Plugin Store

Pre-flight Dependencies (auto-injected by Plugin Store CI)

Run once per session before first use. These checks ensure required tools are installed.

Install onchainos CLI + Skills (auto-injected)

# 1. Install onchainos CLI — pin to latest release tag, verify SHA256
#    of the installer before executing (no curl|sh from main).
if ! command -v onchainos >/dev/null 2>&1; then
  set -e
  LATEST_TAG=$(curl -sSL --max-time 5 \
    "https://api.github.com/repos/okx/onchainos-skills/releases/latest" \
    | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  if [ -z "$LATEST_TAG" ]; then
    echo "ERROR: failed to resolve latest onchainos release tag (network or rate limit)." >&2
    echo "       Manual install: https://github.com/okx/onchainos-skills" >&2
    exit 1
  fi

  ONCHAINOS_TMP=$(mktemp -d)
  curl -sSL --max-time 30 \
    "https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh" \
    -o "$ONCHAINOS_TMP/install.sh"
  curl -sSL --max-time 30 \
    "https://github.com/okx/onchainos-skills/releases/download/${LATEST_TAG}/installer-checksums.txt" \
    -o "$ONCHAINOS_TMP/installer-checksums.txt"

  EXPECTED=$(awk '$2 ~ /install\.sh$/ {print $1; exit}' "$ONCHAINOS_TMP/installer-checksums.txt")
  if command -v sha256sum >/dev/null 2>&1; then
    ACTUAL=$(sha256sum "$ONCHAINOS_TMP/install.sh" | awk '{print $1}')
  else
    ACTUAL=$(shasum -a 256 "$ONCHAINOS_TMP/install.sh" | awk '{print $1}')
  fi
  if [ -z "$EXPECTED" ] || [ "$EXPECTED" != "$ACTUAL" ]; then
    echo "ERROR: onchainos installer SHA256 mismatch — refusing to execute." >&2
    echo "       expected=$EXPECTED  actual=$ACTUAL  tag=$LATEST_TAG" >&2
    rm -rf "$ONCHAINOS_TMP"
    exit 1
  fi

  sh "$ONCHAINOS_TMP/install.sh"
  rm -rf "$ONCHAINOS_TMP"
  set +e
fi

# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global

# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --global

---

Plugin Store

A CLI marketplace for installing/uninstalling/updating Skills and MCP servers across Claude Code, Cursor, and OpenClaw. Also an open-source community platform where any developer can submit plugins.

Pre-flight Checks

Run once per session before the first plugin-store command. Do not echo routine output to the user.

1. Check binary version

plugin-store --version 2>/dev/null || ~/.local/bin/plugin-store --version 2>/dev/null || ~/.cargo/bin/plugin-store --version 2>/dev/null

• If the reported version is ≥ `0.3.0` (this skill's metadata.version): binary is current, skip to step 2.
• If the binary is missing or older: run the installer.

<!-- TODO(security/C01): Automated install commands removed pending upstream fix.

The previous macOS/Linux and Windows one-liners (a 'curl -sSL ... | sh' pipe and an 'irm ... | iex' equivalent fetching install.sh / install.ps1 directly from the main branch) are flagged C01 (zero-verification remote code execution) by the skill security scanner. The literal command strings have been intentionally omitted from this comment so the scanner does not match them.

A SHA256-verified replacement modelled on okx/onchainos-skills (which fetches install.sh + installer-checksums.txt from a pinned release, hashes install.sh locally, and refuses to execute on mismatch) cannot ship today because github.com/okx/plugin-store does not yet publish the required artifacts:

1. No plugin-store CLI v* release exists (current releases are per-plugin only: plugins/<name>@<version>). 2. No 'installer-checksums.txt' asset is published on any release.

Re-enable an OnchainOS-style automated install ONLY after BOTH conditions below are satisfied on github.com/okx/plugin-store: a. release.yml produces a v* tag dedicated to the plugin-store CLI itself, and b. The release.yml 'checksums' job ALSO hashes skills/plugin-store/install.sh and install.ps1 into a release asset named 'installer-checksums.txt'.

Until then, instruct the user to install manually using the 'Manual install' block below. -->

Manual install — visit <https://github.com/okx/plugin-store/releases>, download the binary for your platform, verify it against checksums.txt from the same release, and place it on your PATH (e.g. ~/.local/bin/plugin-store).

Offline fallback: if a binary already exists locally, proceed with it. If not installed and the network is unreachable, stop and ask the user to check their connection.

2. Check for Skill update (remote version check)

Fetch the latest Skill version from GitHub (timeout 5 seconds, non-blocking):

curl -sSL --max-time 5 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/plugin-store/SKILL.md" 2>/dev/null | head -20 | grep 'version:' | head -1

Compare the remote metadata.version with the local version (0.3.0).

If remote version is newer than local, display this notice to the user:

📦 Plugin Store Skill 有新版本可用（当前: 0.3.0, 最新: X.Y.Z）

>

是否更新？更新命令：

```

plugin-store install plugin-store --agent claude-code --skill-only

```

⚠️ 注意：更新后需要重启当前会话，新版 Skill 才会在上下文中生效。

Then wait for the user's response:

• If user says yes / 确认 / 更新 → run the install command, then remind: "Skill 已更新，请重启当前会话（退出并重新进入）以加载新版本。"
• If user says no / 跳过 / 以后再说 → continue with current version, do not ask again this session.
• If the curl fails or times out → skip silently, continue with current version.

If versions match or remote is unreachable, skip silently — do not print anything.

3. Do not auto-reinstall on command failures

Report errors and suggest plugin-store self-update or checking https://github.com/okx/plugin-store.

4. Install onchainos-skills (silent, non-blocking)

npx skills add okx/onchainos-skills --yes 2>/dev/null || true

This installs sub-skills used by Skill Routing (okx-dex-token, okx-dex-swap, etc.). Do not block on failure.

---

Available Plugins

Always run `plugin-store list` to get the current plugin list — never rely on a hardcoded table.

plugin-store list

Parse the output and present it to the user as a clean table (name, category, downloads, description). The registry updates dynamically; this is the only source of truth.

---

Skill Routing

---

Command Index

CLI Reference: For full parameter tables, output fields, and error cases, see cli-reference.md.

User Commands

Developer Commands

---

Operation Flow

Intent: Strategy / DApp / Capability Discovery

1. Run plugin-store list to fetch the live registry 2. Present results as a clean table (name, category, downloads, description) 3. Suggest next steps: "Want to install one? Just say install <name>"

Intent: Install a Plugin

1. Run plugin-store install <name> --yes

• --yes skips the community plugin confirmation prompt
• Agent selection is automatic in non-interactive mode (installs to all detected agents)

2. The CLI will:

• Fetch plugin metadata from registry
• Download and install skill, MCP config, and/or binary as applicable

3. Immediately after install succeeds, read the installed skill file directly — do NOT ask the user to restart:

   Read file: ~/.claude/skills/<name>/SKILL.md

Then follow the instructions in that file (Pre-flight → onboarding flow). The skill is immediately usable in the current session.

Intent: Manage Installed Plugins

1. Run plugin-store installed to show current state 2. Run plugin-store update --all to update everything 3. Run plugin-store uninstall <name> to remove

---

Developer Workflow: Create and Submit a Plugin

Plugin Store is an open-source community platform. Any developer can submit a plugin through a Pull Request. The full workflow:

Overview

Two types of plugins:
  Type A: Pure Skill — just a SKILL.md that orchestrates onchainos CLI commands
  Type B: Skill + Source Code — SKILL.md + a CLI tool compiled/installed from your source repo

Five supported languages for source code:
  Rust, Go         → compiled to native binary (~1-20MB)
  TypeScript, Node.js → distributed via npm install (~KB)
  Python           → distributed via pip install (~KB)

Step 1: Fork and scaffold

# Fork https://github.com/okx/plugin-store on GitHub, then:
git clone --depth=1 git@github.com:YOUR_USERNAME/plugin-store.git
cd plugin-store
plugin-store init <your-plugin-name>

This creates skills/<your-plugin-name>/ with a complete template:

skills/<your-plugin-name>/
├── plugin.yaml           # Plugin manifest (fill in your details)
├── skills/<name>/
│   └── SKILL.md          # Skill definition (built-in onchainos demo)
│   └── references/
├── LICENSE
├── CHANGELOG.md
└── README.md

Step 2: Edit plugin.yaml

Pure Skill — just fill in the basics:

schema_version: 1
name: <your-plugin-name>          # lowercase + hyphens, 2-40 chars
version: "1.0.0"
description: "What your plugin does"
author:
  name: "Your Name"
  github: "your-github-username"  # must match PR submitter
license: MIT
category: utility                 # trading-strategy | defi-protocol | analytics | utility | security | wallet | nft
tags: [keyword1, keyword2]

components:
  skill:
    dir: skills/<your-plugin-name>

api_calls: []                     # external API domains your plugin calls

Skill + Source Code — add a build section pointing to your source repo:

# ... same as above, plus:
build:
  lang: rust                           # rust | go | typescript | node | python
  source_repo: "your-org/your-tool"    # your GitHub repo with source code
  source_commit: "a1b2c3d4e5f6..."     # full 40-char commit SHA (git rev-parse HEAD)
  binary_name: "your-tool"             # compiled output name
  # main: "src/index.js"              # required for typescript/node/python

How to get the commit SHA:

cd your-source-repo
git push origin main
git rev-parse HEAD     # copy this 40-char string into build.source_commit

Step 3: Write SKILL.md

SKILL.md teaches the AI agent how to use your plugin. Required sections:

1. YAML frontmatter — name, description, version, author, tags 2. Overview — what the plugin does (2-3 sentences) 3. Pre-flight Checks — what needs to be installed before use 4. Commands — specific onchainos commands with When to use / Output 5. Error Handling — table of common errors and resolutions 6. Skill Routing — when to defer to other skills

Critical rule: All on-chain write operations (signing, broadcasting, swaps, contract calls) MUST use onchainos CLI. Querying external data sources (third-party APIs, price feeds) is freely allowed.

Step 4: Validate locally

plugin-store lint ./skills/<your-plugin-name>/

Fix all errors (❌), then re-run until you see ✓. Warnings (⚠️) are advisory.

Step 5: Submit via Pull Request

git checkout -b submit/<your-plugin-name>
git add skills/<your-plugin-name>/
git commit -m "[new-plugin] <your-plugin-name> v1.0.0"
git push origin submit/<your-plugin-name>

Then create a PR from your fork to okx/plugin-store. Each PR must contain exactly one plugin.

What happens after submission

Phase 2: Structure check (~30s) — bot validates plugin.yaml + SKILL.md
Phase 3: AI code review (~2min) — Claude reads your code, writes a 9-section report
Phase 4: Build check (if binary) — compiles your source code on 3 platforms
Phase 7: After merge — auto-publishes to registry, users can install immediately

Human review takes 1-3 days. Once merged, your plugin is live:

plugin-store install <your-plugin-name>

Source code requirements by language

Common lint errors

Full guide: https://github.com/okx/plugin-store/blob/main/docs/FOR-DEVELOPERS.md

---

Supported Agents

---

Plugin Source Trust Levels

---

Error Handling

---

Skill Self-Update

To update this skill to the latest version:

macOS / Linux:

plugin-store install plugin-store --agent claude-code --skill-only

<!-- TODO(security/C01): same installer-replacement caveat as in section 1 — see the TODO block earlier in this file. Until the upstream release pipeline publishes installer-checksums.txt, instruct the user to re-install manually from the GitHub releases page. -->

Or re-install manually — see Manual install in section 1 above (download the binary from the GitHub releases page and verify it against checksums.txt).

---

<rules> <must>

• Always run plugin-store list for capability/discovery questions — never use a hardcoded plugin list
• Present plugin lists as clean tables (name, category, downloads, description); omit internal fields like registry URLs or file paths
• Present capabilities in user-friendly language: "You can trade on Uniswap across 12 chains", not "uniswap-ai supports uniswap-v2, uniswap-v3 protocols"
• After any action, suggest 2–3 natural follow-up steps
• Support both English and Chinese — respond in the user's language
• For developer workflow: always run plugin-store init first, then guide through editing, linting, and PR submission
• For lint errors: show the error code, explain the fix, and offer to help edit the file

</must> <should>

• For community-source plugins, proactively warn the user before installing
• After installing a plugin, read the installed SKILL.md and trigger the skill's onboarding flow immediately
• When guiding plugin development, ask which type (Pure Skill or Skill + Binary) and which language
• Suggest running plugin-store lint after every edit to catch issues early

</should> <never>

• Never expose internal skill names, registry URLs, file paths, or MCP config keys to the user
• Never auto-reinstall on command failures — report the error and suggest plugin-store self-update
• Never hardcode a plugin list — always fetch from plugin-store list
• Never skip the lint step before suggesting PR submission

</never> </rules>

Plugin Store CLI Reference

Complete command reference with parameters, output fields, and usage examples.

---

1. plugin-store list

List all available plugins in the registry.

Parameters: None

Output:

Example:

$ plugin-store list

Name                                Version    Source          Description
------------------------------------------------------------------------------------------
uniswap-ai                          1.7.0      dapp-official   AI-powered Uniswap developer tools...

2 plugins available.

---

2. plugin-store search <keyword>

Search plugins by keyword. Matches against name, tags, description, and category.

Parameters:

Output: Same table format as list, filtered by keyword match.

Example:

$ plugin-store search trading

Name                                Version    Source          Description
------------------------------------------------------------------------------------------
uniswap-ai                          1.7.0      dapp-official   AI-powered Uniswap developer tools...

2 plugins found.

$ plugin-store search uniswap

Name                                Version    Source          Description
------------------------------------------------------------------------------------------
uniswap-ai                          1.7.0      dapp-official   AI-powered Uniswap developer tools...

1 plugins found.

---

3. plugin-store info <name>

Show detailed plugin metadata including components, chains, and protocols.

Parameters:

Output:

Example:

$ plugin-store info uniswap-ai

Name: uniswap-ai
Version: 1.7.0
Description: AI-powered Uniswap developer tools: trading, hooks, drivers, and on-chain analysis across V2/V3/V4
Author: Uniswap (https://github.com/Uniswap/uniswap-ai)
Category: defi-protocol
Source: dapp-official
Tags: uniswap, trading, hooks, v2, v3, v4, multi-chain

Components:
  ✔ Skill

Extra:
  Chains: ethereum, base, arbitrum, optimism, polygon, bnb, avalanche, celo, blast, zora, worldchain, unichain
  Protocols: uniswap-v2, uniswap-v3, uniswap-v4, universal-router
  Risk Level: medium

Error — plugin not found:

Plugin 'foo' not found. Run `plugin-store search <keyword>` to find plugins.

---

4. plugin-store install <name> [OPTIONS]

Install a plugin to one or more agents. Downloads skill files, configures MCP servers, and installs binaries as applicable.

Parameters:

Behavior:

1. Fetches plugin metadata from registry 2. If type == "community" and not already installed → shows warning, asks confirmation 3. If --agent not specified → detects installed agents, prompts multi-select 4. Installs components per agent:

• Skill: downloads SKILL.md from GitHub → writes to ~/<agent>/skills/<plugin>/SKILL.md
• MCP: writes config entry to agent's settings file
• Binary: downloads platform-specific binary from GitHub releases, verifies checksum

5. Records install state to ~/.plugin-store/installed.json

Example:

# Interactive install (prompts for agent selection)
$ plugin-store install uniswap-ai

# Install to Claude Code only
$ plugin-store install uniswap-ai --agent claude-code

# Install skill only, skip MCP/binary
$ plugin-store install uniswap-ai --skill-only

# Install MCP only, skip skill/binary
$ plugin-store install uniswap-ai --mcp-only

# Combine: skill-only + specific agent
$ plugin-store install uniswap-ai --skill-only --agent claude-code

Output:

Installing uniswap-ai 1.7.0...
  ✔ Skill installed → ~/.claude/skills/uniswap-ai/ (Claude Code)
Done!

Error — plugin not found:

Plugin 'foo' not found. Run `plugin-store search <keyword>` to find plugins.

Error — no agents selected:

No agents selected.

Error — unknown agent ID:

Unknown agent 'foo'. Valid: claude-code, cursor, openclaw

---

5. plugin-store uninstall <name> [OPTIONS]

Uninstall a plugin. Removes skill files, MCP config entries, and binaries.

Parameters:

Behavior:

• Without --agent: removes from ALL agents the plugin was installed to, then removes state record
• With --agent: removes from that agent only. If no agents remain, removes state record entirely

Example:

# Uninstall from all agents
$ plugin-store uninstall uniswap-ai

# Uninstall from Claude Code only
$ plugin-store uninstall uniswap-ai --agent claude-code

Output:

Uninstalling uniswap-ai...
  ✔ Skill removed from Claude Code
  ✔ State updated
Done!

Error — not installed:

Plugin 'foo' is not installed.

---

6. plugin-store update <name>

Update a specific installed plugin to the latest registry version.

Parameters:

Behavior:

1. Force-refreshes registry cache 2. Compares installed version vs registry version for target plugin(s) 3. If update available: shows oldVersion -> newVersion, re-installs to same agents 4. If --all with multiple updates: asks confirmation before proceeding 5. If already up to date: prints (up to date)

Example:

# Update a specific plugin
$ plugin-store update uniswap-ai

# Update all installed plugins
$ plugin-store update --all

Output — update available:

Updates available:
  uniswap-ai: 1.5.0 -> 1.7.0
Installing uniswap-ai 1.7.0...
  ✔ Skill installed → ~/.claude/skills/uniswap-ai/ (Claude Code)
Done!

Output — up to date:

  uniswap-ai 1.7.0 (up to date)
All plugins are up to date.

Output — nothing installed:

No plugins installed.

Output — missing arguments:

Specify a plugin name or use --all.

---

7. plugin-store installed

Show all installed plugins with their agents and components.

Parameters: None

Output:

Example:

$ plugin-store installed

Name                                Version    Agents               Components
-------------------------------------------------------------------------------------
uniswap-ai                          1.7.0      claude-code          skill

2 plugins installed.

Output — nothing installed:

No plugins installed.

---

8. plugin-store registry update

Force refresh the local registry cache from remote GitHub.

Parameters: None

Behavior:

• Fetches latest registry.json from GitHub raw URL
• Overwrites local cache at ~/.plugin-store/cache/registry.json
• Resets the 12-hour cache TTL

Example:

$ plugin-store registry update

Refreshing registry...
  OK Registry updated. 2 plugins available.

---

9. plugin-store self-update

Update the plugin-store CLI binary itself to the latest GitHub release.

Parameters: None

Behavior:

1. Fetches latest release from GitHub API 2. Compares latest tag version with current binary version (CARGO_PKG_VERSION) 3. If already up to date: prints confirmation and exits 4. If update available: detects current platform target, finds matching binary asset in release 5. Downloads binary, verifies SHA256 checksum against checksums.txt (if present in release) 6. Atomically replaces current binary: current → .bak, new → current; removes .bak on success; rolls back on failure

Example:

$ plugin-store self-update

Checking for updates...
  Current version: 0.1.0
  Latest version:  0.2.0

  Update available: 0.1.0 → 0.2.0
  Downloading plugin-store-aarch64-apple-darwin...
  Checksum verified ✓

Updated!  0.1.0 → 0.2.0

Output — already up to date:

Checking for updates...
  Current version: 0.2.0
  Latest version:  0.2.0

Already up to date!

Output — no releases on GitHub:

  No releases found on GitHub. You're on the latest build.

Error — platform not supported:

No binary found for platform 'riscv64-unknown-linux-gnu'. Available assets: plugin-store-x86_64-apple-darwin, ...

Error — checksum mismatch:

Checksum verification failed.
  Expected: abc123...
  Got:      def456...

---

Agent IDs

Valid values for --agent parameter:

---

File Paths

---

Common Workflows

Install a plugin end-to-end

plugin-store list                              # Browse available plugins
plugin-store info uniswap-ai                   # Check details
plugin-store install uniswap-ai --agent claude-code   # Install
plugin-store installed                         # Verify

Update everything

plugin-store registry update                   # Refresh registry first
plugin-store update --all                      # Update all installed

Remove a plugin from one agent

plugin-store uninstall uniswap-ai --agent cursor   # Remove from Cursor only
plugin-store installed                              # Verify remaining

Search and install

plugin-store search prediction                 # Find prediction market plugins

For Everyone

The plugin marketplace for AI coding agents — discover, install, and manage all Skills and MCP servers with a single command.

• One CLI works across Claude Code, Cursor, and OpenClaw
• Search, install, update, and uninstall plugins without leaving your terminal
• Open developer platform: submit your own plugin via Pull Request and publish to all users

Plugin Store

The CLI marketplace for AI coding agents to discover, install, update, and manage Skills and MCP servers.

Prerequisites

• Claude Code, Cursor, or OpenClaw installed
• onchainos is auto-installed as a dependency on first use — no manual setup needed

When to Use This Skill

Use this skill when the user:

• Asks what plugins, skills, strategies, or DApps are available
• Wants to install, uninstall, or update a plugin
• Wants to extend their AI agent with new tools or capabilities
• Is a developer who wants to submit or publish their own plugin

How It Works

Plugin Store provides a unified CLI interface that works across Claude Code, Cursor, and OpenClaw. It maintains a registry of all available plugins — Skills and MCP servers — which you can browse, search, and install from a single tool. Batch updates keep everything current at once. For developers, the store is an open submission platform: scaffold a new plugin with plugin-store init, validate it with plugin-store lint, and submit via Pull Request. Automated lint checks, AI review, and build verification run before the plugin is published and available to all users.

Key commands:

• plugin-store list — Browse all available plugins
• plugin-store search <keyword> — Search by name, description, or tags
• plugin-store install <name> — Install a plugin
• plugin-store uninstall <name> — Uninstall a plugin
• plugin-store update --all — Update all installed plugins
• plugin-store installed — Show all installed plugins and their status
• plugin-store init <name> — Scaffold a new plugin for submission
• plugin-store lint <path> — Validate a plugin before submitting