Also trigger proactively after user creates or modifies plugin components. Examples: <example> Context: User finished creating a new plugin user: "I've created my first plugin with commands and hooks" assistant: "Great! Let me validate the plugin structure." <commentary> Plugin created, proactively validate to catch issues early. </commentary> assistant: "I'll use the plugin-validator agent to check the plugin." </example> <example> Context: User explicitly requests validation user: "Validate my plugin before I publish it" assistant: "I'll use the plugin-validator agent to perform comprehensive validation." <commentary> Explicit validation request triggers the agent. </commentary> </example> <example> Context: User modified plugin.json user: "I've updated the plugin manifest" assistant: "Let me validate the changes." <commentary> Manifest modified, validate to ensure correctness. </commentary> assistant: "I'll use the plugin-validator agent to check the manifest." </example>
Use this agent when the user has created or modified a skill and needs quality review, asks to "review my skill", "check skill quality", "improve skill description", or wants to ensure skill follows best practices. Trigger proactively after skill creation. Examples: <example> Context: User just created a new skill user: "I've created a PDF processing skill" assistant: "Great! Let me review the skill quality." <commentary> Skill created, proactively trigger skill-reviewer to ensure it follows best practices. </commentary> assistant: "I'll use the skill-reviewer agent to review the skill." </example> <example> Context: User requests skill review user: "Review my skill and tell me how to improve it" assistant: "I'll use the skill-reviewer agent to analyze the skill quality." <commentary> Explicit skill review request triggers the agent. </commentary> </example> <example> Context: User modified skill description user: "I updated the skill description, does it look good?" assistant: "I'll use the skill-reviewer agent to review the changes." <commentary> Skill description modified, review for triggering effectiveness. </commentary> </example>
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.
This skill should be used when the user asks to "add MCP server", "integrate MCP", "configure MCP in plugin", "use .mcp.json", "set up Model Context Protocol", "connect external service", mentions "${CLAUDE_PLUGIN_ROOT} with MCP", or discusses MCP server types (SSE, stdio, HTTP, WebSocket). Provides comprehensive guidance for integrating Model Context Protocol servers into Claude Code plugins for external tool and service integration.
This skill should be used when the user asks about "plugin settings", "store plugin configuration", "user-configurable plugin", ".local.md files", "plugin state files", "read YAML frontmatter", "per-project plugin settings", or wants to make plugin behavior configurable. Documents the .claude/plugin-name.local.md pattern for storing plugin-specific configuration with YAML frontmatter and markdown content.
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
SummerSec 个人 Agent Skills 集合,按类别分插件管理。

SumSec-Skills/
├── writing-zh/ # 中文写作插件
│ └── skills/
│ ├── humanizer-zh/ 去 AI 味润色
│ ├── creating-blog-web-ppt/ 文章转网页 PPT
│ ├── khazix-writer/ 卡兹克写作风格 (khazix-skills)
│ └── sumsec-illustrations/ SumSec 博客正文配图
├── media-tools/ # 媒体生成插件
│ └── skills/
│ ├── draw-image-generation/ AI 图片生成
│ └── remotion-best-practices/ Remotion 视频
├── dev-tools/ # 开发工具插件
│ └── skills/
│ ├── git-commit-pr/ Git 提交与 PR
│ ├── agent-chat-history/ 对话历史检索
│ ├── frontend-design/ 前端界面实现
│ └── baoyu-design/ UI 设计稿与原型生成
├── agents-dev/ # Agent 开发生态插件(聚合)
│ └── skills/
│ ├── skill-creator/ 技能创建(claude-plugins-official)
│ ├── writing-rules/ Hook rules 生成(hookify)
│ ├── agent-sdk-dev/ Agent SDK 开发
│ ├── claude-agents-symlink/ CLAUDE.md 指向 AGENTS.md
│ ├── skill-optimizer/ Skill 审计优化
│ ├── multi-platform-plugin-guide/ 多平台版本对齐
│ └── workflow-skill-creator/ 流程编排 Skill 设计
├── skills/ # 通用 skill 聚合入口(symlink 到各插件 skills)
├── plugin-dev/ # 镜像:插件开发七件套(agent/command/hook/skill/MCP/structure/settings)
├── claude-md-management/ # 镜像:CLAUDE.md 维护
├── claude-code-setup/ # 镜像:Claude Code 自动化建议
├── hookify/ # 原创:Hook 创建工具
├── cloudflare-email/ # Cloudflare 临时邮箱插件
├── taste-skill/ # Taste Skill 跨平台插件封装
├── openclaw.plugin.json # OpenClaw 插件清单
├── openclaw/ # OpenClaw 插件入口 & skills
├── opencode/ # OpenCode 插件入口 & rules
├── hermes/ # Hermes skills & context
├── .claude-plugin/ # 根 marketplace
├── .cursor-plugin/
├── .codex-plugin/
├── .agents/plugins/
├── .cursor/rules/
├── khazix-skills/ # submodule: KKKKhazix/khazix-skills
├── taste-skill-upstream/ # submodule: Leonxlnx/taste-skill
├── AGENTS.md
├── README.md
├── package.json
└── plugin.json
/plugin marketplace add https://github.com/SummerSec/SumSec-Skills.git
/plugin install writing-zh@sumsec-skills
/plugin install media-tools@sumsec-skills
/plugin install dev-tools@sumsec-skills
/plugin install agents-dev@sumsec-skills
/plugin install plugin-dev@sumsec-skills
/plugin install claude-md-management@sumsec-skills
/plugin install claude-code-setup@sumsec-skills
/plugin install hookify@sumsec-skills
/plugin install cloudflare-email@sumsec-skills
/plugin install taste-skill@sumsec-skills
codex plugin marketplace add SummerSec/SumSec-Skills --ref master
然后在 Codex 的 /plugins 里选择 SumSec Skills,按需安装 writing-zh、media-tools、dev-tools、agents-dev、plugin-dev、claude-md-management、claude-code-setup、hookify、cloudflare-email、taste-skill 等插件。仓库内的 .agents/plugins/marketplace.json 是 repo-scoped marketplace,每个插件条目使用 source: "local" + 对应子目录 path(如 ./writing-zh)指向当前 checkout;Git 获取由 codex plugin marketplace add 管理,不在插件条目里写 url/ref。
Codex 也会直接扫描仓库级 .agents/skills/,适合放仅服务本仓的工具型 skill;需要分发给其他项目或团队时,应打包进 .codex-plugin/plugin.json 所描述的插件。
将 <plugin>/skills/<skill-name>/ 链接到对应客户端 skill 目录:
ln -sf "$(pwd)/dev-tools/skills/git-commit-pr" ~/.claude/skills/git-commit-pr
| 客户端 | skill 目录/安装方式 |
|---|---|
| Claude Code | /plugin install <plugin>@sumsec-skills |
| Cursor | .cursor-plugin/marketplace.json 导入 |
| OpenAI Codex CLI | codex plugin marketplace add SummerSec/SumSec-Skills --ref master |
| OpenClaw | openclaw.plugin.json + openclaw/ 插件加载 |
| OpenCode | opencode/plugins/sumsec-skills.js 插件注册 |
| Hermes | hermes/skills/sumsec-skills/SKILL.md 复制加载 |
| 通用 symlink | ~/.agents/skills/<name>/ -> <plugin>/skills/<name>/ |
| 技能 | 来源 | 说明 |
|---|---|---|
| humanizer-zh | 本仓库 | 去 AI 味:本地 CLI + 深度指南,反 AI 审查二遍工作流 |
| creating-blog-web-ppt | 本仓库 | Markdown 文章转网页 PPT(slide-writer + blog-sumsec 主题) |
| khazix-writer | khazix-skills | 卡兹克写作风格:用特定口吻和节奏写公众号长文 |
| sumsec-illustrations | 本仓库 | 为 sumsec.me 风格文章生成 SumSec Observer 正文配图 |
| 技能 | 说明 |
|---|---|
| draw-image-generation | 调用 Right.Codes API 生成 AI 图片 |
| remotion-best-practices | Remotion React 视频最佳实践 |
npx claudepluginhub summersec/sumsec-skills --plugin plugin-devShiroAttack2 — Shiro-550 漏洞利用工具:密钥爆破、Gadget 链探测、命令执行、内存马注入、Key 修改。
Apache Shiro-550 漏洞利用 CLI:单目标探测、密钥爆破、Gadget 链自动检测、命令执行、内存马注入、Key 修改。
Makes Claude Code sessions expose a visible Inner OS monologue layer in the format ▎InnerOS:...
Analyze codebases and recommend tailored Claude Code automations such as hooks, skills, MCP servers, and subagents.
Cloudflare temp mail agent skill for reading inbox messages, fetching parsed mail, and sending email with an Address JWT.
Access thousands of AI prompts and skills directly in your AI coding assistant. Search prompts, discover skills, save your own, and improve prompts with AI.
Consult multiple AI coding agents (Gemini, OpenAI, Grok, Perplexity, plus codex, antigravity, and grok CLIs when installed) to get diverse perspectives on coding problems
Complete developer toolkit for Claude Code
Production-grade engineering skills for AI coding agents — covering the full software development lifecycle from spec to ship.
Intelligent draw.io diagramming plugin with AI-powered diagram generation, multi-platform embedding (GitHub, Confluence, Azure DevOps, Notion, Teams, Harness), conditional formatting, live data binding, and MCP server integration for programmatic diagram creation and management.
Feature development with code-architect/explorer/reviewer agents, CLAUDE.md audit and session learnings, and Agent Skills creation with eval benchmarking from Anthropic.