CM-71972: Collect plugin skills for every IDE, not just Claude Code

A plugin's skills live at <plugin_dir>/skills/<name>/SKILL.md, which is a
property of the plugin format rather than of any one IDE - Codex and
Copilot plugins use the same layout, and all three readers already hold
the resolved plugin_dir. So the scan moved into _skill_utils and all three
call it: a plugin shipping skills is now inventoried whichever IDE loaded
it.

User-scope collection stays Claude Code only, because that is the only
tool with a SKILL.md convention of its own today - the SCM side agrees, it
classifies .claude/skills/*/SKILL.md as category Skill while Cursor's .mdc
rules and CLAUDE.md are category Rule. The hook is generic: IDE.get_skills
defaults to [] and any IDE opts in by overriding it, so adding one is two
lines once its skills directory is confirmed rather than guessed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Altruistus

cycode/cli/apps/ai_guardrails/ides/_skill_utils.py

@@ -19,6 +19,10 @@
 
 SKILL_FILE_NAME = 'SKILL.md'
 
+# Where a plugin keeps its skills, relative to the plugin directory. A property of the plugin format
+# rather than of any one IDE, so Claude Code, Codex and Copilot plugins all use it.
+PLUGIN_SKILLS_SUBDIR = 'skills'
+
 # A skill is instructions, not data. Anything larger is not a skill we can usefully inventory,
 # and sending it would push the one-request report toward the API's body limit.
 MAX_SKILL_FILE_BYTES = 256 * 1024
@@ -88,3 +92,12 @@ def walk_skill_dirs(skills_root: Path) -> list[dict]:
             skills.append(skill)
 
     return skills
+
+
+def walk_plugin_skills(plugin_dir: Path) -> list[dict]:
+    """Collect the skills a plugin ships, from ``<plugin_dir>/skills/<name>/SKILL.md``.
+
+    Shared by every IDE with a plugin system: the layout belongs to the plugin format, so a plugin
+    shipping skills is inventoried whichever IDE loaded it.
+    """
+    return walk_skill_dirs(plugin_dir / PLUGIN_SKILLS_SUBDIR)

cycode/cli/apps/ai_guardrails/ides/claude_code.py

@@ -13,7 +13,7 @@
     resolve_cached_plugin_dir,
     walk_enabled_plugins,
 )
-from cycode.cli.apps.ai_guardrails.ides._skill_utils import walk_skill_dirs
+from cycode.cli.apps.ai_guardrails.ides._skill_utils import walk_plugin_skills, walk_skill_dirs
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
@@ -36,9 +36,6 @@
 _CLAUDE_SETTINGS_PATH = Path.home() / '.claude' / 'settings.json'
 _CLAUDE_SKILLS_DIR = Path.home() / '.claude' / 'skills'
 
-# Claude hardcodes a plugin's skills under this subdirectory, the same way it hardcodes ".mcp.json".
-_PLUGIN_SKILLS_SUBDIR = 'skills'
-
 _SCAN_COMMAND = f'{CYCODE_SCAN_PROMPT_COMMAND} --ide claude-code'
 _SESSION_START_COMMAND = f'{CYCODE_SESSION_START_COMMAND} --ide claude-code'
 
@@ -206,7 +203,7 @@ def _read_claude_plugin(plugin_dir: Path) -> tuple[dict, dict]:
 
     # Attached to the plugin entry rather than the top-level skills list so the backend keeps the
     # plugin provenance (marketplace, plugin, version) that a marketplace-installed skill has.
-    skill_files = walk_skill_dirs(plugin_dir / _PLUGIN_SKILLS_SUBDIR)
+    skill_files = walk_plugin_skills(plugin_dir)
     if skill_files:
         entry['skill_files'] = skill_files
 

cycode/cli/apps/ai_guardrails/ides/codex.py

@@ -20,6 +20,7 @@
     resolve_cached_plugin_dir,
     walk_enabled_plugins,
 )
+from cycode.cli.apps.ai_guardrails.ides._skill_utils import walk_plugin_skills
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
@@ -121,6 +122,12 @@ def _read_codex_plugin(plugin_dir: Path) -> tuple[dict, dict]:
         if field in manifest:
             entry[field] = manifest[field]
 
+    # Same plugin-format layout as every other IDE's plugins, so a plugin shipping skills is
+    # inventoried whichever IDE loaded it.
+    skill_files = walk_plugin_skills(plugin_dir)
+    if skill_files:
+        entry['skill_files'] = skill_files
+
     mcp_ref = manifest.get('mcpServers')
     if not mcp_ref:
         return entry, {}

cycode/cli/apps/ai_guardrails/ides/copilot.py

@@ -37,6 +37,7 @@
     load_plugin_json,
     walk_enabled_plugins,
 )
+from cycode.cli.apps.ai_guardrails.ides._skill_utils import walk_plugin_skills
 from cycode.cli.apps.ai_guardrails.ides.base import IDE, DecisionAction, HookDecision
 from cycode.cli.apps.ai_guardrails.scan.payload import AIHookPayload
 from cycode.cli.apps.ai_guardrails.scan.types import AiHookEventType
@@ -178,6 +179,12 @@ def _read_copilot_plugin(plugin_dir: Path) -> tuple[dict, dict]:
         if field in manifest:
             entry[field] = manifest[field]
 
+    # Same plugin-format layout as every other IDE's plugins, so a plugin shipping skills is
+    # inventoried whichever IDE loaded it.
+    skill_files = walk_plugin_skills(plugin_dir)
+    if skill_files:
+        entry['skill_files'] = skill_files
+
     mcp_ref = manifest.get('mcpServers')
     mcp_config_path = plugin_dir / mcp_ref if isinstance(mcp_ref, str) else plugin_dir / '.mcp.json'
     mcp_doc = load_plugin_json(mcp_config_path) or {}

tests/cli/commands/ai_guardrails/ides/test_codex.py

@@ -377,3 +377,18 @@ def test_read_codex_plugin_no_mcp_config_file_when_no_manifest(tmp_path: Path) -
 
     assert 'mcp_config_file' not in entry
     assert servers == {}
+
+
+def test_read_codex_plugin_collects_plugin_skills(fs: FakeFilesystem) -> None:
+    """Plugin skills are a property of the plugin format, so Codex plugins carry them too."""
+    plugin_dir = Path('/dummy/codex-marketplace/dummy-plugin')
+    fs.create_file(
+        plugin_dir / '.codex-plugin' / 'plugin.json',
+        contents=json.dumps({'name': 'dummy-plugin', 'version': '3.0.0'}),
+    )
+    skill_file = plugin_dir / 'skills' / 'codex-skill' / 'SKILL.md'
+    fs.create_file(skill_file, contents='---\nname: codex-skill\n---\nBody.\n')
+
+    entry, _ = _read_codex_plugin(plugin_dir)
+
+    assert [s['path'] for s in entry['skill_files']] == [str(skill_file)]

tests/cli/commands/ai_guardrails/ides/test_copilot.py

@@ -15,6 +15,7 @@
 from cycode.cli.apps.ai_guardrails.ides.base import HookDecision
 from cycode.cli.apps.ai_guardrails.ides.copilot import (
     Copilot,
+    _read_copilot_plugin,
     _vscode_mcp_config_path,
     split_mcp_tool_name,
 )
@@ -499,3 +500,18 @@ def test_parse_mcp_payload_matches_plugin_server_via_normalized_name(fs: FakeFil
 
     assert unified.mcp_server_name == 'dummy-tracker'
     assert unified.mcp_tool_name == 'fetch_api'
+
+
+def test_read_copilot_plugin_collects_plugin_skills(fs: FakeFilesystem) -> None:
+    """Plugin skills are a property of the plugin format, so Copilot plugins carry them too."""
+    plugin_dir = Path('/dummy/copilot-marketplace/dummy-plugin')
+    fs.create_file(
+        plugin_dir / 'plugin.json',
+        contents=json.dumps({'name': 'dummy-plugin', 'version': '4.0.0'}),
+    )
+    skill_file = plugin_dir / 'skills' / 'copilot-skill' / 'SKILL.md'
+    fs.create_file(skill_file, contents='---\nname: copilot-skill\n---\nBody.\n')
+
+    entry, _ = _read_copilot_plugin(plugin_dir)
+
+    assert [s['path'] for s in entry['skill_files']] == [str(skill_file)]