feat: initial open marketplace with llm-security, config-audit, ultraplan-local

plugins/config-audit/examples/minimal-setup/CLAUDE.md

@@ -0,0 +1 @@
+# My Project

plugins/config-audit/examples/minimal-setup/README.md

@@ -0,0 +1,17 @@
+# Minimal Setup Example
+
+This example demonstrates a bare-minimum Claude Code project — just a single-line CLAUDE.md with no other configuration.
+
+## What to expect
+
+Running `node ../../scanners/posture.mjs .` from this directory will show:
+
+- **Low utilization score** — most features are unused
+- **Low maturity level** — no hooks, no rules, no settings
+- **Multiple feature gap findings** — all tiers flagged
+
+## Why this matters
+
+Even a single CLAUDE.md file is enough for Claude Code to work. But without permissions, hooks, rules, or MCP configuration, you're leaving significant capability on the table.
+
+Compare with the [optimal-setup](../optimal-setup/) example to see what a fully-configured project looks like.

plugins/config-audit/examples/optimal-setup/.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "optimal-project",
+  "description": "Example project demonstrating optimal Claude Code configuration",
+  "version": "1.0.0"
+}

plugins/config-audit/examples/optimal-setup/.claude/agents/review-agent.md

@@ -0,0 +1,15 @@
+---
+name: review-agent
+description: |
+  Code review agent that checks for style violations, 
+  potential bugs, and test coverage gaps.
+model: sonnet
+color: green
+isolation: worktree
+tools: ["Read", "Glob", "Grep"]
+---
+
+Review the specified files for:
+1. Style violations per code-style rules
+2. Missing error handling
+3. Untested code paths

plugins/config-audit/examples/optimal-setup/.claude/commands/build.md

@@ -0,0 +1,12 @@
+---
+name: build
+description: Build the project with current branch context
+argument-hint: "[--watch]"
+allowed-tools: Bash, Read
+model: sonnet
+---
+
+Current branch: !`git branch --show-current`
+Status: !`git status --short`
+
+Build the project. If --watch is specified, run in watch mode.

plugins/config-audit/examples/optimal-setup/.claude/keybindings.json

@@ -0,0 +1,6 @@
+[
+  {
+    "key": "shift+enter",
+    "command": "chat:newline"
+  }
+]

plugins/config-audit/examples/optimal-setup/.claude/rules/code-style.md

@@ -0,0 +1,9 @@
+---
+paths: "src/**/*.ts"
+---
+
+# Code Style
+
+- Use explicit return types on all exported functions
+- Prefer `const` over `let`
+- No `any` types — use `unknown` and narrow

plugins/config-audit/examples/optimal-setup/.claude/rules/testing.md

@@ -0,0 +1,9 @@
+---
+paths: "tests/**/*"
+---
+
+# Testing Conventions
+
+- Use `describe`/`it` blocks with clear names
+- One assertion per test where practical
+- Mock external services, not internal modules

plugins/config-audit/examples/optimal-setup/.claude/settings.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://cdn.anthropic.com/schemas/claude-code/settings.schema.json",
+  "model": "sonnet",
+  "permissions": {
+    "allow": [
+      "Read",
+      "Glob",
+      "Grep",
+      "Bash(npm test)",
+      "Bash(npm run build)"
+    ],
+    "deny": [
+      "Bash(rm -rf *)"
+    ]
+  },
+  "statusLine": {
+    "enabled": true
+  },
+  "outputStyle": "concise",
+  "worktree": {
+    "symlinkDirectories": [
+      "node_modules"
+    ]
+  },
+  "autoMode": {
+    "enabled": false
+  },
+  "env": {
+    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
+  }
+}

plugins/config-audit/examples/optimal-setup/.lsp.json

@@ -0,0 +1,8 @@
+{
+  "servers": {
+    "typescript": {
+      "command": "typescript-language-server",
+      "args": ["--stdio"]
+    }
+  }
+}

plugins/config-audit/examples/optimal-setup/.mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "."],
+      "trust": "local"
+    }
+  }
+}

plugins/config-audit/examples/optimal-setup/CLAUDE.md

@@ -0,0 +1,33 @@
+# Optimal Project
+
+A fully-configured Claude Code project demonstrating best practices.
+
+## Overview
+
+This project uses TypeScript with a standard src/tests layout. All configuration follows Claude Code best practices for permissions, hooks, rules, and tooling.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/build` | Build the project with status context |
+
+## Architecture
+
+```
+src/           # Application source (TypeScript)
+tests/         # Test files
+.claude/       # Claude Code configuration
+hooks/         # Git and Claude hooks
+```
+
+## Code Standards
+
+- TypeScript strict mode
+- ESLint + Prettier
+- 80% test coverage minimum
+
+## Gotchas
+
+- Run `npm install` before first use
+- Tests require Node.js 18+

plugins/config-audit/examples/optimal-setup/README.md

@@ -0,0 +1,38 @@
+# Optimal Setup Example
+
+This example demonstrates a fully-configured Claude Code project that scores A on config-audit's posture assessment.
+
+## What's configured
+
+| Feature | File | Gap Check |
+|---------|------|-----------|
+| Project instructions | `CLAUDE.md` | t1_1 |
+| Permissions | `.claude/settings.json` | t1_2 |
+| Hooks (3 events) | `hooks/hooks.json` | t1_3, t2_5 |
+| Custom commands | `.claude/commands/build.md` | t1_4 |
+| MCP servers | `.mcp.json` | t1_5, t4_1 |
+| Multi-scope settings | `.claude/settings.local.json` | t2_1 |
+| Modular rules | `.claude/rules/` | t2_2 |
+| Path-scoped rules | `code-style.md`, `testing.md` | t2_3 |
+| Custom agents | `.claude/agents/review-agent.md` | t2_6 |
+| Model config | `settings.json` (model key) | t2_7 |
+| Status line | `settings.json` (statusLine) | t3_1 |
+| Custom keybindings | `.claude/keybindings.json` | t3_2 |
+| Output style | `settings.json` (outputStyle) | t3_3 |
+| Worktree config | `settings.json` (worktree) | t3_4 |
+| Advanced skill frontmatter | `build.md` (argument-hint) | t3_5 |
+| Agent isolation | `review-agent.md` (worktree) | t3_6 |
+| Dynamic context | `build.md` (!`git ...`) | t3_7 |
+| Auto mode | `settings.json` (autoMode) | t3_8 |
+| Plugin manifest | `.claude-plugin/plugin.json` | t4_2 |
+| Agent teams | `settings.json` (env) | t4_3 |
+| LSP config | `.lsp.json` | t4_5 |
+
+## How to test
+
+```bash
+cd examples/optimal-setup
+node ../../scanners/posture.mjs .
+```
+
+Expected: A-grade score with high utilization across all tiers.

plugins/config-audit/examples/optimal-setup/hooks/hooks.json

@@ -0,0 +1,38 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo 'Pre-tool check passed'",
+            "timeout": 5000
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo 'Post-tool verification passed'",
+            "timeout": 5000
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "prompt",
+            "prompt": "Remember to commit your changes before ending the session."
+          }
+        ]
+      }
+    ]
+  }
+}

plugins/config-audit/examples/run-demo.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Demo: run config-audit scanners on the example projects
+# Usage: bash examples/run-demo.sh (from plugin root)
+#    or: cd examples && bash run-demo.sh
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -d "$SCRIPT_DIR/../scanners" ]; then
+  SCANNER_DIR="$(cd "$SCRIPT_DIR/../scanners" && pwd)"
+else
+  SCANNER_DIR=""
+fi
+
+if [ -z "$SCANNER_DIR" ] || [ ! -f "$SCANNER_DIR/posture.mjs" ]; then
+  echo "Error: Cannot find scanners/posture.mjs"
+  echo "Run from plugin root: bash examples/run-demo.sh"
+  exit 1
+fi
+
+echo "=== Minimal Setup (expect low score) ==="
+echo ""
+node "$SCANNER_DIR/posture.mjs" "$SCRIPT_DIR/minimal-setup/"
+
+echo ""
+echo ""
+echo "=== Optimal Setup (expect high score) ==="
+echo ""
+node "$SCANNER_DIR/posture.mjs" "$SCRIPT_DIR/optimal-setup/"