diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 687aa2f..0000000 --- a/.gitignore +++ /dev/null @@ -1,12 +0,0 @@ - -# --- session/local state (gitignored per ~/.claude polyrepo-konvensjon) --- -STATE.md -REMEMBER.md -ROADMAP.md -TODO.md -NEXT-SESSION-PROMPT*.local.md -*.local.md -*.local.json -*.local.sh -.DS_Store -.claude/ diff --git a/docs/review-2026-06-20.md b/docs/review-2026-06-20.md deleted file mode 100644 index 3e2ac06..0000000 --- a/docs/review-2026-06-20.md +++ /dev/null @@ -1,29 +0,0 @@ -# Plugin review — human-friendly-style (2026-06-20) - -> Full-depth review (part of the marketplace-wide sweep; pilot was okr). Tooling: config-audit -> v5.4.0 scanners (from source) + llm-security posture assessor + structure/version checks. -> Read-only; this file is the only artifact. - -## Verdict - -**Clean, grade A — essentially no attack surface.** A metadata-only manifest plus one output-style -markdown; no commands, agents, skills, hooks, MCP, or dependencies. Nothing actionable. - -## Results by dimension - -| Dimension | Result | -|-----------|--------| -| config-audit posture | **A** (Feature Coverage F 17 — expected: an output-style uses almost no CC features; opportunity, not a defect) | -| config-audit plugin-health | **0 findings** | -| llm-security posture | **A** — no findings (1 INFO). The only real vector (an output-style edits the system prompt) was reviewed line-by-line + byte-scanned: tone-only, `keep-coding-instructions: true`, no hidden/encoded/scope-expanding directives. Hidden-char scan clean (only em-dashes). | -| structure / hygiene | README ✓, CHANGELOG ✓, CLAUDE.md ✓, LICENSE ✓ | -| version consistency | **OK** (gate) | - -## Findings - -- **INFO** — `output-styles/human-friendly.md:21-27` — hide-by-default directives reduce visibility - into routine tool output. This is the stated purpose, reversible on request (L29), and carved out - for irreversible actions (L32-33). Not a defect; no remediation. - -The irreversible-action carve-out (forces verbatim display of destructive commands) is a net -security positive.