* Add tech-debt skill; bump version to 3.7.0
- New two-mode routed skill (prevent during change / triage backlog)
- Bundles jnsahaj/zero-tech-debt + anthropics/tech-debt stances
- sync-plugins.sh propagated 3.7.0 to all 143 manifests
* Add unknowns-discovery plugin (Claude port from suedzucker-codex-plugins)
Port the unknowns-discovery skill from the suedzucker-codex-plugins Codex
plugin into the Claude Code plugin format. Claude manifest is source of
truth; Codex manifest and both marketplace entries are derived via the
repo's existing generate-marketplace.sh / sync-plugins.sh tooling.
Adaptations:
- SKILL.md frontmatter description trimmed 341 -> 150 chars (sync-plugins.sh
skips single-skill plugins whose description exceeds 250 chars).
- 3 slash commands get name: unknowns-discovery:<cmd> frontmatter and drop
the Codex $unknowns-discovery token; $ARGUMENTS and allowed-tools kept.
- README rewritten for Claude/Codex install; auto-trigger keywords preserved.
- 7 references, 12 templates, 4 examples, 2 scripts copied verbatim.
- Codex-only files dropped (.codex-plugin/plugin.json regenerated,
agents/openai.yaml x2, assets/*.svg) — no icon support on the Claude side.
Also sync package.json 3.6.3 -> 3.7.0 to match marketplace + plugins
(the bump scripts don't touch package.json; resolves a pre-existing drift).
Plugin count: 143 -> 144. All versions held at 3.7.0.
Add .codex-plugin/plugin.json manifests for every plugin (derived from
.claude-plugin/ manifests) and .agents/plugins/marketplace.json (Codex's
standard marketplace location). Codex CLI users can now install plugins
natively via Added marketplace `claude-skills` from https://github.com/secondsky/claude-skills.git.
Installed marketplace root: /Users/eddie/.codex/.tmp/marketplaces/claude-skills.
New files:
- scripts/generate-codex-manifests.sh — derives Codex manifests from Claude
manifests (Claude remains source of truth)
- schemas/codex-plugin.schema.json + codex-marketplace.schema.json — AJV
validation for generated Codex artifacts
- 142 × .codex-plugin/plugin.json — one per plugin
- .agents/plugins/marketplace.json — Codex marketplace catalog
Changed:
- scripts/sync-plugins.sh — syncs .codex-plugin/ version in lockstep pass
- scripts/generate-marketplace.sh — calls generate-codex-manifests.sh after
regenerating the Claude marketplace
- scripts/validate-json-schemas.sh — validates Codex schemas alongside Claude
- package.json — added validate:codex + generate:codex scripts
- README/CHANGELOG/CLAUDE.md/PROJECT_STRUCTURE.md — Codex CLI now ✅ Native
- Version bump 3.6.2 → 3.6.3 (all 142 plugins + both marketplaces + package.json)
Not carried into Codex: commands/ and agents/ arrays (no Codex equivalent;
use Codex /import for that). mcpServers carried through where present (3 nuxt
plugins).
Fixes stale delegate-my-work/.codex-plugin/plugin.json (was 3.4.0).
Lockstep version bump (repo convention): package.json, all 142 plugin.json, and all 142 marketplace.json entries -> 3.6.1.
- README: accurate per-harness marketplace support table (Claude Code + ZCode native; Codex CLI + Cursor adaptation needed; opencode + Gemini CLI no marketplace); new 'Installing with skills.sh' section with verified npx skills examples and a security-scanning caveat.
- Removed dead scripts scripts/install-skill.sh and scripts/install-all.sh (targeted non-existent skills/ dir); updated 30 docs/plugins referencing them to use /plugin install (Claude Code) or npx skills add (cross-harness).
- Fixed skill-count inconsistency (139 -> 142 standardized; categories table updated).
- Fixed generate-marketplace.sh bug: hardcoded metadata.version=3.5.0 in heredoc reset the marketplace version on every regen; now syncs from plugin entries.
- Security-audit findings D-001, D-002, D-016, D-019, D-020 marked resolved (install scripts removed).
Lockstep version bump (repo convention): package.json, all 142 plugin.json,
and all 142 marketplace.json entries 3.5.0 -> 3.6.0. Documents the exhaustive
dependency-version audit and stale-instruction fixes from this branch in
CHANGELOG.md, and updates the README version line.
See CHANGELOG.md [3.6.0] entry for the full breakdown: 67/142 plugins
updated, version alignment across Cloudflare/Bun/Next.js/TanStack/Nuxt/
hono/drizzle/better-auth/Hugo/WP/UI skills, Zod 3->4 and Tailwind v3->v4
instruction fixes, Cloudflare node_compat->nodejs_compat, Next 16
middleware->proxy (with OpenNext caveat), CI hardening, and the broken
gitleaks hook / audit-script repairs.
Add `set -euo pipefail` + `IFS=$'\n\t'` to all 4 hook scripts, drop fragile
grep/sed JSON fallback parsers (require jq — already a hard Claude Code hook
dependency), and wrap jq invocations with `|| true` so malformed stdin never
aborts the advisory hooks.
A-007/A-011: bun hooks now require jq (no fallback), descriptions clarified
as "advisory only — never blocks".
A-008/F-15: detect-nuxt-seo.sh env-file writes use `printf '%q'` shell
escaping and are bracketed with sentinel markers; no bare `${MODULES[*]}`
interpolation. Future-proofs against a malicious or contributor-sourced
package.json.
A-009: trust-boundary comment documents that project-file values are
untrusted, used only as fixed-string grep targets and array assignments
from a hardcoded allowlist.
A-010: check-seo-config.sh validates FILE_PATH is under $CLAUDE_PROJECT_DIR
before inspecting (defense against crafted tool_input paths).
A-012: every script documents it's invoked via `bash ...` so the shebang is
informational.
A-013: awk `site:` block parser limitation documented (single-line / nested
forms not matched; advisory env var only).
A-014: bash-patterns settings.json template no longer runs
`env > $CLAUDE_ENV_FILE` (was dumping inherited secrets); `.envrc` source
is now gated behind an explicit `.claude-enable-envrc` sentinel with a
warning comment.
All PoCs pass: malformed JSON exits 0, /etc/passwd rejected by check-seo-config,
shell-injection attempt in module name neutralized by `printf '%q'`, env-file
writes round-trip cleanly, template SessionStart hook no longer touches
CLAUDE_ENV_FILE.
Batch B5 — closes 2 Critical + 4 High findings in claude-code-bash-patterns
hook scripts. The PreToolUse guard previously failed OPEN on malformed input
and missed many dangerous-command shapes; the logger captured secrets
verbatim and read from the wrong source; the enforcer never blocked.
dangerous-command-guard.py (A-001 Critical fail-open, A-002 Critical
AttributeError, A-003 High regex bypass):
- Fail-secure parsing: malformed JSON, non-object JSON ([]/null/"str"/42),
or non-object tool_input all block with exit 2 + stderr reason. Empty
command allows (legitimate non-bash tool input).
- Widened the except clause and added isinstance() guards throughout.
- Removed inverted "fail open for safety" comment; replaced with a
fail-closed rationale and a denylist caveat pointing at allowlist-based
allowedTools as the primary control.
- Added patterns: rm -fr / rm -rf / rm --recursive --force / targeting /,
find / -delete, chmod -R <octal> /, git push --force (any position),
curl/wget | sh|bash, fork-bomb flexible spacing, /etc/{passwd,sudoers,
shadow} overwrite. All tested against the actual bypass commands.
bash-audit-logger.sh (A-004 High secrets, A-005 High wrong var, D-018 Med
rotation race):
- Read JSON from stdin instead of $CLAUDE_TOOL_INPUT (Claude Code sends
the payload on stdin, not env).
- redact_secrets() scrubs Bearer/Authorization headers, password=,
PGPASSWORD=, --token, and sk-/ghp_/AKIA/xox[baprs]- prefixes before
logging. Best-effort; documented as extendable.
- umask 077 at top; chmod 600 on every log (re)creation.
- Rotation wrapped in flock when available; graceful fallback with a
TODO comment on platforms without flock (e.g. macOS default).
package-manager-enforcer.sh (A-006 High wrong var):
- Read JSON from stdin; the old env-var read left COMMAND empty and the
block logic never fired. pnpm-lock.yaml + `npm install` now correctly
blocks with exit 2.
PoC verification (all passed):
- guard: empty stdin / [] / null / "str" all exit 2 (was 0 / uncaught);
rm -fr /, find / -delete, curl|sh, git push origin main --force all
exit 2; legit `ls -la` and `npm install` still exit 0.
- logger: Bearer token + multiple token shapes (PGPASSWORD, ghp_, sk_,
AKIA, xoxb-) all show ***REDACTED*** in log; secret absent from log;
perms 0600; rotation triggers on >10MB log.
- enforcer: pnpm-lock + npm install blocks (exit 2); no lockfile allows
(exit 0); yarn.lock + pnpm add blocks (mismatch).
- All tests used HOME=\$(mktemp -d); real ~/.claude untouched.
- Move SKILL.md files from root to skills/<plugin-name>/ subdirectories
- Update all 169 plugins to match official plugin-structure pattern
- Fix marketplace generation script to find SKILL.md in new location
- Update CLAUDE.md documentation with correct structure
- Update skill templates to match new pattern
Per official plugin-dev:plugin-structure skill:
- Skills MUST be in skills/ subdirectory for auto-discovery
- Each plugin has skills/<name>/SKILL.md structure
- This enables Claude Code to automatically discover and load skills
Fixes skill discovery issue where plugins showed as 'installed' but
skills didn't appear in system prompt.
Migration script: scripts/migrate-plugin-structure.sh
Migrated: 167 plugins successfully (2 already migrated)
Total: 169 skills now discoverable
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
BREAKING CHANGE: All plugin paths changed from nested to flat structure
Problem:
- Only 11 out of 169 skills appeared in Claude Code's system prompt
- v3.1.0 updated marketplace.json but didn't migrate directory structure
- Mismatch: marketplace expected `./plugins/skill-name` but files were at
`./plugins/category/skills/skill-name`
Solution:
- Moved all 169 skills from `plugins/*/skills/*` to `plugins/*` (flat)
- Removed 66 empty category directories (api, cloudflare, testing, etc.)
- Updated marketplace.json with correct flat paths (all 169 entries)
- Updated scripts to work with flat structure:
- generate-marketplace.sh: removed nested loop logic
- sync-plugins.sh: simplified to single loop
- Added flatten-plugin-structure.sh migration tool
Migration Details:
- Used git mv to preserve history for all 169 skills
- Handled name collisions via temporary directories
- Validated: 0 errors, 169 skills successfully migrated
Results:
- ✅ All 169 skills at `plugins/*/` level
- ✅ marketplace.json: 169 valid entries
- ✅ No nested skills/ directories remain
- ✅ Scripts updated and tested
This completes the migration started in v3.1.0 (commit 677abf8) and
resolves skill discovery issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
secondsky