Bundle of low-medium-severity follow-ups that were deferred when PR #720
landed the 3 blocking bugs. None of these silently break correctness —
they're discoverability, consistency, and convention gaps.
Bugs / code-quality:
1. fullstack_decision_engine.py: asymmetric cadence matching
`inputs.cadence in target or target in inputs.cadence` produced
asymmetric results — "per-pr" matched "per-pr-with-gates" but not
vice versa. Profile cadences are intentional alternatives joined
by "-or-" (e.g. "weekly-or-on-demand" → {weekly, on-demand}); now
parsed explicitly with "-with-..." modifier suffixes stripped.
Verified:
cadence=per-pr → matches per-pr, per-pr-with-gates, daily-or-per-pr
cadence=daily → matches daily-or-per-pr (only)
cadence=on-demand → matches weekly-or-on-demand
2. fullstack_decision_engine.py: rename weight_total/weight_matched
to w_total/w_matched. Backend and frontend engines already use the
short form; this aligns the three files as a family.
3. sync-gemini-skills.py: 3-way name collision in dedup logic
The naive `if name in seen_names: name = parent-name` handled one
collision but not two. Three "status" skills under "skills" parent
dirs produced two entries both named "skills-status". Now suffixes
with -2, -3, ... so each entry has a unique index name. Eliminates
the duplicate-name ambiguity surfaced when checking PR #713.
Discoverability:
4. senior-fullstack/SKILL.md: surface fullstack_decision_engine.py in
the labeled "Tools" section at the top. Previously only mentioned
inline in the body (5 references buried in the Stack Decision Matrix
section); not findable when scanning the SKILL.md.
Conventions / v2.8.0 compliance:
5. commands/cs-{fullstack,backend,frontend}-review.md: add explicit
"## Forcing-question library" section header per the v2.8.0
convention. Each lists the 7 questions inline with a pointer to
the canonical reference file.
6. agents/engineering/cs-{fullstack,backend,frontend}-engineer.md:
alphabetize the specialist list in the description field (annotated
that workflow body order remains dependency-driven). Makes the
three agent descriptions consistent as a family.
7. agents/engineering/cs-{backend,frontend}-engineer.md: promote the
"Cross-agent invocation" content out of Workflow 3 into a dedicated
"## When invoked as fork target" section with an explicit question-
skip table per parent agent (cs-fullstack-engineer, cs-cto-advisor,
cs-vpe-advisor, cs-ciso-advisor for backend; cs-fullstack-engineer,
cs-content-creator, cs-product-manager for frontend). Closes the
cross-agent contract gap the bot flagged.
Not changed:
- CLAUDE.md plugin-schema section (already corrected in #715; bot's
"stale text" claim was incorrect — it was reading the cumulative diff)
- Workflow body specialist order (intentional dependency order; would
break the SLO-first → API → DB → migration → observability sequence)
Verification:
- All 3 decision engines: --sample → exit 0
- Cadence matching: 3 test cases pass cleanly
- check_plugin_json.py --all → 0 FAIL, 0 WARN, 69 OK
- sync-gemini-skills.py → 392 unique names (was 391 unique / 1 dupe)
Addresses claude[bot] code review findings on PR #718.
1. backend_decision_engine.py: scoped language-preference match
Previous code serialized the entire profile dict to JSON and ran a
substring search, so --language-preference=go false-matched against
"django", "mongo", etc. New approach tokenizes profile_name +
stack.language + stack.runtime on '-' and checks exact membership.
Verified:
- language=go → matches go-or-rust-microservice only
- language=python → matches django-monolith + fastapi-python only
- language=typescript → matches node-express only
2. frontend_decision_engine.py: removed dead pass-block kill check
`if team_size in 4..10 and read_write_ratio >= 50: pass` was a no-op
with an unclear intent comment. Removed.
3. frontend_decision_engine.py: wired up unused inp_target_ms field
The field was declared on Inputs, exposed via --inp-target-ms, and
threaded through main() but never consulted by any kill criterion.
Added a kill check that mirrors the existing LCP one:
"mobile-4g primary with INP target Xms: tighten to < 200ms"
(Web Vitals 'good' threshold for INP is 200ms; 'poor' is 500ms.)
Verification:
- backend_decision_engine.py --sample → exit 0
- frontend_decision_engine.py --sample → exit 0
- fullstack_decision_engine.py --sample → exit 0 (untouched)
Resolves#712 and #714.
Claude Code's plugin spec (code.claude.com/docs/en/plugins-reference) requires
"All paths must be relative to the plugin root and start with ./". CC 2.1.144+
rejects the bare "skills" form with `Validation errors: skills: Invalid input`,
breaking plugin installs from this repo.
Changes:
- 47 plugin.json manifests migrated from "skills": "skills" → ["./skills"]
(canonical post-CC 2.1.144 form, also accepts string "./skills")
- scripts/check_plugin_json.py rewritten to enforce the live spec:
* Hard-fails on non-"./"-prefixed strings (except the legacy "skills" literal)
* Hard-fails on empty strings/arrays and non-string array entries
* Emits WARN (non-fatal) on the legacy "skills" literal as a safety net
for copied templates — the WARN tolerance can be removed later
* Tested against all four canonical forms + 3 garbage forms
- CLAUDE.md §5 rewritten to document the live spec, including the historical
context of the v2.1.107 → v2.1.144 regression window that's now closed
- 15 stale broken symlinks under .gemini/skills/ removed (orphans from older
reorgs that the sync script didn't prune because its cleanup is disabled)
Verification:
- scripts/check_plugin_json.py --all → 0 FAIL, 0 WARN, exit 0 (69 files OK)
- pytest tests/ → 2103 passed
- find . -type l ! -exec test -e {} \; → 0 broken symlinks
- Live spec forms tested: ["./"], ["./skills"], "./skills", ["./a","./b"] all pass
- Garbage forms rejected: bare "./", empty array, non-string entries, plain strings
Claude Code 2.1.133+ rejects "skills": "./skills" with a "Path escapes
plugin directory" warning, even though ./skills resolves to a valid
subdirectory inside the plugin root. Per the upstream docs example, the
correct value is "skills" (no ./ prefix), which works across all CC
versions and other tools (Codex, Gemini CLI, etc.).
Applied to all 47 plugin.json files that used "./skills"; updated
CLAUDE.md ClawHub publishing constraints to document the new convention
and reference the issue.
Move PIL import from module-level to inside analyse_image() so argparse
help text displays without requiring Pillow installed. Add proper argparse
with --json support per project conventions.
Fixes#653
Two small polish tasks ahead of any future Pages deploy.
1. Add /cs:* command nav entries (22 new entries)
The 21 c-level-agents-* sub-skill pages now exist (since #632) but weren't
surfaced in mkdocs.yml sidebar nav. Added a "Founder-Mode Commands" nested
section under C-Level Advisory with:
- c-level-agents index
- 10 forcing-question reviews (/cs:cfo-review through /cs:vpe-review)
- 5 strategic sprint pipeline commands (brief/boardroom/decide/execute/post-mortem)
- 4 meta+safety commands (founder-mode/onboard/cross-eval/freeze)
- /cs:office-hours
2. Clear 33 mkdocs INFO warnings
mkdocs build was emitting 33 INFO-level warnings during the docs deploy.
Pre-existing noise; not regressions. Three categories:
a) 27 unrecognized-link warnings: relative links like `[Skills](skills/)`
that mkdocs flags because the path doesn't end in .md. Fix: added
explicit `index.md` suffix in 3 manual doc files.
- docs/index.md: 15 links
- docs/skills/index.md: 11 links
- docs/custom-gpts.md: 1 link
b) 2 anchor warnings in scrum-master TOC: links pointed to
`#analysis-tools--usage` and `#key-metrics--targets` (double hyphen
from ampersand) but mkdocs Material's slugify produces single-hyphen
slugs. Fix: changed to `#analysis-tools-usage` and `#key-metrics-targets`.
c) 4 anchor warnings in senior-computer-vision + senior-data-engineer TOCs:
links pointed to non-existent sections.
- senior-computer-vision: `#common-commands` TOC entry — no such heading
anywhere; removed the entry.
- senior-data-engineer: 3 sub-bullets pointing to `#workflow-1-...`,
`#workflow-2-...`, `#workflow-3-...` — no such headings (only a
parent `## Workflows`); removed the sub-bullets.
Verification:
- mkdocs build now emits 0 INFO warnings
- karpathy diff_surgeon: 0 findings on staged diff
- All 22 new nav entries verified to point to existing HTML pages
- generate-docs.py re-run picked up the upstream SKILL.md fixes; docs/skills/
now matches sources
10 files changed, +54/-39. After the next dev->main release, the Pages
deploy will have:
- Cleaner build output (no INFO noise)
- Fully discoverable /cs:* command pages in the sidebar nav
https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN
Bitdefender (and similar heuristic AV/EDR products) quarantine the
hunt-playbooks reference because it lists the command-line patterns
associated with LOLBin abuse (certutil -decode, regsvr32 /s /u /i:http
scrobj.dll, mshta URL, etc.). The strings appear inside markdown
tables and cannot execute from a .md file — this is defensive
threat-hunting documentation.
Added a banner at the top that:
- States the defensive-doc intent explicitly
- Lists the binaries cited and why they appear
- Tells affected users how to allow-list the path
- Links to the tracking issue
Closes#533
The /si:extract command and its skill-extractor agent had no guard
against the Claude Code skill-spec reserved name fragments. Users
reported the agent autogenerating skills like 'claude-code-settings',
'claude-mcp-tools', etc. — all of which violate the spec.
- Add explicit reserved-fragment rule to both the slash-command
SKILL.md and the agent definition.
- Recommend the 'cc-' prefix for Claude Code-specific skills
(cc-settings, cc-maintenance, cc-mcp-tools).
- Add the check to both quality-gate checklists so the agent
surfaces a rename before writing files.
Closes#537
Karpathy-style review of commit 3806b9b (the prior PR commit) caught real
issues that I missed: agents weren't fully equipped per the optional but
recommended fields in the official sub-agents spec.
Changes:
- engineering/agenthub/agents/hub-coordinator.md: narrow Bash(node *) (too
broad per defense-in-depth) -> moved node into disallowedTools; add
maxTurns: 100 (orchestrators run long); add skills: agenthub:agenthub
(preload the plugin's own guidance into agent context)
- engineering-team/self-improving-agent/agents/memory-analyst.md:
add maxTurns: 30 to bound runaway analysis loops
- engineering-team/self-improving-agent/agents/skill-extractor.md:
add disallowedTools (rm/curl/wget) — agent has Write+Edit so defense-in-
depth applies; add maxTurns: 30
- engineering/karpathy-coder/agents/karpathy-reviewer.md: fix skills field
format from path-style "engineering/karpathy-coder" to spec-correct
namespaced name "karpathy-coder:karpathy-coder" (the path syntax is the
cs-* orchestrator template convention; the official sub-agents spec uses
skill names per code.claude.com/docs/en/sub-agents); add maxTurns: 30
All 6 plugin agents (4 here + 2 in playwright-pro from prior commit) +
the 1 user agent (tech-ingester) now have name + description + tools +
disallowedTools (where write-capable) + model + maxTurns. The skills:
field is set on agents that benefit from preloaded domain skill content.
Functional smoke tests post-fix:
- memory-analyst: PASS (2 turns, 25s, 24K tokens, found 1 real orphan)
- skill-extractor: PASS (0 tool uses, 34s, 17K tokens, generated correct
plan staying read-only with new disallowedTools in effect)
- karpathy-reviewer: PASS (verified in prior session, 28 tool uses)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per https://code.claude.com/docs/en/sub-agents, agents require YAML
frontmatter with name + description, and the field is `tools:` not
`allowed-tools:` (deprecated). Bare `Bash` allows any command including
curl/wget/rm, which violates defense-in-depth.
Changes:
- engineering/agenthub/agents/hub-coordinator.md: add full frontmatter
(name, description, tools allowlist for git/python/node/Agent,
disallowedTools for rm -rf / curl / wget / git push --force, model)
- engineering-team/self-improving-agent/agents/memory-analyst.md:
add frontmatter, read-only tools (Read, Glob, Grep)
- engineering-team/self-improving-agent/agents/skill-extractor.md:
add frontmatter, write tools (Read, Write, Edit, Glob, Grep)
- engineering-team/playwright-pro/agents/test-architect.md:
rename allowed-tools to tools, add model: inherit
- engineering-team/playwright-pro/agents/migration-planner.md:
same rename
- engineering-team/playwright-pro/agents/test-debugger.md:
rename + narrow bare Bash to npx playwright / node / npm patterns,
add disallowedTools for rm / curl / wget / destructive git
- engineering/karpathy-coder/agents/karpathy-reviewer.md:
narrow bare Bash to git read-ops + python, add disallowedTools
All registered agents now load cleanly under the sub-agents spec rather
than falling through to permissive registration.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Same root cause as #587/#591 — Claude Code's runtime loader rejects
array-form skills paths like ["./content-production", "./ai-seo", ...]
even when each entry is a valid subdirectory containing SKILL.md.
`claude plugin validate` accepts them but the loader does not.
The proven canonical layout (used by self-improving-agent in #536):
<plugin>/
├── .claude-plugin/plugin.json skills: "./skills"
└── skills/
├── <skill-1>/SKILL.md
├── <skill-2>/SKILL.md
└── ...
Restructured 9 multi-skill domain plugins:
- business-growth (4 skills moved)
- c-level-advisor (28)
- engineering (36)
- engineering-team (32)
- finance (2)
- marketing-skill (43)
- product-team (12)
- project-management (8)
- ra-qm-team (13)
Also fixed standalone plugins that had root SKILL.md + ./skills/ subdir
(agenthub, autoresearch-agent, executive-mentor, playwright-pro). The
loader rejected them despite skills="./skills" because of the conflicting
root SKILL.md (compare self-improving-agent which works because PR #536
moved its root SKILL.md). Moved each root SKILL.md into ./skills/<name>/.
Restored standalone plugin folders to their original paths after the
multi-skill restructure swept them into parent skills/ directories
(marketplace.json source paths require original locations).
Removed 7 orphaned marketplace entries that pointed to skill folders
without their own plugin.json (content-creator, demand-gen,
fullstack-engineer, aws-architect, product-manager, scrum-master,
skill-security-auditor) — these were already non-functional.
Bumped patch versions on every changed plugin and synced
marketplace.json. Marketplace now lists 29 working plugins (down
from 36).
After merge: users run `/plugin marketplace update claude-code-skills`
followed by `/plugin update --all` to pick up the working layout.
Claude Code v2.1.126 rejects "skills": ["./"] (array form) at runtime
with the same "Path escapes plugin directory: ./" error as the bare
string form, despite the official plugins reference docs explicitly
showing ["./"] as a valid example. `claude plugin validate` accepts it,
so the bug is in the runtime loader, not the manifest validator.
The proven workaround (already used for self-improving-agent in #536)
is to follow the canonical layout:
<plugin>/
├── .claude-plugin/plugin.json skills: "./skills"
└── skills/<plugin-name>/
├── SKILL.md
├── scripts/
├── references/
└── ...
Applied to 21 single-skill plugins:
- engineering-team/a11y-audit, google-workspace-cli, snowflake-development
- engineering/behuman, code-tour, data-quality-auditor, demo-video,
docker-development, helm-chart-builder, karpathy-coder, llm-cost-optimizer,
llm-wiki, prompt-governance, statistical-analyst, terraform-patterns
- finance/business-investment-advisor
- marketing-skill/video-content-strategist
- product-team/agile-product-owner, apple-hig-expert, code-to-prd,
research-summarizer
Moved with each SKILL.md: scripts/, references/, assets/, templates/,
expected_outputs/. Kept at plugin root (per Claude Code requirements):
agents/, commands/, hooks/, settings.json, README.md.
Bumped patch version on each restructured plugin so /plugin update
picks up the new layout.
Refs #539
PR #587 fixed `"skills": "./"` in 35 plugin.json files but did not bump
versions. Claude Code uses version as the cache key — same version string
means /plugin update is a no-op and users keep loading the cached
plugin.json with the broken path. The /plugin UI shows "1 error" on
every plugin from this marketplace because the installed cache is stale.
Per the official version-management docs:
> If you set `version` in `plugin.json`, you must bump it every time
> you want users to receive changes. Pushing new commits alone is not
> enough.
Bump every plugin.json by one patch using max(plugin_version,
marketplace_version) as the base so no version moves backward. Sync the
new versions back into .claude-plugin/marketplace.json.
After this lands, users run `/plugin marketplace update claude-code-skills`
followed by `/plugin update --all` to pull the fixed manifests.
Claude Code v2.1.107+ rejects bare "skills": "./" with "Path escapes
plugin directory: ./". This blocks every plugin in the marketplace from
loading. Replace with the layout-appropriate form per the official
plugins reference:
- Single-skill plugin (SKILL.md at root):
"skills": ["./"] array form (per docs example)
- Plugin with skills/ subdir:
"skills": "./skills" standard subdir layout
- Multi-skill domain plugin (skills are subfolders at root):
"skills": ["./sub1", "./sub2"] explicit list of skill dirs
The multi-skill case omits "./" from the array so the index SKILL.md
at the plugin root does not register as a skill — that would create
a redundant `marketing-skills:marketing-skills` namespace.
Verified by running `claude plugin validate` against all 35 manifests.
Closes#539
The plugin.json configured 'skills': './' which scans the plugin root for SKILL.md files. This found the root SKILL.md (name: 'self-improving-agent') and stopped, preventing Claude Code from discovering the subskills (review, promote, extract, status, remember) in the skills/ subdirectories.
Fix: Move root SKILL.md to skills/self-improving-agent/SKILL.md and update plugin.json to 'skills': './skills/' so Claude Code recursively scans the skills/ directory and discovers all 5 subskills.
This enables the intended /si:review, /si:promote, /si:extract, /si:status, /si:remember slash command routing.
Issue #506 reported that `hooks/hooks.json` used `./hooks/error-capture.sh`
which fails for any session started outside the plugin dir. That specific
file was already fixed in commit 217b199 (which closed#392) — both
`hooks/hooks.json` and `settings.json` already use `${CLAUDE_PLUGIN_ROOT}`.
However, two stale example paths were still surfacing the bug in
documentation:
1. `engineering-team/self-improving-agent/CLAUDE.md` line 74 — "To enable"
example with `./skills/self-improving-agent/hooks/error-capture.sh`
2. `engineering-team/self-improving-agent/hooks/error-capture.sh` header
comment — install example with the same broken path
Both examples would teach users to copy the broken pattern into their own
settings.json, reproducing the exact bug #506 describes.
Fix: rewrite both examples to use `${CLAUDE_PLUGIN_ROOT}/hooks/error-capture.sh`
and add explicit "do not use relative paths" warnings. Also clarify in
CLAUDE.md that manual hook wiring is NOT needed when installing via
`/plugin install` — the hook is registered automatically from the plugin's
hooks.json.
Fixes#506
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bug: after `/plugin install self-improving-agent@claude-code-skills`, only
1 skill appeared and `/si:review`, `/si:promote`, `/si:extract`, `/si:status`,
`/si:remember` were all unknown commands. The 5 sub-skills were silently
registered under the wrong namespace.
Root cause: two issues in the plugin manifest layer.
1. **Slash-command namespace is derived from `.claude-plugin/plugin.json`
`name`**, not from the marketplace entry name, the settings.json name, or
frontmatter. Previous `name: "self-improving-agent"` caused sub-skills to
register as `/self-improving-agent:review` etc — never matching the
documented `/si:*` commands.
2. **`command: /si:<op>` frontmatter in sub-skill SKILL.md files is a
non-standard field** not in the Claude Code Skills spec. Claude Code
silently ignores it. It created the illusion that the commands were being
registered when they were not.
Fix:
- Change `engineering-team/self-improving-agent/.claude-plugin/plugin.json`
`name` from "self-improving-agent" → "si". This is the namespace root; it
does NOT affect the marketplace install identifier (which stays
`self-improving-agent` via the marketplace.json `name` field). After the
fix, skills register as `/si:review`, `/si:promote`, `/si:extract`,
`/si:status`, `/si:remember` — matching the README and CLAUDE.md docs.
- Remove the non-standard `command: /si:<op>` frontmatter line from all 5
sub-skill SKILL.md files (review, promote, extract, status, remember).
Frontmatter now contains only `name` and `description` per the Claude Code
Skills spec.
- Bump plugin.json version 2.1.2 → 2.3.0 to match repo release.
- Update marketplace.json entry: version 2.2.0 → 2.3.0, expand description
to list all 5 slash commands and 2 sub-agents.
OpenClaw compat: the legacy `settings.json` inside the skill directory still
uses `"name": "self-improving-agent"` for OpenClaw's install path. Claude Code
ignores settings.json entirely, so this is safe to leave as-is.
Install flow (unchanged, verified correct after fix):
/plugin marketplace add alirezarezvani/claude-skills
/plugin install self-improving-agent@claude-code-skills
# → 5 skills register as /si:review, /si:promote, /si:extract,
# /si:status, /si:remember
Known related issue (not fixed in this PR to keep scope tight): `agenthub`
has the identical bug. Its plugin.json `name` is "agenthub", so sub-skills
register as `/agenthub:init` rather than the documented `/hub:init`. Same
fix applies: rename plugin.json `name` to "hub". Will file as a follow-up.
Fixes#505
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds threat-detection, incident-response, cloud-security, red-team, and ai-security skills to engineering-team. Each includes SKILL.md, references, and Python scripts (stdlib-only). Consolidation of 66 individual skills into 5 production-ready packages.
Adds adversarial code review skill with 3 hostile personas (Saboteur, New Hire, Security Auditor) that force genuine perspective shifts to break the self-review monoculture. Each persona must find at least one issue - no LGTM escapes.
Per Anthropic docs: "Keep SKILL.md under 500 lines. Move detailed
reference material to separate files."
- browser-automation: 564 → 266 lines (moved examples to references/)
- spec-driven-workflow: 586 → 333 lines (moved full spec example to references/)
- security-pen-testing: 850 → 306 lines (condensed OWASP/attack details, moved to references/)
No content deleted — all moved to existing reference files with pointers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- executive-mentor: add url to author, add homepage + repository
- self-improving-agent: add url to author, version 1.0.0 → 2.1.2
- playwright-pro: fix author name (Reza → Alireza), replace email with url, version 1.0.0 → 2.1.2
- google-workspace-cli: add url to author
All plugin.json files now use consistent author object format.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Relative paths (./hooks/error-capture.sh) resolve against the project
working directory, not the plugin root. Replaced with
${CLAUDE_PLUGIN_ROOT}/hooks/error-capture.sh in both hooks.json and
settings.json.
Fixes#392
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Claude Code plugin manifest requires author as {"name": "..."}, not a
plain string. Fixes install error: "author: Invalid input: expected
object, received string"
Affected: agenthub, a11y-audit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
