## Summary
- Import Zoom combined plugin content from zoom/zoom-plugin-codex commit
6f30034c94b4594daaf814cd9bf4cf972b90a323 into the existing app-backed
Zoom plugin.
- Add Zoom developer commands, reviewer agents, and 53 developer skills
under plugins/zoom while preserving the Zoom app connector mapping and
marketplace identity.
- Mark only the imported developer skills explicit-only with adjacent
agents/openai.yaml files using policy.allow_implicit_invocation: false;
the regular Zoom app/plugin surface remains implicitly invokable.
## Validation
- jq empty plugins/zoom/.codex-plugin/plugin.json plugins/zoom/.app.json
.agents/plugins/marketplace.json
- Ruby validation for all Zoom SKILL.md frontmatters and 53 skill-level
Zoom agents/openai.yaml policy files, plus confirmation that
plugins/zoom/agents/openai.yaml does not disable implicit invocation
- git diff --check HEAD^ HEAD -- plugins/zoom
- node plugins/plugin-eval/scripts/plugin-eval.js analyze plugins/zoom
--format json completed; it reports high static token budget because the
upstream Zoom reference library is large.
## Summary
- tighten Notion skill guidance around the deployed app contract
- repair invalid or misleading tool-call examples across the four
curated Notion skills
- switch database-creation references from REST-style objects to the SQL
DDL form exposed by the live app
## Root cause
Several deployed plugin examples had drifted from the live Apps SDK /
Notion MCP surface. They either omitted connector-required fields, used
unsupported command names, or showed payload shapes that fail connector
validation before they ever reach Notion.
## What changed
- require explicit `filters: {}` in search examples and remove
pseudo-boolean query syntax such as `or` / `+`
- make fetch examples concrete and reinforce that only Notion URLs / IDs
should be fetched
- make create-page examples include explicit `parent` + `pages`
- fix `notion-query-data-sources` to use the top-level `data` wrapper
and collection URLs as SQL table names
- replace invalid `insert_content_after` examples with `update_content`
search-and-replace payloads
- document the deployed `update-page` quirk that requires both
`properties` and `content_updates` top-level fields
- fix `notion-create-comment` examples to use `page_id`
- update database-creation references to the live SQL DDL schema format
## Validation
- live Notion connector probes on 2026-05-19:
- `search` succeeds with `filters: {}` and fails connector validation
when `filters` is omitted
- `query-data-sources` succeeds with the `data` wrapper and fails
connector validation without it
- `create-pages` and `create-database` reject omitted `parent`;
explicit-parent payloads get past schema validation
- `update-page(update_content)` requires `properties: {}`;
`update-page(update_properties)` requires `content_updates: []`
- `create-comment` with object-style `rich_text` passes connector
validation
Sync the Figma plugin skill bundle with
`figma/mcp-server-guide@a742f0a700a7772ff5ed85f7c9fc1dad5afa9fcc`
(`v2.2.12`).
This pulls in Figma's latest guidance updates across the `figma-use`,
FigJam, Slides, design-generation, and library-generation skill
surfaces. The imported changes sharpen the runtime guidance that came up
in recent threads, including editor-context boundaries, text/font
handling, and more efficient Plugin API traversal patterns, while
keeping the local plugin layout unchanged.
Context:
https://openai.slack.com/archives/C09CKPM5UKT/p1779133790898629?thread_ts=1778698066.370709&cid=C09CKPM5UKT
## Summary
- Add a Slack skill write-safety guardrail requiring fresh
channel/thread reads before acting on relative message targets like
"last message".
- Call out reactions, replies, edits, and other writes so stale cached
reads are not reused for message actions.
## Why
The reported issue was that "last message" stayed bound to an older read
result, so a reaction was applied to an hour-old message until the agent
was told to recheck. The skill should force a fresh resolution
immediately before acting on recency-based targets.
## Validation
- Ran `git diff --check`.
- Verified the diff is limited to one insertion in
`plugins/slack/skills/slack/SKILL.md`.
## Summary
- Register the existing Asana plugin in
`.agents/plugins/marketplace.json`.
- Point the marketplace entry at `./plugins/asana` with the standard
available/on-install policy and Productivity category.
## Validation
- Parsed `.agents/plugins/marketplace.json`,
`plugins/asana/.codex-plugin/plugin.json`, and `plugins/asana/.app.json`
with `jq`.
- Checked the marketplace for duplicate plugin names.
- Verified the appended Asana entry shape with `jq`.
## Summary
Plugin Creator now documents the shorter local-plugin handoff URL that
the app can interpret directly.
[#237](https://github.com/openai/plugins/pull/237) teaches the skill to
end marketplace-backed creation flows with named View and Share links;
this follow-up updates those examples so the skill only emits the
normalized plugin name, the absolute marketplace path, and optional
share mode.
The documented shape is:
```txt
codex://plugins/<normalized-plugin-name>?marketplacePath=<absolute-marketplace-json-path>
codex://plugins/<normalized-plugin-name>?marketplacePath=<absolute-marketplace-json-path>&mode=share
```
The skill text now states exactly where the normalized plugin name
belongs, exactly where the absolute marketplace path belongs, and that
it should not add `pluginName` or `hostId` query parameters.
## Testing
Tests: plugin-creator skill validation.
## Summary
Plugin creation now defaults to the personal marketplace path that Codex
can render and share directly.
Before this change, the curated `plugin-creator` skill centered
repo-local plugin scaffolds and repo-root marketplace updates. That made
the common personal-plugin path less explicit, and the public skill copy
did not include the final deeplink handoff back into Codex after
marketplace-backed creation.
This PR makes personal plugins the default flow. Marketplace-backed
scaffolds now default to `~/plugins/<plugin-name>` plus
`~/.agents/plugins/marketplace.json`. If the current Git repo already
has `.agents/plugins/marketplace.json` and the user has not said whether
the plugin is personal or team-shared, the skill asks which marketplace
to update. The skill also ends marketplace-backed creation with named
`View <plugin-name>` and `Share <plugin-name>` deeplinks.
## What changed
- default scaffold and marketplace paths to the personal plugin location
- document the explicit repo/team override path for shared codebases
- ask for user intent only in the ambiguous existing-repo-marketplace
case
- add the final named Codex deeplink handoff after marketplace-backed
creation
- refresh the marketplace reference sample to the `policy.installation`
and `policy.authentication` shape
## Design decisions
- Personal plugins are the default because they are the path users can
create, open, and share without first deciding to commit plugin code
into a team repo.
- Existing repo marketplaces are the one ambiguous case worth
interrupting for. They can mean “add this to the codebase” rather than
“make something for me personally.”
- The deeplink labels include the plugin name so the assistant can
present readable links instead of raw `codex://...` URLs.
## Testing
Tests: skill validation, Python compile checks, personal-default
scaffold smoke, repo-override scaffold smoke, and whitespace checks.
## Summary
- restore the HeyGen plugin under plugins/heygen
- add the plugin to .agents/plugins/marketplace.json so it appears in
the public catalog
- wire the plugin through .app.json and update the bundled skill docs to
match the app-backed flow
## Notes
- this is a fresh branch from origin/main, not a continuation of the
prior reverted branch
Why: the OpenAI Developers plugin is now the OpenAI-owned Codex plugin
for developer workflows, so ChatGPT Apps guidance should live there
instead of requiring developers to discover and install a separate
ChatGPT Apps plugin.
This merges the ChatGPT Apps build and submission skills into
`plugins/openai-developers`. The OpenAI Developers manifest and README
now describe ChatGPT Apps support alongside OpenAI API keys and Agents
SDK workflows, the plugin declares read/write capability because the
moved submission skill inspects local app code, and the plugin version
is bumped to `1.1.0` for the new workflow surface.
The standalone `chatgpt-apps` plugin is removed from the marketplace and
its skill files are moved under OpenAI Developers, so developers get the
ChatGPT Apps SDK scaffolding and `chatgpt-app-submission.json`
generation flows from one plugin.
I checked the OpenAI Developers node tests and JSON parsing locally. The
README's distribution validation command points at a script path that is
not present in this repository clone, so I could not run that
validation.
## Why
ChatGPT app developers can generate `chatgpt-app-submission.json` even
when their MCP tools omit the optional `outputSchema` field. That should
stay non-blocking, but the generated handoff should still point out
missing output schemas because they give models more structure for using
tool results.
## What changed
The `chatgpt-app-submission` skill now records tools whose descriptors
or source definitions omit `outputSchema` or set it to `null`. The
generated JSON remains unchanged, and the skill reports a concise
final-response warning with the affected tool names and a link to the
MCP tool spec.
The `chatgpt-apps` plugin manifest version is bumped from `0.1.0` to
`0.1.1` because the packaged skill content changed.
Co-authored-by: Codex <noreply@openai.com>
## Summary
- Add OpenAI skill interface metadata for all OpenAI Developers skills
so UI copy stays concise.
- Set the Agents SDK display name explicitly while keeping the skill ID
as hyphen-case `agents-sdk` for validator compatibility.
- Shorten API troubleshooting and API key skill descriptions for UI
surfaces.
## Tests
- `yq . plugins/openai-developers/skills/agents-sdk/agents/openai.yaml
plugins/openai-developers/skills/openai-api-troubleshooting/agents/openai.yaml
plugins/openai-developers/skills/openai-platform-api-key/agents/openai.yaml`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/openai-api-troubleshooting`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/openai-platform-api-key`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/agents-sdk`
- `oaipkg run cloud_plugins_import plugin validate
/private/tmp/openai-plugins-publication-master/plugins/openai-developers`
- `node --test
plugins/openai-developers/tests/openai-platform-api-key.test.mjs`
## Summary
Adds the OpenAI Developers plugin under `plugins/openai-developers` with
its plugin manifest, OpenAI Platform app connector manifest, assets,
skills, helper script, README, tests, and eval references.
Registers `openai-developers` in the curated marketplace manifest so it
can be discovered from the public plugin catalog.
Updates the plugin repository metadata to point at
`https://github.com/openai/plugins/tree/main/plugins/openai-developers`
and keeps the production OpenAI Platform connector id in `.app.json`.
Incorporates the OpenAI Developers pieces from openai/openai#890108 by
adding the Agents SDK lifecycle skill, documenting it in the README, and
updating the plugin metadata for Agents SDK usage.
## Validation
- `jq . .agents/plugins/marketplace.json`
- `jq . plugins/openai-developers/.codex-plugin/plugin.json
plugins/openai-developers/.app.json`
- `python3
/Users/mifan/.codex/skills/.system/skill-creator/scripts/quick_validate.py
plugins/openai-developers/skills/agents-sdk`
- `git diff --check`
- `node --test
plugins/openai-developers/tests/openai-platform-api-key.test.mjs`: 21
passed, 2 skipped because the skipped checks depend on monorepo-only
fixture paths that are not present in `openai/plugins`.
## Summary
- Coordinate `frontend-app-builder` with other installed skills when an
app needs provider-backed capabilities.
- Clarify that provider setup should not block Image Gen concepting,
static UI work, or design review that does not exercise provider-backed
behavior.
- Require `openai-developers:openai-platform-api-key` for
AI/model-generated output when available, instead of fake keys,
placeholder env vars, or manual API-key setup instructions.
Adds Zotero to the Codex official plugin marketplace so customers can
install it from the curated plugin list.
Zotero provides a local-library workflow for searching a user’s Zotero
Desktop library, exporting BibTeX, inserting citation keys, reading
indexed full text, and importing BibTeX/RIS records through the local
Zotero connector server.
The plugin entry is registered in the marketplace catalog with the
Research category and includes the plugin manifest, skill instructions,
local API reference, CLI helper, and icon asset.
## Summary
- add a Salesforce app-only Codex plugin backed by the canonical
Salesforce connector
- add Salesforce to the curated plugin marketplace so it can appear in
the Codex plugins directory
- include a minimal local icon asset
## Testing
- python3 -m json.tool plugins/salesforce/.app.json
- python3 -m json.tool plugins/salesforce/.codex-plugin/plugin.json
- python3 -m json.tool .agents/plugins/marketplace.json
- git diff --check
No secrets added.
## Why
The ChatGPT Apps plugin needs a broader submission-prep workflow than
the old MCP tool hint justification helper. Developers should be able to
run one skill from their local MCP server repo and get the
`chatgpt-app-submission.json` file that onboard can use to prefill
reviewable submission fields.
## Workflow demo
https://github.com/user-attachments/assets/5b6ba645-22e8-4f90-9d3f-2cb8ad603ceb
## What Changed
This updates the plugin metadata to ChatGPT Apps and describes it as a
plugin for building ChatGPT Apps and preparing submission materials.
The old `mcp-tool-hint-justifications` skill is replaced by
`chatgpt-app-submission`. The new skill tells Codex to inspect local app
metadata, MCP tool descriptors, tool implementations, explicit hint
annotations, widget metadata, and CSP values before writing
`chatgpt-app-submission.json`.
The generated file contract covers `app_info`, required `tools`,
`test_cases`, and `negative_test_cases`. The skill also requires concise
review-facing justifications, at least five positive test cases, at
least three negative test cases, exact MCP action names, and a subtitle
of 30 characters or less.
For review checks that do not have first-class onboard fields, the skill
reports findings in its final response instead of writing them into
JSON. That includes sensitive input solicitation, tool data use, tool
naming or description issues, and weak CSPs. The skill keeps the
Apache-2.0 license with the renamed skill directory.
Codex plugin for [HeyGen](https://heygen.com) — create AI avatar videos
and personalized video messages.
## What's included
Two skills that chain together:
- **heygen-avatar** — turn a photo into a persistent digital twin.
Handles avatar lookup, instant-avatar creation, voice selection (or
voice cloning), and writes an `AVATAR` file the video skill reads back.
- **heygen-video** — identity-first presenter videos via the HeyGen v3
Video Agent pipeline. Encodes prompting, asset routing, aspect-ratio
correction, and avatar/voice resolution.
## Source of truth
Skills are authored in
[`heygen-com/skills`](https://github.com/heygen-com/skills) (under
`heygen-avatar/` and `heygen-video/` at the repo root) and mirrored
here. File issues about skill content on that repo.
## What changed from upstream
The upstream repo keeps skills at the root (no `skills/` subdir) and
`heygen-video/SKILL.md` references shared docs via `../references/...`.
The bundled copy here is restructured to match the Codex plugin
convention:
- skills moved into `skills/heygen-avatar/` and `skills/heygen-video/`
so the manifest can use the documented `"skills": "./skills/"` form
- the 9 shared reference files are bundled inside
`skills/heygen-video/references/` (only `heygen-video` reads them)
- `heygen-video/SKILL.md` paths rewritten from `../references/...` →
`references/...` — the only content delta from upstream
No changes to skill prose or behavior. Bundle is 372 KB.
## Requirements
The skills shell out to the HeyGen CLI and need a HeyGen API key. Either
install the CLI from https://static.heygen.ai/cli/install.sh and export
`HEYGEN_API_KEY`, or connect HeyGen via MCP — the skills detect MCP and
skip the CLI path.
## Test plan
- [x] `plugin.json` parses as JSON
- [x] Manifest fields match the schema documented at
<https://developers.openai.com/codex/plugins/build>
- [x] Skill paths in `heygen-video/SKILL.md` resolve to the bundled
`references/` dir
- [x] Assets (PRISM_ORB icon at 512×512 and 1024×1024) flattened onto
white background — render the same on light/dark marketplace tiles
- [ ] Install via Codex plugin marketplace once merged
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sync skill guidance from heygen-com/hyperframes#504. Tells agents to
hand back the Studio project URL
(http://localhost:<port>/#project/<project-name>) instead of the source
index.html path, which won't render outside the Studio runtime.
Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>
Rewrote the skill based on some more testing. Puts more emphasis now on
inspecting the final design, cleared up some redundant copy and removed
the boilerplate for imagegen prompts to reduce the risk of getting very
similar images
This PR adds agents/openai.yaml manifests for the HyperFrames skills. It
also shortens each short_description so it matches the first sentence of
the corresponding SKILL.md description.
## Why
ChatGPT Apps developers need Codex help in two related places: building
Apps SDK projects from current docs, and preparing submission materials
for review. Those workflows are currently scattered across standalone
skills or local monorepo-only plugin work.
This PR adds a curated ChatGPT Apps plugin so users can install one
plugin for both building ChatGPT Apps and generating MCP tool hint
justifications for app submission.
## What changed
Adds `plugins/chatgpt-apps` and registers it in the curated marketplace
as `chatgpt-apps` in the Coding category.
The plugin manifest exposes the bundle as “ChatGPT Apps”, links to the
Apps SDK docs, and declares the plugin as Apache-2.0 licensed. The
plugin root and both skill directories include Apache-2.0 `LICENSE.txt`
files.
The plugin includes two skills:
- `$build-chatgpt-app`: a docs-first ChatGPT Apps builder skill. It
classifies the app archetype, fetches current Apps SDK docs before
generating code, prefers official or upstream examples when they fit,
includes references for app patterns and validation, and ships a small
Node scaffold script for fallback `@modelcontextprotocol/ext-apps`
starters.
- `$mcp-tool-hint-justifications`: a submission helper skill. Developers
run it from an MCP server repo; it inspects tool definitions and
implementations, checks explicit `readOnlyHint`, `openWorldHint`, and
`destructiveHint` annotations against actual behavior, and writes
`tool-hint-justifications.json` for the onboard submission importer.
## Summary
Adds a `hyperframes` plugin packaging five skills for authoring and
rendering video from HTML + CSS + GSAP. HyperFrames is an open-source
Apache-2.0 video rendering framework where HTML is the source of truth
for video.
## Skills included
- **hyperframes** — composition authoring, visual styles, house style,
motion principles, transitions, captions, audio-reactive visuals
- **hyperframes-cli** — `init`, `lint`, `preview`, `render`,
`transcribe`, `tts`, `doctor`, `browser`
- **hyperframes-registry** — `hyperframes add` to install reusable
blocks and components (social overlays, shader transitions, data viz,
effects)
- **gsap** — tweens, timelines, easing, stagger, performance
- **website-to-hyperframes** — 7-step pipeline turning a URL into a
finished video
## Source of truth
Skills are maintained at
[github.com/heygen-com/hyperframes](https://github.com/heygen-com/hyperframes)
under `skills/` at the repo root.
## Files
- `plugins/hyperframes/.codex-plugin/plugin.json` — plugin manifest
- `plugins/hyperframes/skills/**` — skill content
- `plugins/hyperframes/assets/{icon,logo}.png`
- `.agents/plugins/marketplace.json` — marketplace entry
Yiren Lu