agi plugin install github-automation --integrity <sha256>Cloning plugin tree...Hashing tree with SHA-256... matches --integrityInstalled to ~/.agiworkforce/plugins/github-automationagi plugin install unverified-packerror: --integrity required pass --unsafe-no-integrity to skip and print a warning
Some of what a plugin carries is inert, and some of it executes.
5 of 8 packs install on the web, from the plugins section of Settings. The other 3 are declared and not yet published.
Commands, agents, skills
The manifest points at markdown files. Slash commands wait until you invoke them; declared skill folders join the skill list as soon as the plugin loads.
Lifecycle hooks
A plugin can declare hooks that fire on session events, and a hook is a shell command. They merge in only from plugins that live in your home directory.
MCP servers
A declared server connects over stdio by default, which spawns a child process. A manifest can name sse or http with a url instead.
An install is treated as a supply-chain event.
- SourceA local folder or a shallow git clone, landing under ~/.agiworkforce/plugins/ with a name that has to pass validation first.
- IntegrityThe CLI hashes every file in the tree with SHA-256 and compares it to the --integrity value you passed. A mismatch deletes the tree.
- ManifestA tree with no recognized manifest is deleted after the copy.
- PathsManifest entries must be plain relative paths. Anything that resolves outside the plugin folder is rejected on load.
- HooksMerged only from ~/.agiworkforce/plugins/, so a plugin sitting in a cloned repository cannot start running shell commands on your tool calls.
Read the folder before you trust it.
Once a plugin is loaded, what its tools may actually do is governed by the same per-tool permissions as every other tool in the workspace. Every command above is in the agi binary source today; public CLI downloads are coming soon.