docs(llm-security): repo-standard gate to 0 ERROR

Ran repo-standard v0.1.1 against this repo (class: plugin, trait: security).
6 ERROR, 4 WARN, 1 SKIP recorded before any edit; now 0 ERROR, 12 checks pass.

BROKEN
- INSTALL-NO-CLI: added `claude plugin install llm-security@ktg-plugin-marketplace`
  beside the existing `marketplace add` line. The settings.json `enabledPlugins`
  block stays — it is a legitimate second form, just not a CLI command.
- LINK-OUTSIDE-REPO (README:7, reported by catalog): the disclosure link pointed
  at `../../README.md#ai-generated-code-disclosure`, relative to the pre-split
  monorepo and anchored at a heading that never existed. Replaced with the inline
  text the polyrepo migration's step 5 was meant to write.

MISSING
- `## Non-goals`: added as its own heading over the existing out-of-scope table
  inside `## Project scope`. The `## Project scope` heading is kept because
  SECURITY.md and CONTRIBUTING.md reference it by name.
- `## Changelog`: promoted from the trailing "Full history in CHANGELOG.md" line.
- `## Known limitations` (required by the `security` trait): renamed from
  `## What this plugin does NOT cover` — same table, contract heading.

WEAKENING
- README-DESC: opening line now matches the forge description verbatim, so
  description == catalog == README holds. This replaced the tagline
  "Automated defense and advisory analysis for the agentic AI attack surface."
- HEADING-LEVEL: `### Install` promoted to `## Install`; `## Quick Start` split
  into `## Requirements` / `## Install` / `## First scan`.
- BADGE-STATIC-CLAIM: dropped the static `tests-2034` badge. No runner exists on
  this forge, so the badge asserted a run nothing performs. Replaced under
  `## Self-scan` with the command that runs the suite from a clean clone, and
  the plain statement that nothing runs it automatically.
- LINK-NON-REPO x2: `open/claude-code-llm-security` (pre-split name) in
  V3-ANNOUNCEMENT.md updated to `open/llm-security`. Same dead name found in
  sarif-formatter.mjs TOOL_URI, which ships into SARIF output consumed by other
  tools, so it is corrected too.

Left standing, deliberately:
- WARN README-H1 `# LLM Security Plugin for Claude Code` != `# llm-security`.
  The gate defers this to the operator, and the description thread it protects
  is now carried by the opening line instead.

Suite 2034/2034.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016h37aUdBLVDT9xrvG9osA9

README.md

@@ -1,10 +1,10 @@
 # LLM Security Plugin for Claude Code
 
-> Automated defense and advisory analysis for the agentic AI attack surface.
+Security scanning, auditing, and threat modeling for Claude Code projects. OWASP LLM Top 10 (2025) and Agentic AI Top 10.
 
 > **Solo-maintained, fork-and-own.** This plugin is a starting point, not a vendor product. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for the full model and what upstream provides.
 
-*AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)*
+*AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit.*
 
 ![Version](https://img.shields.io/badge/version-7.8.3-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
@@ -13,7 +13,6 @@
 ![Scanners](https://img.shields.io/badge/scanners-22-cyan)
 ![Hooks](https://img.shields.io/badge/hooks-9-red)
 ![Knowledge](https://img.shields.io/badge/knowledge_docs-23-green)
-![Tests](https://img.shields.io/badge/tests-2034-success)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
 A Claude Code plugin that provides security scanning, auditing, and threat modeling for agentic AI projects. Built on [OWASP LLM Top 10 (2025)](https://genai.owasp.org/llm-top-10/), [OWASP Agentic AI Top 10 (ASI01-ASI10, 2026 edition)](https://genai.owasp.org/agentic-ai/), OWASP Skills Top 10 (AST01-AST10), MCP Top 10, and the [AI Agent Traps](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438) taxonomy (Google DeepMind, 2025), grounded in published research from ToxicSkills, ClawHavoc, MCPTox, Pillar Security, Invariant Labs, GHSL Security Lab, and Operant AI.
@@ -33,17 +32,16 @@ This plugin layers three independent kinds of defense — **runtime hooks** that
 
 ---
 
-## Quick Start
-
-### Prerequisites
+## Requirements
 
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code) v2.x+
 - Node.js (any recent LTS — required for hook scripts)
 
-### Install
+## Install
 
 ```bash
 claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
+claude plugin install llm-security@ktg-plugin-marketplace
 ```
 
 Or enable directly in `~/.claude/settings.json`:
@@ -58,7 +56,7 @@ Or enable directly in `~/.claude/settings.json`:
 
 Hooks activate immediately on install. Secret detection, path guarding, prompt-injection scanning, destructive-command blocking, supply-chain guardrails, and runtime trifecta detection start working without any commands.
 
-### First scan
+## First scan
 
 ```
 > /security posture
@@ -394,7 +392,7 @@ Average ~69 %. Strongest at prompt injection (95 % with input + output scanning
 
 ---
 
-## What this plugin does NOT cover
+## Known limitations
 
 | Area | Why | Alternative |
 |------|-----|-------------|
@@ -435,6 +433,8 @@ into commercial-grade territory. Going forward, work focuses on:
 - **Deprecation cleanup** — v8.0.0 removes the `LLM_SECURITY_*` env vars and `riskScoreV1` constant deprecated in v7.3.0
 - **Opportunistic small additions** that fit the existing deterministic architecture
 
+## Non-goals
+
 The following are **explicitly out of scope — fork the repo and own them**
 under your organization's name. The MIT license permits this and the project
 is architected to be forkable. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for
@@ -558,6 +558,16 @@ locally.
 
 ## Self-scan
 
+### Test suite
+
+The whole suite runs from a clean clone with one command, and no CI runs it for
+you — this forge has no Actions runner, so the only run that exists is the one
+you start:
+
+```bash
+npm test          # node --test 'tests/**/*.test.mjs'
+```
+
 Running `node scanners/scan-orchestrator.mjs .` on this plugin produces **0 findings (ALLOW)** with ~190 suppressions via `.llm-security-ignore`. Every suppression is explained — a security plugin that documents attack patterns, ships a malicious demo fixture, and tests against deliberately evil code will trigger its own scanners. The entropy scanner flags regex patterns in `knowledge/secrets-patterns.md`. The taint scanner flags `eval(user_input)` in test fixtures. The toxic flow analyzer flags the plugin's own commands that use Read+Bash. Remove the ignore file and re-run to see the unsuppressed picture.
 
 The `examples/malicious-skill-demo/` directory contains a deliberately malicious "Project Health Dashboard" plugin and a [full security assessment](examples/malicious-skill-demo/security-assessment.md). The combined LLM + deterministic pipeline produced **85 findings** (24 critical, 24 high, 20 medium, 6 low, 11 info) and verdict **BLOCK 100/100** — both layers independently maxed the risk score. A human reviewing the plugin's `README.md` and `SKILL.md` would likely miss most of them; the Unicode Tag steganography is literally invisible.
@@ -644,7 +654,9 @@ demonstrations — each with `README.md`, fixture, run script, and
 | **7.2.0** | 2026-04-29 | **Batch B release.** Critical-review B-tier scanner defects + v7.2.0 evasion-arsenal (PUA-A/B Unicode coverage, NFKC homoglyph fold, escalation-after-input window, markdown link-title + SVG `<desc>`/`<foreignObject>` + HTML comment extractors). Two-stage entropy context classification. v1→v2 risk-formula constants unified across docs. 8 new red-team scenarios (64 → 72). 1522 → 1665 tests |
 | **7.1.0** | 2026-04-29 | **Critical-review patch.** Pathguard regex hole closed (`.env.production.local.backup`-class). Distributed-trifecta block-mode AND-gate removed. CaMeL claim toned down to honest "byte-fingerprint matching". Documentation honesty-sweep across 7 overclaim sites. 1487 → 1511 tests |
 
-Full history in [`CHANGELOG.md`](CHANGELOG.md).
+## Changelog
+
+See [`CHANGELOG.md`](CHANGELOG.md) for the full history.
 
 ---
 

V3-ANNOUNCEMENT.md

@@ -113,15 +113,15 @@ These tools are not mutually exclusive:
 ## Installation
 
 ```bash
-git clone https://git.fromaitochitta.com/open/claude-code-llm-security.git \
-  ~/.claude/plugins/claude-code-llm-security
+git clone https://git.fromaitochitta.com/open/llm-security.git \
+  ~/.claude/plugins/llm-security
 ```
 
 Hooks activate immediately. No configuration required.
 
 ## Links
 
-- **Source**: [git.fromaitochitta.com/open/claude-code-llm-security](https://git.fromaitochitta.com/open/claude-code-llm-security)
+- **Source**: [git.fromaitochitta.com/open/llm-security](https://git.fromaitochitta.com/open/llm-security)
 - **Full README**: See [README.md](README.md)
 - **Changelog**: See [CHANGELOG.md](CHANGELOG.md)
 - **License**: MIT

scanners/lib/sarif-formatter.mjs

@@ -5,7 +5,7 @@
 const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json';
 const SARIF_VERSION = '2.1.0';
 const TOOL_NAME = 'llm-security';
-const TOOL_URI = 'https://git.fromaitochitta.com/open/claude-code-llm-security';
+const TOOL_URI = 'https://git.fromaitochitta.com/open/llm-security';
 
 /**
  * Map finding severity to SARIF level.