fix: security-audit probe searches the tree; CI pin and audit-doc follow-ups

.github/workflows/validate.yml

@@ -114,7 +114,7 @@ jobs:
           node-version: '22'
 
       - name: Install official Claude plugin validator
-        run: npm install -g @anthropic-ai/claude-code@2.1.258
+        run: npm install -g @anthropic-ai/claude-code@2.1.266
 
       - name: Validate plugins with the target host
         env:

docs/SKILL_AUDITS.md

@@ -65,8 +65,11 @@ domain. `/health` continues to describe pollers, not skill effectiveness.
 
 ## Repeat the review
 
-1. Pin the source revision and content hash before reviewing. Inventory installed
-   copies separately; local source versions do not prove release availability.
+1. Pin the source revision and content hash before reviewing. Record revisions that
+   are already on `main`; this marketplace rebase-merges, so branch commits are
+   rewritten and their SHAs stop resolving after merge. Content hashes survive
+   either way. Inventory installed copies separately; local source versions do not
+   prove release availability.
 2. Read every entrypoint in scope, parse real YAML, run the host plugin validator,
    and inspect references and executable dependencies relevant to the task.
 3. Execute reviewed probes in empty, matching, and unrelated contexts. Check their

plugins/code-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "clownware-code-tools",
   "description": "Universal dev workflow skills: architecture/deployment-readiness auditing, security auditing, test-suite auditing, skill auditing, design-system auditing, accessibility auditing, dependency auditing, performance auditing, devops/CI-CD auditing, audit-fix application, plugin releasing, skill validation, ADR authoring, PR descriptions, root-cause debugging, test scaffolding, and GitHits OSS research conventions. Each skill probes the repo it runs in and degrades gracefully. Also ships a git guard hook: blocks --no-verify commits/pushes and secret-scans staged changes (gitleaks, with a pattern fallback) before every commit.",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "license": "Apache-2.0",
   "author": {
     "name": "clownware"

plugins/code-tools/skills/security-audit/SKILL.md

@@ -10,7 +10,7 @@ Security-audit this repository. Focus, if given: $ARGUMENTS
 
 **Toolchain:** !`out=$(ls go.mod package.json pyproject.toml requirements.txt Cargo.toml pom.xml build.gradle Gemfile composer.json 2>/dev/null); echo "${out:-unrecognized — infer from source extensions}"`
 **Dependency scanners available:** !`out=$(command -v govulncheck npm pip-audit cargo-audit osv-scanner trivy snyk bundler-audit 2>/dev/null); echo "${out:-none on PATH — audit deps by reading lockfiles + advisories}"`
-**Auth/session/security-relevant files:** !`out=$(rg -l -i "cookie|jwt|session|password|csrf|oauth|bcrypt|crypto/rand|subtle\.|SetCookie|Authorization" --iglob '!*_test.*' --iglob '!node_modules' 2>/dev/null | head -20); echo "${out:-none matched — locate auth by reading routing/middleware}"`
+**Auth/session/security-relevant files:** !`out=$(rg -l -i "cookie|jwt|session|password|csrf|oauth|bcrypt|crypto/rand|subtle\.|SetCookie|Authorization" . --iglob '!*_test.*' --iglob '!node_modules' 2>/dev/null | head -20); echo "${out:-none matched — locate auth by reading routing/middleware}"`
 **Prior security decisions:** !`out=$(rg -l -i "threat model|security|owasp|rls|csrf|xss" docs/ CLAUDE.md CONTRIBUTING.md SECURITY.md 2>/dev/null | head -8); echo "${out:-none found — no written threat model (note it)}"`
 **Env/secret surface:** !`out=$(ls .env .env.example .env.local docker-compose.yml Dockerfile 2>/dev/null; ls .github/workflows/ 2>/dev/null); echo "${out:-none}"`
 **Secrets ever committed (name check):** !`out=$(git log --all --diff-filter=A --name-only --format= -- '*.env' '.env*' '*.pem' '*.key' '*_rsa' 2>/dev/null | grep -v '\.env\.example$' | sort -u | head); echo "${out:-none — no obvious secret files in history (still grep contents)}"`