The neon-postgres plugin exposed its skills via symlinks pointing outside
the plugin root (../../../skills/*). Cursor and Claude silently drop
out-of-root symlinks when installing a plugin from git, so the plugin
shipped its MCP server but none of its skills.
Replace the symlinks with committed real copies of every skill, generated
from the top-level skills/ source of truth by a one-way sync script
(scripts/sync-plugin-skills.mjs, driven by an in-script PLUGIN_SKILLS map;
"*" vendors all skills). A pre-commit hook wired via the prepare script
runs the sync automatically, and validate:plugin-skills (in validate:ci)
plus the cursor/claude plugin validators fail on drift or any in-plugin
symlink so this cannot silently regress.
Restructure plugin packaging into per-plugin folders so Claude and Cursor manifests, MCP config, and branding are co-located while shared skills are symlinked from top-level skills. Add plugin-manager guidance and CI validation scripts/workflow to prevent marketplace and manifest path regressions as additional plugins are added.
Co-authored-by: Cursor <cursoragent@cursor.com>
Tony Dang