Factory’s plugin marketplace adds workflows for security reviews, code maintenance, app testing, design and optimization experiments to Droid.
Factory Plugins Marketplace is a catalog of extensions for developers working in Droid. Choose plugins for the work you need: reviewing security risks, preparing pull requests, improving TypeScript and React code, operating applications, or running measured optimization experiments. Adding the marketplace makes its plugins available to install; each plugin is installed separately as a complete package.
Once a plugin is installed and enabled, Droid can select relevant skills from your request, and you can invoke enabled skills directly. The droid-control plugin also provides user-invoked commands for recording demos, testing behavior claims and running QA flows.
Use security-engineer when a pull request or commit range needs a security review. Its workflow builds a repository threat model when needed, scans changes, and examines whether findings are exploitable. Vulnerability validation uses the scan’s findings and threat model to distinguish confirmed issues from false positives.
Use code-review to prepare a PR with a Conventional Commits title, a structured description and relevant local checks. For an existing PR, provide its URL or number to guide rebasing, reviewer fixes, CI investigation and pushed updates.
Use typescript when removing type assertions, resolving knip unused-export findings or replacing direct useEffect calls. Its guidance selects fixes according to the code’s purpose, including schema validation, type narrowing, derived state and event handlers.
Use droid-control to test a behavior claim or exercise a QA flow and collect screenshots, snapshots or byte captures. It selects terminal, browser or desktop mechanics for the target. Install only the tools your task needs; native desktop work needs cua-driver, a graphical session and the applicable OS permissions. The droid-control prerequisites explain the requirements.
Use debugging when a CLI or service sends an unexpected payload, authentication header or backend request. Its HTTP Toolkit workflow pairs exported outbound traffic with the program’s session log. The process must support proxying; captured traffic can include authentication headers.
Use autoresearch to investigate test runtime, bundle size, build time or another measurable target. Define the metric, benchmark command, files that may change and stopping condition. The skill guides repeated experiments, records results, keeps improvements and reverts regressions.
Use droid-evolved for frontend design, editing prose, creating reusable Droid skills, images or presentations. Image generation uses nanobanana and a Gemini API key; presentations use Slidev. Choose the relevant skill for the artifact you need.
Install the plugin named in each skill’s description to get that skill. The demo, QA and verification commands belong to droid-control.
Showing all 17
Coordinate threat modeling, security scanning and exploitability checks for code reviews. Plugin: security-engineer.
Map repository architecture, assets and trust boundaries into a STRIDE threat model. Plugin: security-engineer.
Scan commits, PRs or staged changes using a repository threat model. Plugin: security-engineer.
Assess scan findings for exploitability and false positives using the repository threat model. Plugin: security-engineer.
Replace TypeScript assertions with schema validation, narrowing and other checked alternatives. Plugin: typescript.
Replace direct React useEffect calls with patterns matched to their purpose. Plugin: typescript.
Resolve knip findings by tracing consumers and correcting exports or file boundaries. Plugin: typescript.
Run measured optimization experiments, keeping improvements and reverting regressions. Plugin: autoresearch.
Prepare pull requests with conventional titles, structured descriptions and relevant local checks. Plugin: code-review.
Rebase existing PRs, address review comments, fix CI and push updates. Plugin: code-review.
Operate terminal, browser and desktop apps for tests, demos and evidence capture. Plugin: droid-control.
Automate forms, screenshots, browser tests and data extraction with agent-browser. Plugin: droid-evolved.
Inspect HTTP traffic with HTTP Toolkit for processes that support proxying. Plugin: debugging.
Design and build web interfaces with responsive layout and accessibility guidance. Plugin: droid-evolved.
Generate images with nanobanana or create Slidev presentations; images need a Gemini API key. Plugin: droid-evolved.
Edit prose to remove formulaic language while preserving meaning and voice. Plugin: droid-evolved.
Turn repeatable workflows and learned techniques into reusable Droid skills. Plugin: droid-evolved.
No matching results.
/demoPlan and record a feature or PR demo, with comparison video when needed.
Use this command in a Droid session with droid-control installed. Supply a PR number, GitHub URL or a description of the feature to demonstrate. Review and approve the proposed plan before recording.
Video work needs the capture and rendering dependencies for your target. See the demo command and video prerequisites.
/qa-testExercise an application flow and report results with captured evidence.
Use this command in a Droid session with droid-control installed. Supply a URL, app name, CLI target, PR reference or a description of the flow. Include the steps and success criteria you want checked.
The workflow records pass, fail or blocked results with evidence. Native desktop testing needs the graphical session and OS permissions for its driver. See the QA command and target prerequisites.
/verifyTest a behavior claim and report whether the evidence supports it.
Use this command in a Droid session with droid-control installed. Supply a specific claim, optionally with a PR reference. It guides an interaction that can confirm or refute the claim and reports an inconclusive result when the evidence cannot decide it.
The driver and permissions depend on the application being tested; video production is optional. See the verification command and target prerequisites.
Add the marketplace, then install the plugins you want. Each plugin installs as a complete package; registering the marketplace alone does not install its plugins.
Register the marketplace from a terminal where the Droid CLI is available.
droid plugin marketplace add https://github.com/Factory-AI/factory-pluginsChoose the plugin to install. For a specific skill, use the plugin ID shown in its Components description.
Choose user or project scope and run the corresponding install command. Repeat this step for each plugin you want.
Installation scope
For user scope, replace <plugin@marketplace> with your chosen plugin ID, such as security-engineer@factory-plugins.
droid plugin install <plugin@marketplace> --scope userRun from the project folder. Replace <plugin@marketplace> with your chosen plugin ID, such as security-engineer@factory-plugins.
droid plugin install <plugin@marketplace> --scope projectConfirm the plugin is installed and enabled. In a Droid session, open the plugin manager and check the Installed tab for each plugin you selected. Where policy permits, Space toggles enablement.
/pluginsFor a plugin containing skills, check which skills Droid discovered and which version is active.
/skillsSources: Factory marketplace installation, Droid plugin management and Droid skill management.