OpenAI Plugins: package examples, portable formats and connection boundaries
Operating OpenAI plugins: instructions, hooks, connections and revocation boundaries
Review executable hooks and connected-service access separately from package metadata, and avoid assuming uninstalling a bundle revokes every connection.
What you will learn
- Review instructions and executable resources separately
- Connection access is a separate boundary
- Plan revocation beyond removing the bundle
Before you start
- Basic JSON and directory-path knowledge
- Understanding of skills and external-service permissions
Distinguish source examples from current format guidance and inspect a package without confusing metadata with runtime proof.
Key takeaways
- Instruction content and executable hooks need different reviews.
- Connector identity, authentication and permitted actions are separate.
- Uninstalling a bundle may leave a separately connected service intact.
Review instructions and executable resources separately
A skill is instruction content, while a hook can run a command in the execution environment. Both deserve review, but they have different failure modes. Do not treat a plausible plugin description as evidence that its scripts are harmless or its instructions cannot be influenced by untrusted documents.
The current official packaging page says installing or enabling a plugin does not automatically trust its bundled hooks. It also notes that hook scripts must exist in the execution environment; installation on the web does not deploy them there. These are documented host rules, not a guarantee that arbitrary legacy scaffolding is active.
Connection access is a separate boundary
A registered connector identifier in .app.json is not a credential and does not itself grant access. Confirm the actual account, resource permissions and allowed operations through the supported connection flow. Test with disposable resources before giving a workflow access to private documents or write capabilities.
When reviewing public examples, inspect the package’s own publisher and license metadata. The Figma example identifies specific developer terms rather than a universal license for every repository component. This is a reminder to examine the applicable materials, not a legal determination about how you may redistribute them.
Plan revocation beyond removing the bundle
Official usage guidance distinguishes uninstalling a plugin bundle from disconnecting a separately connected MCP integration. A rollback plan should therefore identify the installed package, host enablement, trusted hooks and service connection independently. Removing one surface does not prove all external access has been revoked.
For incidents, preserve the relevant version and action evidence, stop further use within your authorized scope and review the specific connection or hook involved. Do not erase broad cache or profile directories to obtain a superficially clean state. No credential revocation, hook trust change or live security audit was performed in this series.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Inspect skills and hook commands before trusting them.
- 2
Verify account and resource scope for connections.
- 3
Test writes only on disposable authorized resources.
- 4
Document separate bundle and connection revocation steps.
Copy-ready example
{
"reviewWorksheet": true,
"skillsReviewed": false,
"hookTrustReviewed": false,
"serviceAccountVerified": false,
"writeScopeApproved": false,
"bundleRemoved": false,
"serviceDisconnected": false
}Frequently asked questions
Does enabling a plugin automatically trust its hooks?
The checked official guidance says no; bundled hooks require review and trust.
Does uninstalling revoke every service connection?
No. Official usage guidance says separately connected MCP integrations remain until disconnected.
Sources
- OpenAI Plugins / plugins/figma/.codex-plugin/plugin.jsonSource checked 2026-09-14
- OpenAI Plugins / plugins/figma/.app.jsonSource checked 2026-09-14
- OpenAI Plugins / plugins/figma/README.mdSource checked 2026-09-14
- OpenAI — Package your plugin (checked 2026-09-14)Source checked 2026-09-14
- OpenAI — Plugins usage (checked 2026-09-14)Source checked 2026-09-14