Kjell Tore Guttormsen
a86b92e2b5
Three additive findings extend existing PLH and SET scanners (scanner count stays 13; --json/--raw byte-stable): - CA-PLH-015 plugin-folder shadowing — a plugin.json component-path key in the replaces-set (commands/agents/outputStyles) pointing at a custom path while the default folder still exists; mirrors CC /doctor & claude plugin list. - CA-PLH-016 skills:-array validation — each entry must resolve to a directory inside the plugin root; flags non-string/escapes-root/not-found/not-a-directory; mirrors claude plugin validate. - CA-SET autoMode — structure (only environment/allow/soft_deny/hard_deny string arrays; "$defaults" valid) = medium; dead-config (autoMode in shared .claude/settings.json is not read by CC) = low. Release mechanics: version 5.3.0 -> 5.4.0 (plugin.json); CHANGELOG [5.4.0]; README badge/TOC/What's-New/version-history; knowledge v5.4.0 scanner-backing facts. Gates: suite 949/949, self-audit A/A + readmeCheck.passed (count 13), SC-5 byte-equal, gitleaks clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8 |
||
|---|---|---|
| .. | ||
| plugin.json | ||