* Add tech-debt skill; bump version to 3.7.0
- New two-mode routed skill (prevent during change / triage backlog)
- Bundles jnsahaj/zero-tech-debt + anthropics/tech-debt stances
- sync-plugins.sh propagated 3.7.0 to all 143 manifests
* Add unknowns-discovery plugin (Claude port from suedzucker-codex-plugins)
Port the unknowns-discovery skill from the suedzucker-codex-plugins Codex
plugin into the Claude Code plugin format. Claude manifest is source of
truth; Codex manifest and both marketplace entries are derived via the
repo's existing generate-marketplace.sh / sync-plugins.sh tooling.
Adaptations:
- SKILL.md frontmatter description trimmed 341 -> 150 chars (sync-plugins.sh
skips single-skill plugins whose description exceeds 250 chars).
- 3 slash commands get name: unknowns-discovery:<cmd> frontmatter and drop
the Codex $unknowns-discovery token; $ARGUMENTS and allowed-tools kept.
- README rewritten for Claude/Codex install; auto-trigger keywords preserved.
- 7 references, 12 templates, 4 examples, 2 scripts copied verbatim.
- Codex-only files dropped (.codex-plugin/plugin.json regenerated,
agents/openai.yaml x2, assets/*.svg) — no icon support on the Claude side.
Also sync package.json 3.6.3 -> 3.7.0 to match marketplace + plugins
(the bump scripts don't touch package.json; resolves a pre-existing drift).
Plugin count: 143 -> 144. All versions held at 3.7.0.
Add .codex-plugin/plugin.json manifests for every plugin (derived from
.claude-plugin/ manifests) and .agents/plugins/marketplace.json (Codex's
standard marketplace location). Codex CLI users can now install plugins
natively via Added marketplace `claude-skills` from https://github.com/secondsky/claude-skills.git.
Installed marketplace root: /Users/eddie/.codex/.tmp/marketplaces/claude-skills.
New files:
- scripts/generate-codex-manifests.sh — derives Codex manifests from Claude
manifests (Claude remains source of truth)
- schemas/codex-plugin.schema.json + codex-marketplace.schema.json — AJV
validation for generated Codex artifacts
- 142 × .codex-plugin/plugin.json — one per plugin
- .agents/plugins/marketplace.json — Codex marketplace catalog
Changed:
- scripts/sync-plugins.sh — syncs .codex-plugin/ version in lockstep pass
- scripts/generate-marketplace.sh — calls generate-codex-manifests.sh after
regenerating the Claude marketplace
- scripts/validate-json-schemas.sh — validates Codex schemas alongside Claude
- package.json — added validate:codex + generate:codex scripts
- README/CHANGELOG/CLAUDE.md/PROJECT_STRUCTURE.md — Codex CLI now ✅ Native
- Version bump 3.6.2 → 3.6.3 (all 142 plugins + both marketplaces + package.json)
Not carried into Codex: commands/ and agents/ arrays (no Codex equivalent;
use Codex /import for that). mcpServers carried through where present (3 nuxt
plugins).
Fixes stale delegate-my-work/.codex-plugin/plugin.json (was 3.4.0).
Lockstep version bump (repo convention): package.json, all 142 plugin.json, and all 142 marketplace.json entries -> 3.6.1.
- README: accurate per-harness marketplace support table (Claude Code + ZCode native; Codex CLI + Cursor adaptation needed; opencode + Gemini CLI no marketplace); new 'Installing with skills.sh' section with verified npx skills examples and a security-scanning caveat.
- Removed dead scripts scripts/install-skill.sh and scripts/install-all.sh (targeted non-existent skills/ dir); updated 30 docs/plugins referencing them to use /plugin install (Claude Code) or npx skills add (cross-harness).
- Fixed skill-count inconsistency (139 -> 142 standardized; categories table updated).
- Fixed generate-marketplace.sh bug: hardcoded metadata.version=3.5.0 in heredoc reset the marketplace version on every regen; now syncs from plugin entries.
- Security-audit findings D-001, D-002, D-016, D-019, D-020 marked resolved (install scripts removed).
Lockstep version bump (repo convention): package.json, all 142 plugin.json,
and all 142 marketplace.json entries 3.5.0 -> 3.6.0. Documents the exhaustive
dependency-version audit and stale-instruction fixes from this branch in
CHANGELOG.md, and updates the README version line.
See CHANGELOG.md [3.6.0] entry for the full breakdown: 67/142 plugins
updated, version alignment across Cloudflare/Bun/Next.js/TanStack/Nuxt/
hono/drizzle/better-auth/Hugo/WP/UI skills, Zod 3->4 and Tailwind v3->v4
instruction fixes, Cloudflare node_compat->nodejs_compat, Next 16
middleware->proxy (with OpenNext caveat), CI hardening, and the broken
gitleaks hook / audit-script repairs.
Next.js 16 renamed middleware.ts -> proxy.ts, but @opennextjs/cloudflare does
not yet recognize the proxy.ts filename — renaming silently disables
middleware when deployed to Cloudflare Workers. Added the 'keep middleware.ts
on Cloudflare' warning to the three places the rename is taught:
- nextjs migration guide (canonical Next 16 migration instructions)
- bun-nextjs SKILL.md (Proxy section)
- cloudflare-nextjs feature-support.md (Middleware row, the Cloudflare home)
Defense-in-depth batch B13 — documentation/markdown-only fixes for three
findings from the secret-handling audit:
C-003 (High): better-auth Worker reference snippets logged the email
verification token to stdout. Removed the `console.log(\`Verification
code: ${token}\`)` line from both cloudflare-worker-drizzle.ts and
cloudflare-worker-kysely.ts. Also dropped the companion URL log (the
URL carries the token as a query param, so it leaks equally) and
replaced both with a redacted stub
`Verification email sent to <first-2-chars>***`.
C-004 (High): bun-cloudflare-workers SKILL.md taught
`console.log(env.API_KEY)` as the way to access a Worker secret,
contradicting the cloudflare-workers-security guidance that explicitly
marks this as NEVER. Replaced the leaking example with an `if
(env.API_KEY) { ... }` read and added the `// ❌ NEVER:
console.log(env.API_KEY)` warning comment next to it.
C-009 (Medium): Hono/OAuth reference samples hardcoded JWT/session
secrets inline. Replaced the hardcoded literals with env-var reads in:
- hono-routing/references/middleware-catalog.md (bearerAuth, jwt)
- cloudflare-workers-frameworks/references/hono.md (bearerAuth, jwt)
- oauth-implementation/references/python-java.md (Flask app.secret_key)
Each replacement carries a `// load from env; rotate immediately if
committed` comment and a one-line "Always load secrets from
environment variables; never hardcode." warning above. Added `import
os` to the Flask snippet.
Acceptance grep all return clean.
Add `set -euo pipefail` + `IFS=$'\n\t'` to all 4 hook scripts, drop fragile
grep/sed JSON fallback parsers (require jq — already a hard Claude Code hook
dependency), and wrap jq invocations with `|| true` so malformed stdin never
aborts the advisory hooks.
A-007/A-011: bun hooks now require jq (no fallback), descriptions clarified
as "advisory only — never blocks".
A-008/F-15: detect-nuxt-seo.sh env-file writes use `printf '%q'` shell
escaping and are bracketed with sentinel markers; no bare `${MODULES[*]}`
interpolation. Future-proofs against a malicious or contributor-sourced
package.json.
A-009: trust-boundary comment documents that project-file values are
untrusted, used only as fixed-string grep targets and array assignments
from a hardcoded allowlist.
A-010: check-seo-config.sh validates FILE_PATH is under $CLAUDE_PROJECT_DIR
before inspecting (defense against crafted tool_input paths).
A-012: every script documents it's invoked via `bash ...` so the shebang is
informational.
A-013: awk `site:` block parser limitation documented (single-line / nested
forms not matched; advisory env var only).
A-014: bash-patterns settings.json template no longer runs
`env > $CLAUDE_ENV_FILE` (was dumping inherited secrets); `.envrc` source
is now gated behind an explicit `.claude-enable-envrc` sentinel with a
warning comment.
All PoCs pass: malformed JSON exits 0, /etc/passwd rejected by check-seo-config,
shell-injection attempt in module name neutralized by `printf '%q'`, env-file
writes round-trip cleanly, template SessionStart hook no longer touches
CLAUDE_ENV_FILE.
Fixes#60
62/211 skills had YAML frontmatter that failed to parse, causing Claude
Code to silently drop all metadata at runtime. Affected skills would
never auto-trigger based on user input.
Two failure patterns fixed:
- Pattern A (60 files): multiline description with indented Keywords
continuation converted to YAML folded block scalar (>-)
- Pattern A variant (17 files): single-line description with colons
wrapped in double quotes
- Pattern B (1 file): inconsistent keyword list indentation in
tanstack-start normalized to consistent 4-space indent
Added YAML parse check to validate-frontmatter.sh using Ruby
YAML.safe_load to catch syntax errors that grep/awk structural
checks could not detect. Existing CI workflow already runs this
script on PRs and pushes.
Verification: 211/211 skills pass validation with 0 failures.
- Fix .githooks/pre-push grep to match root-level and nested SKILL.md
- Fix validate-frontmatter.sh find to discover all SKILL.md (not just nested)
- Add empty description validation error in validate-frontmatter.sh
- Add del(.category) to sync-plugins.sh jq filters
- Shorten dependency-upgrade description to <200 chars
- Remove false agent claims from maz-ui description
- Fix nuxt-setup.md: DB adapter from database var, add auth handlers, use packageManager
- Remove process.env/validateSecret from nuxt.config.ts template (edge compat)
- Condense nuxt-seo SKILL.md from 867→314 lines, add source links for issues #11-#14
- Fix unscoped package names: nuxt-robots→@nuxtjs/robots, nuxt-sitemap→@nuxtjs/sitemap
- Add fence language tags to nuxt-setup, performance.md, testing-vitest, staged-upgrades
- Fix nuxt-ui-v4 Dashboard component count (10, not 11)
- Scope CI workflow to changed files for PRs, full validation on push to main
- scan_agents/scan_commands return empty string instead of "null",
so agents/commands fields are omitted (not null) in plugin.json,
fixing JSON schema validation failures for 153 plugins
- Multi-skill jq merge uses del(.agents)/del(.commands) to remove
stale null values from existing plugin.json files
- validate-frontmatter.sh --dir scans skills/*/SKILL.md instead of
hardcoded skills/<plugin-name>/SKILL.md, supporting multi-skill
plugins (bun, cloudflare-workers, nuxt-v4, nuxt-v5)
- validate-frontmatter.sh --dir validates ALL sub-skills, not just
the first one
- Restore missing categorize_skill call for multi-skill plugins
The bun plugin hooks were failing because they used incorrect JSON
field paths. Claude Code sends hook input with nested structure
`{input: {command: "..."}}` but the scripts were extracting from
the root level `.command`.
Changes:
- validate-bun-command.sh: .command → .input.command
- bun-suggestions.sh: .command → .input.command
- Added defensive fallbacks for exit_code/output fields
- Changed missing command handling from error to graceful skip
Fixes hook errors: "Failed to extract 'command' from JSON input"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Wrap PreToolUse and PostToolUse events in top-level 'hooks' object
- Add description field for better documentation
- Fix schema validation error: "Expected: object at path ['hooks']"
- Matches official hooks.json structure used by other plugins
Errors prevented: 1 (schema validation failure)
Production tested: Validated against working nuxt-seo plugin structure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Removed 'category' field from plugin.json files (not part of official schema)
- Affected plugins: better-auth, bun, cloudflare-r2, cloudflare-turnstile, nuxt-studio, nuxt-ui-v4
- Category field only belongs in marketplace.json, not individual plugin.json files
- Fixes validation error: 'Unrecognized key(s) in object: category'
Per official plugin-dev:plugin-structure documentation:
- Allowed fields: name, version, description, author, homepage, repository, license, keywords, commands, agents, hooks, mcpServers
- NOT allowed: category
Note: sync-plugins.sh correctly excludes category from plugin.json generation.
These were leftover artifacts from manual creation or older processes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
secondsky