When creating NPCs, you have one main luxury - you don't have to create them in front of the rest of the players; it's no concern of theirs if you simply assigned their stats willy-nilly. What's important is that the concept and the character are believable. Get your purpose in mind and then work out a statblock to suit it. Figure out their personalities, their in-game strengths and weaknesses, and a bit about their appearance, and write a paragraph about them first.
Thousand-Faced Thralgar is a master of disguise. A spy by trade, little in the city that escapes his notice. No-one is quite sure what he looks like, including (as his career progresses) himself. He's changed his appearance more times than he'd care to remember; one face is much like another. He could be anyone: the barman who just served you a pint of stout, the young lad who's looking for work and agreed to carry your weapons for you while you're down in the dungeon - even the prostitute who agreed to do all the horrible things you wanted her to do to you last night that your wife would never dream of doing! It's an unpleasant job, but the gain far outweighs the pain. Regardless of what he wants, his motives are selfish and almost certain to run against those of the heroes. He could even be called upon to play a very fiendish role - to imitate a member of the adventuring party, infiltrate his way into their ranks and learn their secrets!
His main assets are his ability to insinuate himself into almost any situation, and find a way to work it to his advantage. His lack of physical strength is his chief weakness, but in his opinion muscle is overrated, and if a job has to be accomplished with a lot of unpleasant exertion, then chances are it's either not worth doing, or some big, muscled, well-meaning idiot can do it for him.
Level 1
At level 1, Thousand-Faced Thralgar is more likely to be encountered as part of a group rather than at the top of an organisation of thugs and spies, although he is still more powerful than a 1st-level warrior or expert, so his superiors might trust him with a few bodyguards -- perhaps a few mêlée grunts, as detailed in the article on grunts.
Thousand-Faced Thralgar, male human Brd1: CR 1; Medium Humanoid (Human); HD 1d6; hp 6; Init +1 (Dex); Spd 30 ft.; AC 13 (+1 Dex, +2 armour), touch 11, flat-footed 12; Base Atk +0; Grp -1; Atk -1 melee (1d4-1/19-20, dagger) or +1 ranged (1d4-1/19-20, dagger); Full Atk -1 melee (1d4-1/19-20, dagger) or +1 ranged (1d4-1/19-20, dagger); Space/Reach 5 ft./5 ft.; SA Bardic Music 1/day (countersong, fascinate, inspire courage +1); SQ Bardic Knowledge +3; AL NE; SV Fort +0, Ref +3, Will +3; Str 8, Dex 13, Con 10, Int 14, Wis 12, Cha 15.
Languages: Common, Dwarf, Elf.
Skills and Feats: Bluff +6, Concentration +4, Diplomacy +6, Disguise +13, Forgery +4, Gather Information +6, Listen +2, Perform (act) +6, Sense Motive +5, Spellcraft +6, Spot +2, Tumble +2, Use Magic Device +3; Deceitful, Skill Focus (Disguise).
Bard Spells Known (2, base DC = 12 + spell level): 0-detect magic, ghost sound, light, read magic.
Possessions: 3 daggers, leather armour, disguise kit, artisan's outfit, entertainer's outfit, explorer's outfit, peasant's outfit, scholar's outfit, traveller's outfit.
All well and good - but how do we get all that?
A high Charisma is absolutely vital, so he might as well be a bard. The second highest score needs to be Intelligence. Dexterity and Wisdom are handy - Will saves can be used to throw off mind probes and help with seeing through others' disguises, while Dexterity is ignored at the bard's peril. Once the jig's up, Thralgar would need to get out of the way. Strength isn't all that important, and neither really is Constitution. Of the two, Strength is probably the least important. He won't be much cop in melee at any time, so better to let him have more hit points and average Fortitude saves and Concentration checks.
Since the brief for creating him was 'master of disguise', his choice of skills and feats is absolutely vital. Immediately Disguise has to be maxed out. The more skills he has, the better, so he's a human - and of course since humans are meant to be able to fit in almost anywhere, that fits nicely.
Now, broadening this idea a bit, the master of disguise has to be able to act convincingly, and on the whole serves best as a spy. This means he'll need Perform (act) too. Maxing out Bluff is also a good idea, and no intelligence agent worth his salt goes without Diplomacy, Innuendo and Sense Motive. Can he afford all of these skills maxed out? Bards can max out six skills at 1st-level, plus one skill per point of Intelligence bonus and one more skill for being human.
With that in mind, he has Int 14, so all in all that gives him 36 (24+4+8=36) skill points - enough to max out nine skills. If I could max them all out, I'd go for Bluff, Disguise and Perform (necessary for bardic music and going around in disguise), and then Diplomacy, Gather Information and Sense Motive (for spying), and finally Concentration and Spellcraft (for spellcasting). As fortune would have it, he can max the lot of them out, with four skill points left over. A lot of other skills would be useful for espionage, but I think he can afford to spread the points around - so he gets one rank each in Listen, Spot, Tumble and Use Magic Device.
No problems there! He's pretty good at almost everything except Concentration, due to that average Constitution. He won't be casting many spells in combat right now - unless he casts defensively while his minions engage the PCs. This is where feats come in. Being a human, he gets an extra feat, which we'll put straight into Skill Focus (Disguise). The other feat will go into Combat Deceitful, just to push this capability up even further since it gives him +2 to Disguise and Forgery checks. He's not a very good combatant, but his forte lies very much in deceiving his enemies and leading them into traps.
As for equipment - right now it's not too important. All he needs is something easy to use, concealable and innocuous. I'd rather not spend a feat to get a Martial Weapon Proficiency or Exotic Weapon Proficiency at this stage. Carrying a fancy weapon is an easy way to be recognised, and that's not what Thralgar needs. Therefore, he has leather armour and three daggers - practical, versatile weapons that can be used up close or at range. Most of his expenditure goes on his outfits, since if you're going to try to imitate people you may as well look the part! The disguise kit's also a must: that gives him a +2 circumstance bonus to Disguise checks.
Finally, Thralgar needs some spells. Thralgar doesn't know many at this level, and none except daze and flare are any use in combat. Since he's a spy, he takes detect magic and read magic since they'll always be handy, regardless of level, while ghost sound can provide a useful distraction and light helps him cope with his inability to see in the dark.