create-plugin-scaffold
An agent skill by cursor, from cursor/plugins. Tags: catalog, code, developer-tools, plugin-api, setup.
What it does
Create a new Cursor plugin scaffold with a valid manifest, component directories, and marketplace wiring. Use when starting a new plugin or adding a plugin to a multi-plugin repository.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill create-plugin-scaffoldOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/create-plugin/skills/create-plugin-scaffold ~/.claude/skills/create-plugin-scaffoldSafety box score
Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill scaffolds a new Cursor plugin by creating files under the user's home directory, typically `~/.cursor/plugins/local/<plugin-name>/`, and can optionally add a marketplace entry. It does not ship executable code or network automation, so the main risk is writing plugin files outside the project into the user's Cursor plugin area.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, scripts, or code evaluation are included; the skill only describes files to create. |
| Network access | 0 (none) | It does not download from or send data to remote hosts; the only mention of marketplace wiring is local file editing. |
| Filesystem reach | 2 (moderate) | It explicitly creates and saves files in the home directory under `~/.cursor/plugins/local/<plugin-name>/`, which is outside the working project. |
| Secrets & credentials | 0 (none) | The skill does not request tokens, keys, passwords, or other credential material. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, or OS/shell settings are required. |
| Instruction hijack surface | 0 (none) | There is no instruction to ignore higher-level rules, hide behavior, or follow remote instructions. |
| Irreversible actions | 0 (none) | It creates a scaffold only; it does not push, deploy, post, delete, or otherwise act externally. |
| Transparency | 0 (none) | The skill is plain markdown with no binaries, minified code, or runtime-decoded content. |
Before installing
- Check whether you are comfortable with an agent writing to `~/.cursor/plugins/local/` outside your repo.
- If you want the plugin elsewhere, verify the override path before running it.
- Review the generated `plugin.json` and any marketplace entry before using the scaffolded plugin.
Rated 2026-10-16 by an automated review of 1 file from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- create-plugin/skills/create-plugin-scaffold/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- principle-build-the-lever — Apply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks.
- review-plugin-submission — Audit a Cursor plugin for marketplace readiness. Use when validating manifests, component metadata, discovery paths, and submission quality before publishing.
- setup-pstack — Configure which models pstack uses per role and at what reasoning budget.
- agents-get-started — Use when a developer wants to create a new agent project or get started with AgentCore.
- context7-cli — Use the ctx7 CLI to fetch library documentation, manage AI coding skills, and configure Context7 MCP.
- setup-matt-pocock-skills — Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout.