* fix(fp-check): use correct JSON response format in stop hooks
Prompt-type stop hooks must respond with JSON. The previous prompts
instructed Claude to return plain text ('block' or 'approve'), causing
'Stop hook error: JSON validation failed' on every session end.
Updated both Stop and SubagentStop hook prompts to respond with:
- {"decision": "block", "reason": "..."} to prevent stopping
- {} to allow stopping (omitting decision field per Claude Code docs)
Bug discovered by Claude while debugging the JSON validation error
during active use of the fp-check skill.
* fix: use documented ok/reason schema for prompt hooks, bump to 1.0.2
Per https://code.claude.com/docs/en/hooks.md (Prompt-based hooks >
Response schema), prompt hooks must respond {"ok": true} to allow or
{"ok": false, "reason": "..."} to block — not {"decision": "block"}
or {}. Also bump to 1.0.2 since main already shipped 1.0.1 without
this fix; clients only update when the version increases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Update second-opinion Codex model to gpt-5.5-codex
Bump primary model from gpt-5.3-codex to gpt-5.5-codex and fallback
from gpt-5.2-codex to gpt-5.4-codex. Plugin version 1.6.0 → 1.7.0.
* fix: correct Codex model name from gpt-5.5-codex to gpt-5.5
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
* fix(semgrep-rule-creator): correct 404ing semgrep-docs links
The semgrep-docs repo migrated these writing-rules pages from .md to
.mdx, so the WebFetch links in SKILL.md were returning 404. Update the
five affected links to their .mdx paths (pattern-syntax was already
.mdx). All seven links now return HTTP 200.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump version to 1.2.2 in plugin.json
* Update semgrep-rule-creator version to 1.2.2
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: ahpaleus <38883201+ahpaleus@users.noreply.github.com>
* feat(codex): add skill UI metadata
* Use official Trail of Bits logo
* fix: resolve code review findings for PR #175
Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.
P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
all 38 plugins with skills and point every openai.yaml at
../../assets/trail-of-bits-mark.svg (the supported plugin-level
shared asset pattern). Icons now resolve for marketplace
installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
openai.yaml resolved nowhere (.codex/skills is not a Codex
discovery root) and PR #173 removes the whole .codex/ tree
P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
marketplace.json so installed clients pick up the metadata
Verified:
- Static check replicating Codex's resolution algorithm: all 73
yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
resolved iconSmall/iconLarge and brand_color #D83A34
(claude-in-chrome-troubleshooting fails to load on main due to
a pre-existing 64-char qualified-name limit, fixed by #173's
rename; zeroize-audit's manifest mcpServers object is likewise
a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
pass
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(codex): use skill-local icon assets
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Remove legacy codex compatiblity scripts/shims.
Codex supports claude plugins so this shouldn't be necessary.
Add a script to test the plugin loadablility in both claude and codex
* fix: resolve code review findings for PR #173
Review findings addressed (4 reviewers: pr-review-toolkit agents,
Codex gpt-5.3-codex, direct diff review):
P2 fixed:
- Bump versions for the 5 substantively changed plugins in both
plugin.json and marketplace.json (gh-cli 1.5.0 new skill,
claude-in-chrome-troubleshooting 1.1.0 skill rename,
modern-python 1.5.1 / skill-improver 1.0.3 hooks change,
zeroize-audit 0.1.1 MCP config relocation) so clients pick up
the changes
- README Codex install: replace unpasteable /plugins slash-command
block with verified CLI syntax (codex plugin marketplace add)
- check_claude_loadability: parse_json_output now fails fast with
command context on empty CLI output instead of returning None
- check_codex_loadability: surface skipped RPC error messages in
timeout failures instead of a bare TimeoutError
P3 fixed:
- Both checkers: error out when marketplace.json lists no plugins
instead of passing vacuously
Dismissed:
- @latest CLI installs in validate.yml: deliberate; the check
validates against the clients users actually run
- select.select portability: CI-only script on ubuntu-latest
- Divergent mcpServers validation between checkers: intentional;
the Codex checker enforces the repo's .mcp.json convention
Verified: ruff, prek, validate_plugin_metadata.py, and both
loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP
servers load in Claude Code and Codex)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fix for when CLAUDE_PLUGIN_ROOT contains spaces
* chore(skill-improver): bump version to 1.0.2 for hooks.json fix
The space-quoting fix to hooks.json is a behavioral change, but clients
only pull plugin updates when the version increases. Bump plugin.json and
the root marketplace.json from 1.0.1 to 1.0.2 (kept in sync) so existing
users actually receive the fix.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Expand let-fate-decide zodiac spread
* let-fate-decide: address self-review nits
- Compute ENTROPY_BITS from math.log2(math.comb(...)) so the dict cannot
silently drift if the spread shape changes; test now verifies the formula
and asserts the 100-bit floor.
- Remove the ambiguous draw() wrapper (list-or-dict return); callers use
explicit draw_zodiac_spread() / draw_cards() instead.
- Extract _build_house_record() helper to bring draw_zodiac_spread() under
the 50-line guideline.
- Require --legacy explicitly for the positional count CLI; remove the
implicit legacy flip when a bare integer was passed.
- Generalize the rank-format test to all four minor suits.
- Document test_reviewed_cards_avoid_unsafe_shortcuts as an exact-string
regression guard rather than a semantic check.
- SKILL.md: reframe example session as an explicit house-level fragment
and note the draw agent's bullet output format.
- README.md: correct the deck-shuffle description (two independent decks,
not one 78-card shuffle); compute entropy text from formulas.
- marketplace.json + plugin.json: sync description to mention the 12
Houses spread and the 100+ bit entropy budget.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* let-fate-decide: align SKILL.md description article with sibling surfaces
PR review flagged the SKILL.md frontmatter said "Draws a 12 Houses..." while
plugin.json, marketplace.json, and agents/draw.md all say "Draws the 12
Houses...". SPREAD_NAME is a single fixed spread, so "the" is correct.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* let-fate-decide: rename entropy_bits.minor_shuffle to minor_arcana
PR review flagged inconsistent naming in the entropy_bits dict: major_arcana
(deck-named) vs minor_shuffle (operation-named). The value is also
log2(C(56,24)), an unordered selection — not log2(56!), a full shuffle — and
every prose consumer (SKILL.md, README.md, the entropy_note f-string) already
calls it "Minor Arcana selection". Rename for parallel structure.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* let-fate-decide: address PR follow-up nits
1. agents/draw.md: tighten portent template prose from "3-5 concise bullets"
to "3 concise bullets" — the fenced template has exactly 3 placeholders,
and a Haiku-class model will follow the template literally rather than
the looser range. SKILL.md's example session synced to match.
2. references/INTERPRETATION_GUIDE.md: rewrite the Special Patterns section
for the 12-house spread. The previous patterns were carried over from
the 4-card hand and were broken in the new geometry: "Multiple Major
Arcana" was guaranteed (12 Majors per draw), "All One Suit" was
mathematically impossible (each Minor suit has only 14 cards vs. 24
Minor draws), "All Reversed" dropped from 2^-4 to 2^-36, and "Court
Card Progression in sequence" had no meaning across houses. Replaced
with four patterns calibrated to the new baseline frequencies:
heavy reversal count (>= 24 of 36), heavy single-suit concentration
(>= 10 of 24 Minors), weighty Majors in critical houses (1/8/12), and
court cards clustering in people houses (3/7/11).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* let-fate-decide: fix reversal percentile, focus/Domain drift, Step 1 heading
- Correct "Heavy Reversal Count": P(X>=24) for Binomial(36, 0.5) is ~3.26%,
so "6th percentile" was wrong in both magnitude and direction. Reword to
"roughly the top 3% of draws".
- Align each house focus string to its house file **Domain** line (Houses 6,
7, 8, 9, 12 differed in content; House 8 dropped "secrets"). Both surfaces
reach the interpreter on the default --content path.
- Add test_zodiac_focus_matches_house_domain to pin the two surfaces together.
- Fix Step 1 heading to "Read Each House and Card File" to match its body.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* fix: correct duplicate section numbering in solana-vulnerability-scanner
Three sections shared number 5. Renumbered:
- Section 5: Vulnerability Patterns (unchanged)
- Section 6: Scanning Workflow (was 5)
- Section 7: Example Output (was 5)
- Section 8: Reporting Format (was 6)
- Section 9: Priority Guidelines (was 7)
- Section 10: Testing Recommendations (was 8)
* Renumber all H2 sections sequentially in document order
The earlier renumber attempt only addressed the three '## 5.' duplicates
flagged in #159, but introduced two new pairs ('## 9. Priority Guidelines' /
'## 9. Additional Resources' and '## 10. Testing Recommendations' /
'## 10. Quick Reference Checklist') and left the section numbers
non-monotonic ('7, 5, 6' in document order).
This commit renumbers all 12 H2 sections strictly in document order so the
numbers are unique AND increasing: 1..4 unchanged, Example Output now 5,
Vulnerability Patterns 6, Scanning Workflow 7, Reporting Format 8 (no
change), Priority Guidelines 9 (no change), Testing Recommendations 10
(no change), Additional Resources 11, Quick Reference Checklist 12.
Also adds the missing blank line before '## 7. Scanning Workflow' so the
heading does not abut the preceding paragraph.
Bumps building-secure-contracts plugin version 1.1.0 → 1.1.1 in both
plugin.json and marketplace.json so clients pick up the fix.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* init c review
* lsp
* agents -> prompts
* wip
* add windows, update judges
* improve
* upgrade
* size update
* rm toon format, improve workflow, cluster agents/prompts by issue type, improve prompt cache
* improve general workflow, fix bugs
* sarif via script, cluster manifest
* fix bugs
* fix workflow2
* workflow updates
* more fixes
* more fixes
* improvements
* update readme
* update codeowners
* update codeowners2
* fix small inconsistencies
* Address review feedback on c-review plugin
Critical:
- Move SKILL.md into named skill subdirectory (plugins/c-review/skills/c-review/)
so plugin discovery and the Codex validator find it; add .codex/skills/c-review
symlink.
- Convert allowed-tools in SKILL.md from YAML list to space-delimited string
(spec compliance per #139).
- Fix parse_scalar in generate_sarif.py to respect quoted strings when splitting
inline lists; ["a,b", c] no longer corrupts to ['"a', 'b"', 'c'].
- Fix location_parts trailing-colon handling so 'src/foo.c:' resolves to
('src/foo.c', 1) instead of keeping the colon in the filename.
Important:
- Convert agent tools: from YAML list to comma-separated string in worker,
dedup-judge, fp-judge.
- Refactor build_run_plan.py main() (131 → 77 lines) by extracting
_validate_run_inputs / _render_workers / _print_summary helpers.
- Fix ty possibly-missing-attribute warning by typing workers list explicitly.
- Add PEP 723 inline metadata + plugins/c-review/scripts/pyproject.toml.
- Rewrite SKILL.md description as scenario-based; add When to Use /
When NOT to Use section headers.
- Add Usage section to README.
- Resolve Tier 2 contradiction in dedup-judge: unparseable/multi findings
now skip Tier 2 and go straight to Tier 3.
- Standardize placeholder convention in fp-judge ({var} not <var>).
- Fix "Widthness Overflows" → "Width Truncation" in integer-overflow-finder.
- Standardize "Bug Patterns to Find" heading in signal-handler and
thread-safety finders.
- Replace ls -1 glob in worker shard-write with find for shell portability.
- Bump version 1.1.0 → 1.1.1 in plugin.json + marketplace.json.
Verification: codex validator passes (73 plugin skills); ruff + ty clean;
main() 77 lines (limit 100); SARIF generator runtime tests pass; end-to-end
build_run_plan.py produces all 11 clusters with cache primer.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Address claude[bot] review feedback on c-review
- Phase 1 is_posix/is_windows probes in SKILL.md now include C++ extensions
(.cpp, .cxx, .cc, .hpp, .hh) in their --include lists. A pure C++ POSIX
daemon was silently dropping ~17 POSIX-gated passes plus all is_windows
clusters because pthread.h / windows.h includes only in .cpp/.hpp files
failed both --include='*.c' --include='*.h' filters.
- generate_sarif.py informationUri points at trailofbits/skills (the actual
repo) instead of trailofbits/tob-skills (404).
- CODEOWNERS: add @dguido co-owner to /plugins/c-review/ and move it to the
top of the c* alphabetical group (- < l < o < u under ASCII collation).
- README.md: move c-review row after burpsuite-project-parser (b < c).
- Bump version 1.1.1 → 1.1.2.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add adversarial-modeler agent to differential-review plugin
Introduces a formal agent definition for adversarial threat modeling
on high-risk code changes. Updates SKILL.md to reference agent and
bumps version to 1.1.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix {baseDir} paths and bump marketplace.json version
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve code review findings for PR #84
- Fix decision tree formatting: use correct tree syntax (first
child uses branch connector, last child uses end connector)
- Add "When NOT to Use" section to adversarial-modeler agent per
contributing guidelines
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add sharp-edges-analyzer agent to sharp-edges plugin
Introduces a formal agent definition for the sharp edges analysis
workflow. Updates SKILL.md to reference agent and bumps version
to 1.1.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Bump sharp-edges version to 1.1.0 in marketplace.json
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve code review findings for PR #81
- Add examples column to agent severity classification table
- Add language-specific.md combined quick reference to agent
- Document agent in plugin README.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Refresh trailmark skills for public Trailmark 0.2.x
Aligns all skills with the now-public trailmark package
(pypi.org/project/trailmark, github.com/trailofbits/trailmark):
- Replace hardcoded language tables with runtime detection via
trailmark.parse.detect_languages() and --language auto, so the
skill never goes stale as Trailmark adds languages (21 supported
as of 0.2.x: Python, JS/TS, PHP, Ruby, C/C++, C#, Java, Go, Rust,
Solidity, Cairo, Circom, Haskell, Erlang, Miden Assembly, Swift,
Objective-C, Kotlin, Dart)
- Remove phantom --passes CLI flag from trailmark-structural;
pre-analysis is a QueryEngine.preanalysis() method, not a flag
- Use native trailmark diff --json in graph-evolution alongside the
subgraph-diff helper script
- Add `finding` and `audit_note` annotation kinds to the documented
list (set by augment_sarif / augment_weaudit)
- Document trailmark entrypoints and trailmark augment subcommands
that exist in the public package
- Bump plugin to 0.8.1
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Address Trailmark skill review nits
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* sync skill with claude-code-devcontainer repo
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* devcontainer-setup: apply ruff format and shfmt
The pre-commit hook was failing on these two files in CI: ruff joins
the multi-line f-strings in post_install.py, and shfmt with the repo's
'-i 2 -ci' flags adjusts case-body indentation in install.sh.
No behavior change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* fix(gh-cli): exit 0 when CLAUDE_ENV_FILE is unset in setup-shims.sh
When CLAUDE_ENV_FILE is not set by the runtime, setup-shims.sh exits 1,
causing a SessionStart hook error in Claude Code. This is a graceful
degradation case (shims simply won't be installed), not a fatal error.
The gh-not-found guard on line 10 already exits 0 for the same reason.
This change makes the CLAUDE_ENV_FILE guard consistent.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(gh-cli): update bats test for exit 0 and bump version to 1.4.1
The bats test for the CLAUDE_ENV_FILE-unset guard still expected exit 1.
Update it to match the new graceful-degradation behavior, and bump the
plugin version so clients pick up the fix.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: David Maynor <dmaynor@Davids-MacBook-Air-2.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* let-fate-decide: add missing `import os` to draw_cards.py
The os module was used for path operations but never imported,
causing ruff F821 failures in CI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* remove no import os assertion in test
* specify `uv run --no-config` to potential conflicts with project configs
* bump plugin version
* address remaining PR review comments
Add --no-project to uv run in agents/draw.md for consistency with
SKILL.md, and fix misleading test docstring to reflect the narrower
os.urandom check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* use `--no-config` instead of `--no-project` to ignore config
* broaden card file error handler from FileNotFoundError to OSError
Prevents PermissionError and other OSError subclasses from propagating
to the misleading "failed to read system entropy source" handler in main().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: William Tan <1284324+Ninja3047@users.noreply.github.com>
* add draw agent for let-fate-decide (Haiku, named agent)
Adds agents/draw.md to the let-fate-decide plugin. This
lets callers dispatch tarot draws as a named agent:
Agent(subagent_type="let-fate-decide:draw",
prompt="What portent awaits?")
instead of the current Agent-wrapped-Skill pattern:
Agent(prompt="Call Skill(let-fate-decide, ...)...")
Benefits:
- Runs on Haiku (model: haiku in frontmatter) -- cheaper
than inheriting the parent model for card interpretation
- Card file content stays in agent context, not caller's
- Caches the draw logic across parallel tarot agents
(shared prefix optimization)
- Simplifies dispatch from 4-line prompt to 1-line
The agent does exactly: Bash(draw_cards.py) -> Read(4
card files) -> return 1-2 sentence reading. Falls back
to "fate unavailable" if the script errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* draw agent: --content flag eliminates 4 sequential Read calls
draw_cards.py --content reads card .md files and includes
their text in the JSON output. The draw agent now needs
exactly 1 Bash call (was 1 Bash + 4 sequential Reads).
Saves 4 turns per tarot draw (~8-12 turns per vivisect run).
Haiku was ignoring <use_parallel_tool_calls> and reading
cards one at a time; this bypasses the issue entirely.
Removed Read from agent tools list (no longer needed).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix draw agent script discovery and bump version to 1.1.0
- Replace fragile `find ~/.claude/plugins` with `${CLAUDE_PLUGIN_ROOT}`
- Use context manager for file reads in draw_cards.py
- Bump version to 1.1.0 in plugin.json and marketplace.json
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* feat(trailmark): skills that reason about code as graphs
* Add Codex skill symlinks for trailmark plugin
The trailmark plugin's 10 skills were missing .codex/skills/ mappings,
which caused the validate_codex_skills CI check to fail.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address PR #133 review feedback
- Add Rationalizations (Do Not Skip) sections to 5 security skills:
trailmark, audit-augmentation, crypto-protocol-diagram,
mermaid-to-proverif, graph-evolution
- Fix requires-python: diagram.py >= 3.12 (was 3.13), protocol.py
>= 3.12 (was 3.11) to match trailmark's actual requirement
- Rename diagram/ to diagramming-code/ to match SKILL.md frontmatter
name and all cross-skill references; update Codex symlink
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix diagram skill to use uv run instead of plain python
The diagram.py script carries PEP 723 inline metadata declaring
trailmark as a dependency. Plain python ignores this metadata,
causing ImportError for users who haven't pre-installed trailmark.
uv run processes the metadata and handles dependency resolution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address second round of PR #133 review feedback
- Fix README directory tree: diagram/ -> diagramming-code/
- Fix diagram-types.md: python -> uv run for all script invocations
- Fix graph-evolution Phase 3: replace undefined shell variables
($BEFORE_JSON etc) with template substitutions ({before_json} etc)
- Fix vector-forge mutation-frameworks.md: replace cross-skill file
link with prose reference to genotoxic skill (avoids reference chain)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Local skill-improver review pass across all 10 trailmark skills
diagramming-code:
- Fix arrow syntax inconsistency: uncertain edges use ..-> not -.->
- Fix extra closing paren in diagram-types.md
- Fix diagram.py docstring to match uv run invocation
crypto-protocol-diagram:
- Remove reference chain: spec-parsing-patterns.md no longer links to
mermaid-sequence-syntax.md, inlines the arrow syntax instead
- Fix ProVerif example note: "Tamarin/ProVerif" -> "ProVerif"
trailmark:
- Replace "path/to/project" with {targetDir} in query-patterns.md
- Add uv run prefix to CLI examples in query-patterns.md
- Add circom to supported language list
- Add pre-analysis annotation kinds to annotation docs
genotoxic:
- Remove reference chains: triage-methodology.md and
mutation-frameworks.md no longer link to graph-analysis.md
vector-forge:
- Add trailmark to Prerequisites section
- Fix bare trailmark commands to use uv run with {targetDir}
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address third round of PR #133 review feedback
mermaid-to-proverif:
- Fix ProVerif type error: verify(...) = true is a type mismatch
since verify returns bitstring. Use let _ = verify(...) in instead,
which aborts on destructor failure (correct ProVerif pattern)
trailmark-summary, trailmark-structural:
- Add 8 missing language extensions to find command (.rb, .php, .cs,
.java, .hs, .erl, .cairo, .circom)
- Remove unsupported .lean extension
- Split .c -> --language c and .cpp -> --language cpp (separate parsers)
All 7 security skills:
- Rename "Rationalizations (Do Not Skip)" to "Rationalizations to
Reject" per CLAUDE.md convention
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address fourth round of PR #133 review feedback
mermaid-to-proverif:
- Fix ProVerif type errors in process template: pkey values cannot
appear in bitstring positions. Add pkey2bs() and concat() to the
function declarations and rewrite the template to use them,
matching the sample-output.pv example
trailmark-summary:
- Split .js/.ts mapping: .js -> --language javascript,
.ts -> --language typescript (separate parsers)
graph-evolution:
- Replace bare python with python3 in graph_diff.py invocations
(python does not exist on modern Ubuntu/Debian/macOS)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address fifth round of PR #133 review feedback
graph-evolution:
- Change python3 to uv run for graph_diff.py invocations to match
ecosystem convention
trailmark-structural, trailmark-summary:
- Add Rationalizations to Reject sections (both are security skills
running blast radius, taint, and privilege boundary analysis)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix ProVerif type consistency and graph-evolution template vars
mermaid-to-proverif:
- Rename senc/sdec to aead_enc/aead_dec in Step 3 preamble to match
the process template and sample-output.pv
- Fix hkdf signature: hkdf(key, bitstring): key (first arg is DH
shared secret which has type key, not bitstring)
crypto-to-proverif-mapping.md:
- Fix hkdf declaration and summary table to match corrected signature
- Fix example to use concat/pkey2bs for type-correct HKDF input
graph-evolution:
- Replace $BEFORE_DIR/$AFTER_DIR shell vars in Phase 5 with
{before_dir}/{after_dir} template substitutions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Comprehensive vivisect-style review of all trailmark skills
ProVerif correctness (mermaid-to-proverif):
- Fix broken ForwardSecrecyTest pattern in security-properties.md:
process waited on c_fs but nothing sent on it, past_session_key
was never bound to any session. Replaced with working pattern
that leaks long-term keys and checks session key secrecy.
- Fix hkdf(bitstring,bitstring) -> hkdf(key,bitstring) in
proverif-syntax.md to match SKILL.md and sample-output.pv
- Fix type-incorrect example in proverif-syntax.md: tuple of
(key,pkey,pkey) passed where bitstring expected. Now uses
concat2/pkey2bs for type-correct serialization.
- Align senc/sdec -> aead_enc/aead_dec in proverif-syntax.md and
crypto-to-proverif-mapping.md to match SKILL.md and example
- Fix auth query parameter count in security-properties.md:
beginI fires before session key is known, so has fewer params
Cross-skill consistency:
- Fix 3 stale "diagram skill" references -> "diagramming-code"
in trailmark/SKILL.md and preanalysis-passes.md
- Add PEP 723 header to graph_diff.py for convention consistency
README and helper skills:
- Add trailmark-summary and trailmark-structural to README skills
table and directory tree
- Add secondary file extensions (.jsx, .tsx, .h, .hpp, .cc, .cxx)
to language detection in summary and structural skills
- Inline language mapping in trailmark-structural (was deferred
to trailmark-summary, violating one-level-deep rule)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix ProVerif type consistency and graph-evolution template vars
- Fix endInitiator -> endI in mermaid-to-proverif Step 6 template
(endInitiator was never declared as an event)
- Add missing msg2_label constant to Step 3 constants block
- Add .hh/.hxx C++ header extensions to language detection in
trailmark-summary and trailmark-structural
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix mermaid-to-proverif template: missing beginI event and secrecy witness
Step 6 Initiator template:
- Add missing event beginI(pk(sk_I), pk_R) before first out —
without it, authentication queries always report false attacks
- Replace local new secret_I with free private_I [private] to
match sample-output.pv's secrecy witness pattern
security-properties.md:
- Fix beginI/beginR from 3 args to 2 args in mutual auth section
and query checklist (begin events fire before session key is
known, so they only take the two public keys)
- Update "Placing Events" table to match 2-param form
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Address sixth round of PR #133 review feedback
proverif-syntax.md Two-Party Process example:
- Fix type errors: pkey values passed directly to bitstring params
in sign() and verify(). Now uses concat2(pkey2bs(...)) pattern.
- Add missing pkey2bs declaration to function list
- Add missing info_session constant declaration
- Fix msg2_label -> msg2 in verification check example to match
the file's own constant declarations
trailmark-structural:
- Fix contradiction: Rationalizations table said "Install trailmark
first" but Execution section forbids install commands. Changed
to "Report not installed and return" to match execution policy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* The pre-flight check for plugin-dev only searched sibling directories
and flat plugin paths. When installed via marketplace, plugins live
under ~/.claude/plugins/cache/<marketplace>/plugin-dev/<version>/,
which none of the existing paths matched.
Add glob patterns to search the marketplace cache directory structure.
* add alternative search path for skill-improver since .claude-plugin is stripped when plugins are installed through marketplace
* Bump skill-improver to 1.0.1 and document fallback check
- Bump version in plugin.json and marketplace.json so existing
users receive the cache detection fix
- Document why the agents/skill-reviewer.md fallback exists
(cached marketplace installs strip .claude-plugin/)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add some improvements to semgrep-rule-creator
* Bump second version location
* Use raw GH markdown for docs links
* Fix YAML indentation for by-side-effect in Focus example
The by-side-effect key was at column 3 (same as the list dash),
causing a YAML parse error. Moved to column 5 to be part of the
list item mapping alongside patterns.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix invalid by-side-effect value in taint options example
The pseudo-syntax (true|only) is not valid YAML and is rejected by
semgrep --validate. Use a real value with a comment documenting the
alternative.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Wrap multi-line comment example in inline code backticks
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add missing pattern-sources to taint mode anti-pattern example
Taint mode requires both pattern-sources and pattern-sinks.
Without sources, semgrep --validate rejects the rule.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix review issues: restore {baseDir} paths, improve quick-reference clarity
- Restore {baseDir} in SKILL.md and workflow.md path references per repo convention
- Normalize YAML indentation in focus-metavariable taint example
- Preserve behavioral description in by-side-effect comment
- Rename ambiguous "Operators" section to "Matching Operators"
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Maciej Domanski <maciej.domanski@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* Add hooks to block gh api contents fallback and enforce session-scoped clone paths
Add two new PreToolUse hooks:
- intercept-gh-api-contents: blocks `gh api repos/.../contents/... | base64 -d`
and suggests cloning instead
- intercept-gh-clone-path: denies `gh repo clone` to non-session-scoped temp
paths, enforcing the `$TMPDIR/gh-clones-$CLAUDE_SESSION_ID/` convention
Update existing fetch/curl hooks to warn against the `gh api` contents
anti-pattern in their denial messages. Update skill docs and references to
discourage base64-decoding file contents via the API.
Bump version 1.3.0 → 1.6.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Replace regex-based PreToolUse hooks with a gh PATH shim
Swap intercept-gh-api-contents.sh and intercept-gh-clone-path.sh
(regex-matched PreToolUse hooks) for a single shims/gh wrapper
prepended to PATH via a SessionStart hook. The shim receives
properly tokenized $@ args, eliminating the class of regex bypass
bugs identified in PR review (subshell, @base64d, compound command
gaps). All /contents/ API access is now blocked unconditionally.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix gh shim clone bypass, exec error handling, and docs accuracy
- Replace hardcoded $4 clone target with arg iteration to prevent
flag-based bypass (e.g., -u upstream owner/repo /tmp/bad-path)
- Handle exec failure on real gh binary with error message and exit 126
- Add diagnostic message when gh not found on PATH in setup-shims.sh
- Add error handling for CLAUDE_ENV_FILE write failure
- Replace blocked gh api contents example in SKILL.md Quick Start
- Fix incorrect --branch <sha> docs (git clone --branch requires a
branch/tag name, not a commit SHA)
- Rename misleading "exits silently" test names to "exits gracefully"
- Add test for clone bypass with flags before target path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix review findings: dead exec handler, inaccurate docs, add tests
Remove unreachable || block after exec in the gh shim (dead code
since exec replaces the process). Fix shallow clone + SHA checkout
guidance to note --depth 1 must be omitted. Qualify README passthrough
list to account for shim interceptions. Improve anti-pattern docs
and api.md Headers section. Add 4 tests: bare gh passthrough, tmp
substring path, session-scoped /var/folders/, missing shims dir.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Address PR review: shim executable check, tests, comment/doc accuracy
- Validate shims/gh is executable in setup-shims.sh before writing PATH
- Add tests: API contents with query params, long-form flags before clone
target, non-executable shim file
- Fix README "silently pass through" wording
- Clarify shim comment on flag-value scanning behavior
- Rename test for clarity on flag-preceding-target behavior
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Remove using-gh-cli skill, keep hooks-only enforcement
The skill rarely triggered (~0-11% recall across eval runs) because
Claude's system prompt already includes gh CLI instructions. The hooks
(WebFetch/curl interception, gh shim, clone cleanup) enforce the
critical behaviors regardless of skill triggering, making the skill
redundant.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix CI: marketplace description mismatch, shellcheck, bats test
- Sync marketplace.json description with plugin.json
- Add shellcheck disable directives for bats subshell warnings
- Use absolute bash path in setup-shims test to handle PATH filtering
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Remove skill reference from gh-cli README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix curl hook circular suggestion, shim false positives, and session ID diagnostic
- Curl hook: add api.github.com/repos/.../contents/ branch before
generic catch-all so it suggests clone instead of gh api (which the
shim would then block)
- Shim: anchor /contents/ regex to ^repos/ and skip flags so jq filter
values don't cause false positives
- Shim: emit specific diagnostic when CLAUDE_SESSION_ID is unset
instead of a self-contradicting suggestion
- Curl hook: remove redundant gh/git early exits so compound commands
like "curl github.com/... && gh version" are correctly denied
- Tests: add coverage for all three fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add error handling for shim exec failure and session ID persistence
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix review issues: exec dead code, leading-slash bypass, exit codes, fetch contents gap
- Fix exec failure handler in gh shim: disable set -e around exec so
the error message is actually reachable, use resolved path consistently
- Handle leading-slash API endpoints (gh api /repos/.../contents/...)
by changing regex from ^repos/ to ^/?repos/
- Exit 1 (not 0) when CLAUDE_ENV_FILE is missing in setup-shims.sh,
since this is a runtime contract violation, not graceful degradation
- Add /contents/ branch to fetch hook for api.github.com URLs so
WebFetch to api.github.com/repos/.../contents/ gets the clone
suggestion instead of the generic gh api suggestion
- Add tests for all fixes (leading slash, /private/tmp session path,
CLAUDE_ENV_FILE exit code, fetch contents endpoint)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* Replace third-party codex-mcp-server with Codex CLI's built-in MCP server
Swap `uvx codex-mcp-server` (third-party Python package) for `codex mcp-server`
(built-in to the Codex CLI). Eliminates the Python/uvx dependency and uses
OpenAI's officially maintained MCP server instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Gitignore uv.lock at repo root
No root pyproject.toml exists — the lockfile is a stale artifact from
an accidental uv invocation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix stale references to third-party codex-mcp-server
Update root README table and .gitignore comment to reflect the switch
to Codex CLI's built-in MCP server.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* static-analysis selects all or important queries
* make semgrep/codeql better
* semgrep/codeql - descriptions
* semgrep - workflow plugin improvements
* semgrep - workflow plugin improvements 2
* codeql - workflow plugin improvements
* codeql - workflow plugin improvements 2
* output dir and artifacts more precise handling, better db discovery
* Fix review issues: grep -P on macOS, LANG collision, stale triage refs, error handling
- Replace grep -oP with sed in macOS arm64e workaround (BSD grep lacks -P)
- Rename LANG to CODEQL_LANG across all CodeQL files to avoid POSIX locale collision
- Remove stale triage description from semgrep-scanner agent
- Rename merge_triaged_sarif.py to merge_sarif.py and update all references
- Restore {baseDir} in semgrep-scanner agent and sarif-parsing skill paths
- Fix quoted heredoc in scan-workflow.md preventing $(date) expansion
- Fix suite file location ($RESULTS_DIR -> $RAW_DIR) to match workflow
- Quote $OUTPUT_DIR in extension-yaml-format.md cp commands
- Add SARIF ruleIndex portability note for non-CodeQL tools
- Split CodeQL install check into separate command -v and --version steps
- Add semgrep install check before Pro detection in scan-workflow
- Add rm -rf guards in scanner agent and task prompt
- Narrow OSError catch in merge script with specific exception types
- Track and report skipped files in pure Python SARIF merge
- Add variable guards (${CODEQL_LANG:?}) in suite generation scripts
- Separate neutralModel into own section with column definition
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Iterative fix-review loop that automatically refines Claude Code skills
until they meet quality standards. Uses the plugin-dev:skill-reviewer
agent for automated review cycles with a stop hook to continue the loop.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Import four plugins from skills-internal and clean up README
Import seatbelt-sandboxer, supply-chain-risk-auditor, zeroize-audit,
and let-fate-decide from skills-internal. Remove dead humanizer and
skill-extractor directories. Fold "About Trail of Bits" into the
license line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix CI: shellcheck SC2317 and let-fate-decide description mismatch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Import agentic-actions-auditor from skills-internal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix review issues across 5 imported plugins
- Fix empty array expansion crash under set -u on macOS bash 3.2
(emit_rust_mir.sh, emit_asm.sh, emit_ir.sh)
- Fix copy-paste error in seatbelt-sandboxer README ("variant analysis")
- Remove references to non-existent leak-hunter skill
- Update agentic-actions-auditor license to match repo CC-BY-SA-4.0
- Add PEP 723 metadata to check_rust_asm_{aarch64,x86}.py
- Replace unsafe xargs trim with parameter expansion in track_dataflow.sh
- Add json_escape function to analyze_asm.sh, analyze_heap.sh,
track_dataflow.sh for safe JSON construction with backslashes
- Add allowed-tools frontmatter to seatbelt-sandboxer and
supply-chain-risk-auditor SKILL.md
- Add minimum finding count assertions to run_smoke.sh
- Fix double period typo in supply-chain-risk-auditor SKILL.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
codex-review-schema.json failed OpenAI structured output validation
because required arrays didn't include all sibling property keys when
additionalProperties: false was set. Made optional fields nullable
and added them to required to satisfy the constraint.
Update Gemini model from gemini-3-pro-preview to gemini-3.1-pro-preview
following the Feb 19 release.
Bump version 1.5.0 → 1.5.1.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: escape raw substitution patterns in workflow-skill-design
The skill loader preprocesses $ARGUMENTS, $N, ${CLAUDE_SESSION_ID},
and !`command` patterns before Claude sees the file. The SKILL.md and
tool-assignment-guide.md documented these using the raw syntax, causing
shell preprocessing to attempt execution of "command" and dollar
variables to silently resolve to empty strings.
Replace raw patterns with textual descriptions and add a caution note
warning skill authors about this pitfall.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: version bump and clarify substitution docs
- Bump version to 1.0.1 in plugin.json and marketplace.json
- Replace invented pseudo-syntax (DOLLAR-ARGUMENTS) with natural
descriptions (a dollar sign followed by ARGUMENTS)
- Clarify shell preprocessing example with proper sentence structure
- Warn that code fences do not prevent substitution processing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add .mcp.json to auto-start the codex-mcp-server when the plugin is
installed, providing codex_ask, codex_exec, and codex_review MCP tools.
The MCP tool descriptions are self-documenting — no separate skill
docs needed. Bump version to 1.5.0.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add workflow-skill-design plugin
Adds a plugin that teaches design patterns for workflow-based Claude Code
skills, including a skill with reference docs, workflow guides, and a
review agent for auditing existing skills.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix gaps in workflow-skill-design plugin and update CLAUDE.md URLs
Update CLAUDE.md doc links from docs.anthropic.com to code.claude.com.
Add frontmatter reference table, string substitutions, context:fork
guidance, and LSP Server row to tool-assignment-guide.md. Expand
SKILL.md frontmatter skeleton with optional fields, add substitutions
note, and renumber anti-pattern table to match anti-patterns.md AP-N
numbering. Add TodoWrite phase tracking to reviewer agent.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add research-driven improvements to workflow-skill-design plugin
Add AP-20 (description summarizes workflow) anti-pattern from
superpowers/writing-skills tested failure, degrees-of-freedom
principle from Anthropic best practices, feedback loop guidance
for iterative validation, and new reference links to CLAUDE.md.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* Fix culture-index SKILL.md standards compliance
- Switch description to third-person voice, remove "PDF vision" mention
that contradicts body's prohibition on visual estimation
- Add allowed-tools to frontmatter (Bash, Read, Grep, Glob, Write)
- Add required "When to Use" and "When NOT to Use" sections
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Bump culture-index version to 1.1.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Switch second-opinion Codex path from codex review to codex exec
Use codex exec with --output-schema and -o (--output-last-message)
instead of codex review. This eliminates context waste from verbose
[thinking] and [exec] blocks by capturing only the structured JSON
review output to a file. Uses OpenAI's published code review prompt
that GPT-5.2-codex was specifically trained on.
Also lowers default reasoning from xhigh to high, removes the
--base/--commit prompt limitation (all scopes now support project
context and focus instructions), and adds a JSON schema for
structured findings output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix review issues: untracked files, hardcoded paths, schema naming
- Include untracked files in uncommitted scope diff using
git ls-files + git diff --no-index, matching the coverage
that codex review --uncommitted previously provided
- Replace hardcoded /tmp/ paths with mktemp for portability
- Rename absolute_file_path to file_path in schema since
git diff produces relative paths
- Capture stderr to a log file instead of /dev/null for
faster error diagnosis without retry
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix PR review findings: schema constraints, flag naming, citation
- Add required and additionalProperties: false to JSON schema
- Use -o (short flag) consistently; clarify --output-last-message
- Add cookbook citation URL for the code review prompt
- Add || true to git diff --no-index (exits 1 on diff found)
- Fix schema.json → codex-review-schema.json in SKILL.md quick ref
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Restore xhigh reasoning effort, fix cookbook citation URL
- Change reasoning effort back to xhigh from high
- Update cookbook URL to canonical developers.openai.com domain
(old cookbook.openai.com returns 308 redirect)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The Gemini `/security:scan-deps` command scans the entire project
dependency tree regardless of what changed. This wastes time when
reviewing small config or code changes that don't involve dependencies.
Now the scan only runs when the diff actually touches manifest files
(package.json, Gemfile, requirements.txt, Cargo.toml, go.mod, etc.).
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add spec-compliance-checker agent to spec-to-code-compliance plugin
Introduces a formal agent definition for the full specification-to-code
compliance workflow. Updates SKILL.md to reference agent and bumps
version to 1.1.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix {baseDir} paths and bump marketplace.json version
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve code review findings for PR #82
- Normalize double hyphens to em dashes in agent rationalizations table
for consistency with SKILL.md formatting conventions
- Add invocation example to SKILL.md Agent section
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add function-analyzer agent to audit-context-building plugin
Introduces a formal agent definition for ultra-granular per-function
analysis. Updates SKILL.md Section 8 to reference agent and bumps
version to 1.1.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix {baseDir} paths and bump marketplace.json version
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve code review findings for PR #83
- Wrap long SKILL.md line (239 chars -> multi-line) for readability
- Trim verbose agent description frontmatter
- Add "When NOT to Use" section to agent file per project standards
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* use PATH shim override technique instead of hooking every pre tool usage
* remove unecessary check
* fix: resolve code review findings for PR #89
P1 fixes:
- setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque
'unbound variable' crash when env var is unset (matches
gh-cli plugin pattern)
P2 fixes:
- setup-shims.sh: Guard shims_dir resolution failure to prevent
empty PATH prefix on partial installs
- shims/uv: Fix shfmt formatting (here-string spacing)
- shims/uv: Resolve PATH entries before comparison to prevent
exec loop with symlinked/unnormalized paths
- shims/uv: Use ${PATH:-} to handle unset PATH defensively
- setup-shims.bats: Add test for unset CLAUDE_ENV_FILE
- uv-shim.bats: Add test for 'real uv not found' error path
P3 dismissed:
- CI linting gap for extensionless shim scripts: accepted as-is
since shims must masquerade as real binaries (no .sh extension);
manual review covers these files
- Unset PATH in uv shim: addressed by ${PATH:-} fix above
All 27 bats tests pass. shellcheck and shfmt clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* improve gh hook to prefer cloning repo instead of using api to fetch files
This should make finding stuff way more efficient
Repos are saved to a per claude session directory and cleaned up at the end of the session
* fix formatting
* fix: resolve code review findings for PR #88
P1 (CI-blocking):
- Fix shell formatting: convert tabs to 2-space indent per project
shfmt config (shfmt -i 2 -ci). The prior "fix formatting" commit
used default shfmt settings (tabs) instead of project settings.
P2 (important):
- Add ${TMPDIR:-/tmp} fallback in suggestion strings across both
intercept hooks. Without the fallback, $TMPDIR expands to empty
on Linux systems where it's unset, producing paths at filesystem
root.
- Add session_id format validation in persist-session-id.sh and
cleanup-clones.sh to prevent shell injection via malformed input.
Session IDs are now required to match ^[a-zA-Z0-9_-]+$.
- Add stderr warning in persist-session-id.sh when CLAUDE_ENV_FILE
is unset, since the entire clone workflow silently breaks without
it (CLAUDE_SESSION_ID never gets defined).
- Remove 2>/dev/null from rm -rf in cleanup-clones.sh and add
directory existence check. The stderr suppression hid real
failures like permission errors. Add justification comment for
rm -rf per project conventions.
- Add missing test for tree/ URL pattern in fetch hook.
- Add bats tests for persist-session-id.sh and cleanup-clones.sh
covering: invalid JSON, empty session_id, shell metacharacter
rejection, CLAUDE_ENV_FILE behavior, actual directory cleanup.
- Add test for gist.github.com in curl hook.
- Add test verifying clone suggestions include CLAUDE_SESSION_ID
and --depth 1.
P3 (nice to have):
- Add test for github.com/settings allow path (site pages).
- Strip query strings and fragment identifiers from URLs before
parsing in fetch hook to handle edge cases like
github.com/owner/repo?tab=issues.
Dismissed findings:
- P3 #8 (version jump 1.0.0→1.3.0): Author's choice, not a bug.
- P4 #13 (missing gh silently disables plugin): Intentional design
— a broken hook should not block user operations.
- P4 #14 (loose test assertions): Addressed partially with new
CLAUDE_SESSION_ID/--depth 1 assertion; full template validation
would add test fragility without proportional value.
All 75 bats tests pass. shellcheck and shfmt clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Gemini heredoc patterns that prevent variable expansion
Single-quoted heredoc delimiters (<<'PROMPT') suppress shell
substitution, so $(cat /tmp/review-diff.txt) was passed to
Gemini as literal text. Replaced all heredoc patterns with
pipe-based construction ({ printf ...; cat ...; } | gemini)
which avoids both the quoting bug and shell metacharacter
issues from unquoted heredocs (diffs contain $ and backticks).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Bump second-opinion version in marketplace.json to match plugin.json
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Clarify marketplace.json path in CLAUDE.md PR checklist
The checklist said `.claude-plugin/marketplace.json` which is
ambiguous — every plugin has its own `.claude-plugin/` directory.
Specify that the marketplace.json is at the repo root, distinct
from each plugin's `.claude-plugin/plugin.json`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add semgrep-scanner and semgrep-triager agents to static-analysis plugin
Introduces formal agent definitions for the scanning and triage
workflows. Updates SKILL.md to reference agents and bumps version
to 1.1.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix {baseDir} paths and bump marketplace.json version
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve code review findings for PR #80
- Update scanner-task-prompt.md to reference semgrep-scanner subagent
type instead of Bash (consistent with SKILL.md Step 4 change)
- Update triage-task-prompt.md to reference semgrep-triager subagent
type instead of general-purpose (consistent with SKILL.md Step 5 change)
- Add Agents Included section to README.md documenting new agents
- Fix Agents table column header in SKILL.md from "Type" to "Tools"
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use fully-qualified agent type names for semgrep subagents
Plugin agents require the `plugin-name:agent-name` format at runtime,
but the skill referenced bare names (`semgrep-scanner`, `semgrep-triager`)
causing "Agent type not found" errors when spawning scan/triage Tasks.
Also adds agent types to the Step 3 plan template and pre-scan checklist
so they appear in generated plans and survive context clearing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Explicit semgrep scan allow
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: axelm-tob <axel.mierczuk@trailofbits.com>
* better ci validations, fix marketplace error
* fix lints
* fix lint script
* fix lint script2
* fix ruff errors
* fix abs path regex
* fix shellcheck lint
* fix: resolve code review findings for PR #85
- Remove dead CHANGED_FILES code path (unreachable in CI)
- Add version and description consistency checks between plugin.json
and marketplace.json
- Eliminate duplicate plugin.json reads via parse_plugin_json()
- Fix bats test discovery for filenames with spaces (print0/xargs -0)
- Sync marketplace.json with plugin.json for 5 pre-existing mismatches
(second-opinion version, ask-questions/burpsuite/fix-review/insecure-defaults descriptions)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: gh-cli bats tests fail when gh is in /usr/bin
The _no_gh test helpers used PATH=/usr/bin:/bin to exclude gh, but
on Ubuntu CI runners gh is installed at /usr/bin/gh. Fix by creating
a temp directory with symlinks to only jq and bash.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: improve plugin descriptions for better skill triggering
- ask-questions-if-underspecified: restore trigger context ("asking
questions") while keeping invocation constraint
- burpsuite-project-parser: drop filler "directly from the command
line", use outcome-oriented "for security analysis"
- insecure-defaults: restore specific scenarios (hardcoded credentials,
fallback secrets, weak auth defaults) for better matching
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Remove fix-review plugin (moved to skills-internal)
This plugin is only useful for internal audit workflows and was
added to the public repo by mistake.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Remove empty Audit Lifecycle section from README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add git-cleanup skill
Safely clean up accumulated git worktrees and local branches with a
gated confirmation workflow. Categorizes branches as merged, stale,
or active, and requires explicit user confirmation before any deletions.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: resolve code review findings for PR #77
- Shorten description to focus on function, remove invocation rules
- Remove undocumented `invoke: user` frontmatter field
- Add Read and Grep to allowed-tools
- Quote all $branch variables in bash snippets to prevent injection
- Add programmatic protected branch filtering (main/master/develop/release/*)
- Use $default_branch variable consistently instead of hardcoded 'main'
- Tighten SUPERSEDED criteria to require merge evidence, not just shared prefix
- Replace chained && execution with individual commands for partial failure handling
- Remove duplicated Anti-Patterns, Commands Reference, and Example Session sections
- Add non-interactive automation note to When NOT to Use
- Add release/* to README protected branches list
- Sync descriptions across plugin.json, marketplace.json, and SKILL.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add missing CODEOWNERS entries and require explicit invocation for git-cleanup
- Add 7 missing CODEOWNERS entries (claude-in-chrome-troubleshooting,
culture-index, devcontainer-setup, fix-review, git-cleanup, sharp-edges,
yara-authoring) and fix alphabetical ordering
- Set disable-model-invocation: true on git-cleanup skill so it only
runs when explicitly requested by the user
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* Add hook for gh-cli
This should prevent claude code from wasting cycles trying to fetch from
Github which will not work 90% of the time.
* Add guidance for claude for updating CODEOWNERS
* update codeowners
* fix: resolve code review findings for PR #78
- Add actions and gist endpoint handling to curl hook (parity with fetch hook)
- Skip non-repo github.com paths (settings, notifications, login) in fetch hook
- Move gh-cli entry to correct alphabetical position in marketplace.json
- Fix stale "prefer-gh-cli" name in test_helper.bash comment
- Remove unused Grep from SKILL.md allowed-tools
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: improve agent self-correction suggestions for PR #78
Add specific pattern matching for github.com PR, issue, release-download,
and tree URLs so the deny message suggests the exact correct gh command
(e.g., `gh pr view 78 --repo owner/repo`) instead of the generic
`gh repo view owner/repo` catch-all. Also add releases/download pattern
to the curl hook.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds references/interpreting-failures.md with guidance on analyzing
PBT failures: self-reflection workflow, property grounding checklist,
failure classification, and bug report template. Based on insights
from Anthropic's red team research on AI-driven property-based testing.
Updates SKILL.md decision tree and generating.md with cross-references.
Adds "Rationalizations to Reject" section per project guidelines.
Bumps version to 1.1.0.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Add debug-buttercup skill
* Fix debug-buttercup skill gaps found in PR #73 review
- Add missing services to table (registry-cache, scratch-cleaner,
pov-reproducer, competition-api, ui) and frontmatter description
- Add orchestrator_delete_task_queue to queue table, diagnose.sh, and
failure-patterns.md queue loop
- Add OpenTelemetry/Signoz telemetry debugging section
- Add kubectl availability check and configurable namespace to diagnose.sh
- Complete failure-patterns.md queue loop from 7 to all 13 queues
- Rename README category from "Trail of Bits Tools" to "Infrastructure"
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add devcontainer-setup plugin for Claude Code development environments
Creates pre-configured devcontainers with Claude Code and language-specific
tooling. Supports Python, Node/TypeScript, Rust, and Go projects with
automatic detection and configuration.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add plugin to marketplace list
* Fix the post install command
* Fix YARN installation
* Install fzf from GitHub and add plugin marketplaces
- Install fzf from GitHub releases instead of apt (Ubuntu 24.04's apt
version lacks shell integration)
- Add Claude plugin marketplace setup for anthropics/skills and
trailofbits/skills in post_install.py
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix linting issues in devcontainer-setup plugin
- Use contextlib.suppress instead of try-except-pass (SIM105)
- Fix case statement indentation in install.sh for shfmt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Exclude /home/vscode from hardcoded path check
Standard devcontainer user path should not be flagged as a
personal hardcoded path.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Sync devcontainer-setup with upstream claude-code-devcontainer
Sync resources with https://github.com/trailofbits/claude-code-devcontainer:
- Add Python 3.13 via uv and Node 22 via fnm to base Dockerfile
- Add ast-grep for AST-based code search
- Include network isolation tools (iptables, ipset) by default
- Add Tailscale feature for secure networking
- Add NPM security settings (ignore-scripts, 24-hour release delay)
- Add init: true and updateRemoteUserUID: true to devcontainer.json
- Expand .zshrc with fnm integration, fzf config, and more aliases
- Update post_install.py to print to stderr and add ghostty terminal features
- Integrate delta config into .gitconfig.local
- Move marketplace plugin installation from post_install.py to Dockerfile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Sync devcontainer-setup resources with upstream
Align with https://github.com/trailofbits/claude-code-devcontainer:
- Move PATH env before Claude install
- Remove -p fzf from Oh My Zsh, download fzf shell integration separately
- Add FZF_VERSION arg for shell integration download
- Use uv run --no-project for post_install.py
- Add fzf sourcing to .zshrc
- Add symlink resolution and update command to install.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Address PR review comments and sync with upstream devcontainer
DarkaMaul's review comments:
- Restore SHA256 hash on base image for reproducibility
- Sort apt packages alphabetically within category groups
- Install fzf from GitHub releases (v0.67.0) instead of old apt package
- Remove Tailscale feature (not generic enough for template)
Upstream sync (3 new commits from claude-code-devcontainer):
- Add bubblewrap and socat for Claude Code sandboxing
- Add exec, upgrade, and mount commands to devc CLI
- Mount .devcontainer/ read-only to prevent container escape on rebuild
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Harden devcontainer templates from multi-agent review findings
- Pin uv to 0.10.0 with SHA256 digest (supply chain security)
- Add SYS_ADMIN capability guard to install.sh (prevents defeating
read-only .devcontainer mount)
- Fix mount filter to use target paths instead of source prefixes
(was broken when PROJECT_SLUG was substituted)
- Fix temp file leak in extract_mounts_to_file
- Remove claude-yolo alias (unsafe pattern for a template)
- Remove dead POWERLEVEL9K_DISABLE_GITSTATUS and NODE_OPTIONS configs
- Remove unnecessary terminal profile definitions
- Default timezone to UTC instead of America/New_York
- Remove stale Tailscale reference from SKILL.md
- Fix line length violations throughout install.sh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Restore claude-yolo alias and POWERLEVEL9K_DISABLE_GITSTATUS
The claude-yolo alias is intentional for devcontainer use.
POWERLEVEL9K_DISABLE_GITSTATUS is needed because zsh-in-docker
installs Powerlevel10k, whose gitstatus can be slow in large repos.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Restore NODE_OPTIONS, terminal profiles, and re-clone URL
NODE_OPTIONS 4GB heap is intentional for Claude Code in containers.
Terminal profiles are useful in VS Code dropdown. Re-clone message
needs the full URL to be actionable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
jonnydevs