Compare commits
No commits in common. "main" and "v1.1.0" have entirely different histories.
2 changed files with 0 additions and 41 deletions
12
.gitignore
vendored
12
.gitignore
vendored
|
|
@ -1,12 +0,0 @@
|
||||||
|
|
||||||
# --- session/local state (gitignored per ~/.claude polyrepo-konvensjon) ---
|
|
||||||
STATE.md
|
|
||||||
REMEMBER.md
|
|
||||||
ROADMAP.md
|
|
||||||
TODO.md
|
|
||||||
NEXT-SESSION-PROMPT*.local.md
|
|
||||||
*.local.md
|
|
||||||
*.local.json
|
|
||||||
*.local.sh
|
|
||||||
.DS_Store
|
|
||||||
.claude/
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Plugin review — human-friendly-style (2026-06-20)
|
|
||||||
|
|
||||||
> Full-depth review (part of the marketplace-wide sweep; pilot was okr). Tooling: config-audit
|
|
||||||
> v5.4.0 scanners (from source) + llm-security posture assessor + structure/version checks.
|
|
||||||
> Read-only; this file is the only artifact.
|
|
||||||
|
|
||||||
## Verdict
|
|
||||||
|
|
||||||
**Clean, grade A — essentially no attack surface.** A metadata-only manifest plus one output-style
|
|
||||||
markdown; no commands, agents, skills, hooks, MCP, or dependencies. Nothing actionable.
|
|
||||||
|
|
||||||
## Results by dimension
|
|
||||||
|
|
||||||
| Dimension | Result |
|
|
||||||
|-----------|--------|
|
|
||||||
| config-audit posture | **A** (Feature Coverage F 17 — expected: an output-style uses almost no CC features; opportunity, not a defect) |
|
|
||||||
| config-audit plugin-health | **0 findings** |
|
|
||||||
| llm-security posture | **A** — no findings (1 INFO). The only real vector (an output-style edits the system prompt) was reviewed line-by-line + byte-scanned: tone-only, `keep-coding-instructions: true`, no hidden/encoded/scope-expanding directives. Hidden-char scan clean (only em-dashes). |
|
|
||||||
| structure / hygiene | README ✓, CHANGELOG ✓, CLAUDE.md ✓, LICENSE ✓ |
|
|
||||||
| version consistency | **OK** (gate) |
|
|
||||||
|
|
||||||
## Findings
|
|
||||||
|
|
||||||
- **INFO** — `output-styles/human-friendly.md:21-27` — hide-by-default directives reduce visibility
|
|
||||||
into routine tool output. This is the stated purpose, reversible on request (L29), and carved out
|
|
||||||
for irreversible actions (L32-33). Not a defect; no remediation.
|
|
||||||
|
|
||||||
The irreversible-action carve-out (forces verbatim display of destructive commands) is a net
|
|
||||||
security positive.
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue