* feat(codex): add skill UI metadata
* Use official Trail of Bits logo
* fix: resolve code review findings for PR #175
Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.
P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
all 38 plugins with skills and point every openai.yaml at
../../assets/trail-of-bits-mark.svg (the supported plugin-level
shared asset pattern). Icons now resolve for marketplace
installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
openai.yaml resolved nowhere (.codex/skills is not a Codex
discovery root) and PR #173 removes the whole .codex/ tree
P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
marketplace.json so installed clients pick up the metadata
Verified:
- Static check replicating Codex's resolution algorithm: all 73
yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
resolved iconSmall/iconLarge and brand_color #D83A34
(claude-in-chrome-troubleshooting fails to load on main due to
a pre-existing 64-char qualified-name limit, fixed by #173's
rename; zeroize-audit's manifest mcpServers object is likewise
a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
pass
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(codex): use skill-local icon assets
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Remove legacy codex compatiblity scripts/shims.
Codex supports claude plugins so this shouldn't be necessary.
Add a script to test the plugin loadablility in both claude and codex
* fix: resolve code review findings for PR #173
Review findings addressed (4 reviewers: pr-review-toolkit agents,
Codex gpt-5.3-codex, direct diff review):
P2 fixed:
- Bump versions for the 5 substantively changed plugins in both
plugin.json and marketplace.json (gh-cli 1.5.0 new skill,
claude-in-chrome-troubleshooting 1.1.0 skill rename,
modern-python 1.5.1 / skill-improver 1.0.3 hooks change,
zeroize-audit 0.1.1 MCP config relocation) so clients pick up
the changes
- README Codex install: replace unpasteable /plugins slash-command
block with verified CLI syntax (codex plugin marketplace add)
- check_claude_loadability: parse_json_output now fails fast with
command context on empty CLI output instead of returning None
- check_codex_loadability: surface skipped RPC error messages in
timeout failures instead of a bare TimeoutError
P3 fixed:
- Both checkers: error out when marketplace.json lists no plugins
instead of passing vacuously
Dismissed:
- @latest CLI installs in validate.yml: deliberate; the check
validates against the clients users actually run
- select.select portability: CI-only script on ubuntu-latest
- Divergent mcpServers validation between checkers: intentional;
the Codex checker enforces the repo's .mcp.json convention
Verified: ruff, prek, validate_plugin_metadata.py, and both
loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP
servers load in Claude Code and Codex)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fix for when CLAUDE_PLUGIN_ROOT contains spaces
* chore(skill-improver): bump version to 1.0.2 for hooks.json fix
The space-quoting fix to hooks.json is a behavioral change, but clients
only pull plugin updates when the version increases. Bump plugin.json and
the root marketplace.json from 1.0.1 to 1.0.2 (kept in sync) so existing
users actually receive the fix.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Fix `allowed-tools` to use spec-compliant space-delimited strings
Per the agentskills.io specification, `allowed-tools` must be a single
string of space-delimited patterns, not a YAML list. Converted all 23
SKILL.md files from the `- Item` list format to the correct
`"Item1 Item2"` string format. Also updated the frontmatter examples in
CLAUDE.md and the workflow-skill-design skill template to match.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix remaining allowed-tools format in firebase-apk-scanner and workflow-skill-design docs
- Convert firebase-apk-scanner from comma-separated to space-delimited
- Update anti-patterns.md and tool-assignment-guide.md examples from YAML lists to space-delimited strings
- Remove unnecessary quotes from SKILL.md template placeholder
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Cover commands, new SKILL.md files, and fix template placeholder
Extends the previous spec-compliance fixes:
* Convert command frontmatter (commands/*.md) — per Claude Code
docs, command files use the same frontmatter as skills, so the
same space-delimited rule applies.
* Convert three SKILL.md files added since the original PR:
mutation-testing, trailmark-structural, trailmark-summary.
* Fix the placeholder in the workflow-skill-design template.
The previous "[minimum tools needed, space-delimited]" was YAML
flow-sequence syntax, which parses as a list — the opposite of
what the placeholder claims. Replaced with a concrete-looking
space-delimited example plus a comment.
Zeroize-audit agent files still use `allowed-tools:` in YAML list
form. They are intentionally excluded: per the project's own docs
(workflow-skill-design references), agents declare tools with
`tools:` (not `allowed-tools:`). Fixing those requires changing
the field name as well as the format and is out of scope for this
PR.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* zeroize-audit agents: switch allowed-tools to tools
Subagents declare their tool allowlist via `tools:` (comma-separated),
not `allowed-tools:` — see Claude Code's subagent docs and this
repo's own designing-workflow-skills/SKILL.md:47:
> Skills use `allowed-tools:` in frontmatter. Agents use `tools:`
> in frontmatter.
Before this change, the zeroize-audit agents declared their tool list
under `allowed-tools:`, which Claude Code does not read for subagents.
The field was effectively a no-op; the spawned agents had no tool
restriction enforced.
Renames the field on all 11 agents to `tools:` and reformats the YAML
list as comma-separated to match the documented format and existing
agents elsewhere in the repo (e.g. function-analyzer.md,
spec-compliance-checker.md). Tool sets are unchanged.
Behavior change: tools now actually constrain what each spawned agent
can call. The lists are the ones the original author intended.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* skill-improver: convert command allowed-tools to space-delimited
The two command files in plugins/skill-improver/commands/ still used
the JSON flow-array format (`allowed-tools: ["..."]`), which the rest
of this PR converted everywhere else. Convert them to the spec-compliant
space-delimited string form for consistency.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
* The pre-flight check for plugin-dev only searched sibling directories
and flat plugin paths. When installed via marketplace, plugins live
under ~/.claude/plugins/cache/<marketplace>/plugin-dev/<version>/,
which none of the existing paths matched.
Add glob patterns to search the marketplace cache directory structure.
* add alternative search path for skill-improver since .claude-plugin is stripped when plugins are installed through marketplace
* Bump skill-improver to 1.0.1 and document fallback check
- Bump version in plugin.json and marketplace.json so existing
users receive the cache detection fix
- Document why the agents/skill-reviewer.md fallback exists
(cached marketplace installs strip .claude-plugin/)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Iterative fix-review loop that automatically refines Claude Code skills
until they meet quality standards. Uses the plugin-dev:skill-reviewer
agent for automated review cycles with a stop hook to continue the loop.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Lixin2026