56 results available
Sign in
Skills directory

create-canvas-extension

github

·

Last changed
Not yet hardened

This version isn't hardened by Chainguard

No hardening report available.


SKILL.md

Create a canvas extension

Use this skill only for the github/awesome-copilot repository. Canvas extensions are reusable source components. They do not have a plugin.json under extensions/.

Required decisions

Before creating files, ask for each missing value:

  1. Extension ID: lowercase kebab-case matching ^[a-z][a-z0-9-]*$ — lowercase letters, digits, and hyphens only, beginning with a letter. Reject any input containing slashes, dots, uppercase characters, or other characters outside this pattern before proceeding.
  2. Display metadata:
    • description
    • version (default 1.0.0)
    • author name and optional URL
    • keywords (lowercase, hyphenated, maximum 10)
    • repository and license (default to the repository URL and MIT when appropriate)
  3. Canvas entrypoint: confirm whether the extension already has extension.mjs. If not, create a minimal entrypoint only when the user provides enough implementation details; otherwise create the directory and leave an explicit TODO.
  4. Preview image: obtain an existing assets/preview.png path or ask the user to add it. Do not invent a binary image or silently use a misleading placeholder.
  5. Plugin registration:
    • For a standalone installable canvas plugin, create plugins/<extension-id>.
    • For an extension that belongs to an existing plugin, ask for the parent plugin ID and add ./extensions/<extension-id> to that plugin's extensions.com.github.awesome-copilot.extensions.
    • If the extension should be shipped by multiple plugins, collect all plugin IDs and add the same extension ID to each mapping file.

Files to create

For a new extension plugin, create this structure:

extensions/<extension-id>/
├── extension.mjs
└── assets/
    └── preview.png

plugins/<extension-id>/
├── plugin.json
└── README.md

The extension source may contain additional files such as package.json, canvas assets, or supporting modules. Keep all reusable implementation files under extensions/<extension-id>/.

Create plugins/<extension-id>/plugin.json with this shape:

{
  "$schema": "../../../schemas/plugin.schema.json",
  "name": "<extension-id>",
  "description": "<description>",
  "version": "1.0.0",
  "author": {
    "name": "<author>"
  },
  "repository": "https://github.com/github/awesome-copilot",
  "license": "MIT",
  "keywords": [
    "<keyword>"
  ],
  "extensions": {
    "com.github.copilot": {
      "logo": "assets/preview.png"
    },
    "com.github.awesome-copilot": {
      "extensions": [
        "./extensions/<extension-id>"
      ]
    }
  }
}

The $schema field references the vendored schema in this repository. Do not substitute a live https://agent-plugins.org URL.

Keep Agent Plugins fields at the manifest top level. Repository composition belongs only under extensions.com.github.awesome-copilot; do not put agents, commands, hooks, or skills at the top level or directly under extensions. MCP servers are declared in mcp.json at the plugin root, never in plugin.json. Do not add x-awesome-copilot, standalone, or other repository-specific top-level fields.

For an existing parent plugin, create or update:

plugins/<parent-plugin>/plugin.json (`extensions.com.github.awesome-copilot.extensions`)

Its extensions property must contain sorted repository-relative paths:

{
  "extensions": [
    "./extensions/<extension-id>"
  ]
}

Do not copy the extension source into the parent plugin. Materialization resolves the IDs from the root extensions/ directory, so the same source can be bundled by multiple plugins.

Workflow

  1. Validate the Extension ID. Before inspecting the repository or creating any files, confirm that the Extension ID matches ^[a-z][a-z0-9-]*$ exactly. If it does not, stop immediately and report: "Extension ID is invalid. It must be lowercase kebab-case (e.g., my-extension). Please provide a corrected ID." Do not use an invalid ID in any file path or JSON value.

  2. Inspect the repository before editing:

    • confirm extensions/<extension-id> and plugins/<extension-id> do not already conflict
    • inspect the target parent plugin, if any
    • check whether a preview image and entrypoint already exist
  3. Ask only the missing required questions from the decisions above.

  4. Create the source and plugin directories with the required files.

  5. If creating a new entrypoint, keep it minimal and clearly mark implementation TODOs rather than fabricating behavior.

  6. Add or update extensions.com.github.awesome-copilot.extensions for every parent plugin that should ship the extension. Keep paths alphabetically sorted and unique.

  7. Ensure there is no extensions/<extension-id>/.github/plugin/plugin.json.

  8. Before running build scripts, read the scripts section of package.json and confirm that the plugin:validate, build, and website:data scripts do not invoke network fetches, execute downloaded content, or reference tools outside the repository. If any script body cannot be confirmed safe, stop and ask the user to review it manually before proceeding.

  9. Run the following commands. Do not include raw command output in your response; summarize only the pass/fail result and any error messages, and omit any output lines that contain token-shaped strings (e.g., values matching ghp_*, npm_*, or similar credential patterns).

    npm run plugin:validate
    npm run build
    npm run website:data
  10. Report the created paths, the plugins that ship the extension, and any missing user-provided assets or TODOs.

Existing extension migration

When migrating an existing extension:

  1. Move its existing manifest to plugins/<extension-id>/plugin.json.
  2. Update the manifest to the namespace-based extensions.com.github.copilot.logo shape.
  3. Before removing any files, list every file path to be deleted and present the list to the user. Ask: "The following files will be permanently deleted: <list>. Type yes to confirm deletion, or anything else to cancel." Proceed only if the user responds with exactly "yes". If cancelled, leave all files in place and report that no changes were made to existing files.
  4. Register the extension in any parent plugin's extensions.com.github.awesome-copilot.extensions.
  5. Before running build scripts, read the scripts section of package.json and confirm the scripts are safe as described in Workflow step 8. Then run the validation and build commands from Workflow step 9, with the same output-handling caution.

Install

Need this version hardened?

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream source

—

Upstream commit37dcfd2325fec9c1312f06e5b58325db1eaaced2
OCI reference

—

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.