* feat(codex): add skill UI metadata
* Use official Trail of Bits logo
* fix: resolve code review findings for PR #175
Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.
P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
all 38 plugins with skills and point every openai.yaml at
../../assets/trail-of-bits-mark.svg (the supported plugin-level
shared asset pattern). Icons now resolve for marketplace
installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
openai.yaml resolved nowhere (.codex/skills is not a Codex
discovery root) and PR #173 removes the whole .codex/ tree
P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
marketplace.json so installed clients pick up the metadata
Verified:
- Static check replicating Codex's resolution algorithm: all 73
yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
resolved iconSmall/iconLarge and brand_color #D83A34
(claude-in-chrome-troubleshooting fails to load on main due to
a pre-existing 64-char qualified-name limit, fixed by #173's
rename; zeroize-audit's manifest mcpServers object is likewise
a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
pass
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(codex): use skill-local icon assets
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Remove legacy codex compatiblity scripts/shims.
Codex supports claude plugins so this shouldn't be necessary.
Add a script to test the plugin loadablility in both claude and codex
* fix: resolve code review findings for PR #173
Review findings addressed (4 reviewers: pr-review-toolkit agents,
Codex gpt-5.3-codex, direct diff review):
P2 fixed:
- Bump versions for the 5 substantively changed plugins in both
plugin.json and marketplace.json (gh-cli 1.5.0 new skill,
claude-in-chrome-troubleshooting 1.1.0 skill rename,
modern-python 1.5.1 / skill-improver 1.0.3 hooks change,
zeroize-audit 0.1.1 MCP config relocation) so clients pick up
the changes
- README Codex install: replace unpasteable /plugins slash-command
block with verified CLI syntax (codex plugin marketplace add)
- check_claude_loadability: parse_json_output now fails fast with
command context on empty CLI output instead of returning None
- check_codex_loadability: surface skipped RPC error messages in
timeout failures instead of a bare TimeoutError
P3 fixed:
- Both checkers: error out when marketplace.json lists no plugins
instead of passing vacuously
Dismissed:
- @latest CLI installs in validate.yml: deliberate; the check
validates against the clients users actually run
- select.select portability: CI-only script on ubuntu-latest
- Divergent mcpServers validation between checkers: intentional;
the Codex checker enforces the repo's .mcp.json convention
Verified: ruff, prek, validate_plugin_metadata.py, and both
loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP
servers load in Claude Code and Codex)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* use PATH shim override technique instead of hooking every pre tool usage
* remove unecessary check
* fix: resolve code review findings for PR #89
P1 fixes:
- setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque
'unbound variable' crash when env var is unset (matches
gh-cli plugin pattern)
P2 fixes:
- setup-shims.sh: Guard shims_dir resolution failure to prevent
empty PATH prefix on partial installs
- shims/uv: Fix shfmt formatting (here-string spacing)
- shims/uv: Resolve PATH entries before comparison to prevent
exec loop with symlinked/unnormalized paths
- shims/uv: Use ${PATH:-} to handle unset PATH defensively
- setup-shims.bats: Add test for unset CLAUDE_ENV_FILE
- uv-shim.bats: Add test for 'real uv not found' error path
P3 dismissed:
- CI linting gap for extensionless shim scripts: accepted as-is
since shims must masquerade as real binaries (no .sh extension);
manual review covers these files
- Unset PATH in uv shim: addressed by ${PATH:-} fix above
All 27 bats tests pass. shellcheck and shfmt clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* update version numbers of any plugins with updates and a note about doing this for future claudes
* update more plugins versions and sync with marketplace
* claude.md update
- Tighten frontmatter description to name specific tools (uv, ruff, ty)
and migration triggers (pip/Poetry/mypy/black) for better matching
- Document UV_PROJECT_ENVIRONMENT variable for container/host workflows
- Add Container/Host Development section explaining separate venv usage
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
pytest now fully supports [tool.pytest] in pyproject.toml, making
the legacy [tool.pytest.ini_options] section unnecessary. Also
converts the string-form addopts in SKILL.md to a proper TOML array.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Add BATS test suite for intercept-legacy-python hook
- Add 64 tests covering all code paths: early exits, allow cases
(uv run, diagnostics, search tools), deny cases (python/pip
execution, uv pip, piped commands, compound commands)
- Add test_helper.bash with run_hook, assert_allow, assert_deny,
and assert_suggestion_contains helpers
- Add bats job to CI workflow
- Fix hook to properly detect python execution in piped commands
like `python script.py | grep foo` and `find . | xargs python`
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix CI failures in hook test suite
- Suppress jq stderr in run_hook_no_uv to avoid "Broken pipe" error
when hook script exits early due to missing uv
- Fix shfmt formatting: remove trailing backslash, single space before
inline comments
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Add hook to modern-python to intercept python3 and pip calls
Uses tree-sitter-bash parse the AST for more robust hooking
* Fix ruff line-length lint in intercept-legacy-python hook
Run ruff format to properly break long lines into multi-line tuples.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Rewrite legacy Python hook in shell for performance
Replace tree-sitter-based Python implementation with a shell script
using jq and regex patterns. This eliminates the overhead of spawning
Python and loading tree-sitter on every Bash command.
- Use jq for JSON parsing (fast, commonly available)
- Regex-based pattern matching for python/pip commands
- Allow uv run commands to pass through
- Context-aware suggestions based on subcommand
- Passes shellcheck validation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Allow diagnostic commands and simplify error message
- Skip `which`, `type`, `whereis`, `command -v` for python/pip
- Simplify denial message (Claude already knows uv commands)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Allow search tools through legacy Python hook
Add allowlist for grep, rg, ag, ack, find to prevent false positives
when searching for "python" or "pip" as text patterns. Also normalize
character class ordering for consistency with other patterns.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix shfmt formatting (2-space indent)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add hook development guidance to CLAUDE.md
Document design lessons from PR #40's Python-to-shell rewrite:
- Performance: prefer shell+jq over Python with dependencies
- Simplicity: accept false positives when performance gain is worth it
- False positive awareness: diagnostic commands, search tools, filenames
- Explicit tradeoff documentation in PR descriptions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Refine CLAUDE.md formatting for consistent density
Remove section breaks (horizontal rules) between major sections and
condense the Hooks section from verbose multi-paragraph format into
a unified list while preserving all guidance.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* Align prek auto-update cooldown to 7 days
Update the recommended --cooldown-days value from 3 to 7 to match
the project's CLAUDE.md standard. A 7-day cooldown provides a
reasonable window for the community to detect compromised releases.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Update modern-python for ruff and ty compatibility
- Remove deprecated ANN101/ANN102 rules (removed in ruff 0.8.0)
- Fix ty config section: tool.ty → tool.ty.terminal
- Fix ty rule name: possibly-unbound → possibly-unresolved-reference
- Update SKILL.md ignore list to match reference docs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Rewrite "When to Use" with specific, outcome-focused triggers
- Add security tools section (shellcheck, detect-secrets, actionlint, zizmor, pip-audit, Dependabot)
- Add prek and ty to core tools
- Group into Core Tools, Security Tools, and Standards sections
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Consolidate modern-python security documentation
Security content was fragmented across prek.md, migration-checklist.md,
and SKILL.md with no clear entry point. Users had to hunt across files
to understand security setup.
Changes:
- Add references/security-setup.md as single source of truth for all 6
security tools (shellcheck, detect-secrets, actionlint, zizmor,
pip-audit, Dependabot)
- Add Security Tools subsection to SKILL.md tool overview
- Simplify migration-checklist.md security items with links
- Add cross-references from prek.md to security-setup.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix pip-audit command and add installation instructions
- Fix pip-audit command: use `. ` (project path) instead of
`--requirement pyproject.toml` which expects requirements.txt format
- Add Tool Installation section with brew, uv, and alternative methods
- Remove duplicate prek configuration (already documented in prek.md)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add templates and improve security docs organization
- Create templates/ with copy-paste-ready pre-commit and dependabot configs
- Move Tool Installation before Quick Setup in security-setup.md
- Consolidate prek installation into security-setup.md
- Fix detect-secrets to use --report (non-interactive)
- Replace inline dependabot config with template reference
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix PR review issues: remove ty hook, update dependabot docs
- Remove ty pre-commit hook (no official hook exists yet, astral-sh/ty#269)
- Update dependabot.md to reference template instead of inline YAML
- Fix pip-audit CI command to use project scanning (uv run pip-audit .)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add migration-checklist.md for gradual adoption of strict typing
- Bump minimum Python from 3.10 to 3.11 throughout
- Fix ty.rules in Full Project Setup to be strict from day 1
(migration guidance now lives in migration-checklist.md)
- Use [tool.ty.environment] for python-version (correct syntax)
- Add pip-audit to dependency groups for supply chain security
- Update references with clearer examples
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* add modern python best practices skill
* update README and update markeplace metadata
* make description more direct and shorter
* update description
* Update plugins/modern-python/skills/modern-python/SKILL.md
Co-authored-by: dm <darkamaul@hotmail.fr>
* Reorganize reference files and fix issues
- Move reference files to references/ directory per CLAUDE.md convention
- Update all links in SKILL.md to point to new paths
- Fix typo: closing code fence had extra dot character
- Add version pinning notes in prek.md with links to release pages
- Update ty version from 0.0.12 to 0.0.13
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix review feedback: typos, fragile command, SHA pinning
- Fix "Trail Of Bits" → "Trail of Bits" and "boostrap" → "bootstrap"
- Replace fragile shell one-liner for requirements.txt migration with
robust while-read loop that handles version specifiers properly
- Pin GitHub Actions to SHA with version comments:
- actions/checkout@v6.0.1
- j178/prek-action@v1.0.12
- codecov/codecov-action@v5.5.2
- Update uv_build version constraint to >=0.9,<1 to prefer latest
- Add note about preferring open version constraints for rapidly
evolving tools
- Fix prek description to be factual rather than marketing copy
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add Dependabot configuration with 7-day cooldown
Adds recommended .github/dependabot.yml configuration for:
- Python (pip) dependencies
- GitHub Actions
Includes cooldown.default-days: 7 for supply chain protection,
which delays updates for newly published versions to allow time
for community detection of compromised packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Replace hardcoded versions with <latest> placeholders
Add release URLs as comments so Claude looks up current versions
when using the skill instead of using stale training data.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Extract Dependabot configuration to separate reference file
Move Dependabot content from prek.md to dedicated dependabot.md
for better organization and discoverability.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add [tool.ty.rules] configuration example
Show how to configure individual rule severities for stricter
type checking, including possibly-unbound, possibly-unresolved-reference,
and unused-ignore-comment.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Address review feedback: fix section titles and Makefile scope
- prek.md: Remove lint/format targets from Makefile (not prek-specific)
- pep723-scripts.md: Rename "Optional Dependencies" → "Private Package Index"
to match the actual content (extra-index-url configuration)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: dm <darkamaul@hotmail.fr>
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Lixin2026