Ran repo-standard v0.1.1 against this repo (class: plugin, trait: security).
6 ERROR, 4 WARN, 1 SKIP recorded before any edit; now 0 ERROR, 12 checks pass.
BROKEN
- INSTALL-NO-CLI: added `claude plugin install llm-security@ktg-plugin-marketplace`
beside the existing `marketplace add` line. The settings.json `enabledPlugins`
block stays — it is a legitimate second form, just not a CLI command.
- LINK-OUTSIDE-REPO (README:7, reported by catalog): the disclosure link pointed
at `../../README.md#ai-generated-code-disclosure`, relative to the pre-split
monorepo and anchored at a heading that never existed. Replaced with the inline
text the polyrepo migration's step 5 was meant to write.
MISSING
- `## Non-goals`: added as its own heading over the existing out-of-scope table
inside `## Project scope`. The `## Project scope` heading is kept because
SECURITY.md and CONTRIBUTING.md reference it by name.
- `## Changelog`: promoted from the trailing "Full history in CHANGELOG.md" line.
- `## Known limitations` (required by the `security` trait): renamed from
`## What this plugin does NOT cover` — same table, contract heading.
WEAKENING
- README-DESC: opening line now matches the forge description verbatim, so
description == catalog == README holds. This replaced the tagline
"Automated defense and advisory analysis for the agentic AI attack surface."
- HEADING-LEVEL: `### Install` promoted to `## Install`; `## Quick Start` split
into `## Requirements` / `## Install` / `## First scan`.
- BADGE-STATIC-CLAIM: dropped the static `tests-2034` badge. No runner exists on
this forge, so the badge asserted a run nothing performs. Replaced under
`## Self-scan` with the command that runs the suite from a clean clone, and
the plain statement that nothing runs it automatically.
- LINK-NON-REPO x2: `open/claude-code-llm-security` (pre-split name) in
V3-ANNOUNCEMENT.md updated to `open/llm-security`. Same dead name found in
sarif-formatter.mjs TOOL_URI, which ships into SARIF output consumed by other
tools, so it is corrected too.
Left standing, deliberately:
- WARN README-H1 `# LLM Security Plugin for Claude Code` != `# llm-security`.
The gate defers this to the operator, and the description thread it protects
is now carried by the opening line instead.
Suite 2034/2034.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016h37aUdBLVDT9xrvG9osA9
Add /ultraresearch-local for structured research combining local codebase
analysis with external knowledge via parallel agent swarms. Produces research
briefs with triangulation, confidence ratings, and source quality assessment.
New command: /ultraresearch-local with modes --quick, --local, --external, --fg.
New agents: research-orchestrator (opus), docs-researcher, community-researcher,
security-researcher, contrarian-researcher, gemini-bridge (all sonnet).
New template: research-brief-template.md.
Integration: --research flag in /ultraplan-local accepts pre-built research
briefs (up to 3), enriches the interview and exploration phases. Planning
orchestrator cross-references brief findings during synthesis.
Design principle: Context Engineering — right information to right agent at
right time. Research briefs are structured artifacts in the pipeline:
ultraresearch → brief → ultraplan --research → plan → ultraexecute.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
