12 Commits

  • fix: port continuous-learning observer fixes
    Ports continuous-learning observer signal, storage, remote normalization, and v1 deprecation fixes onto current main.
  • security: remove supply chain risks, external promotions, and unauthorized credits
    - Remove zenith.chat references and @DRodriguezFX shoutout from README
    - Remove Inspiration Credits section (already in CHANGELOG.md)
    - Remove awesome-agent-skills reference from Links
    - Remove Plankton H3 section by @alxfazio (skill stays in skills/)
    - Remove brand names (InsAIts, VideoDB, Evos) from v1.9.0 notes
    - Remove @ericcai0814 individual credit from README (kept in CHANGELOG)
    - Add Security Guide to Links section
    - Replace curl-pipe-to-bash in autonomous-loops with review warning
    - Replace git clone in plankton-code-quality with review warning
    - Replace pip install git+ in agent-eval with review warning
    - Replace npm install -g in dmux-workflows with review warning
    - Add commercial API notice to nutrient-document-processing
    - Remove VideoDB maintainer credit from videodb skill
    - Replace skill-creator.app link with ECC-Tools GitHub App reference
  • fix: resolve CI failures on main — lint, hooks validator, and test alignment
    - Fix MD012 trailing blank lines in commands/projects.md and commands/promote.md
    - Fix MD050 strong-style in continuous-learning-v2 (escape __tests__ as inline code)
    - Extract doc-file-warning hook to standalone script to fix hooks validator regex parsing
    - Update session-end test to match #317 behavior (always update summary content)
    - Allow shell script hooks in integration test format validation
    
    All 992 tests passing.
  • feat: project-scoped instinct isolation
    * feat: add project-scoped instinct isolation
    
    * fix(continuous-learning-v2): harden instinct loading and promotion safety; sync v2.1 command docs
    
    * fix(ci): make copilot-setup-steps a valid GitHub Actions workflow
    
    * fix(hooks): stabilize docs warning inline JS regex parsing
  • feat: add security guides and sanitize external links across repo
    New articles:
    - the-security-guide.md: "The Shorthand Guide to Securing Your Agent" (595 lines)
      Attack vectors, sandboxing, sanitization, OWASP Top 10, observability
    - the-openclaw-guide.md: "The Hidden Danger of OpenClaw" (470 lines)
      Security analysis of OpenClaw, MiniClaw thesis, industry evidence
    
    External link sanitization (22 files across EN, zh-CN, zh-TW, ja-JP, .cursor):
    - Removed third-party GitHub links from skills and guides
    - Replaced with inline descriptions to prevent transitive prompt injection
    - Kept official org links (Anthropic, Google, Supabase, Mixedbread)
  • fix: add origin metadata to skills for traceability
    Add origin field to all skill files to track their source repository.
    This enables users to identify where distributed skills originated from.
    Fixes affaan-m/everything-claude-code#246
  • docs: add 'When to Activate' sections to 14 skill definitions
    Add activation triggers to skills that were missing them, helping
    Claude Code determine when to load each skill contextually.
  • fix: use CLAUDE_PLUGIN_ROOT for continuous-learning-v2 paths
    Fixes #113
    
    The instinct commands referenced hardcoded paths that only work with
    manual installation (~/.claude/skills/...). When installed as a plugin,
    files are at ~/.claude/plugins/cache/.../skills/...
    
    Changes:
    - Updated instinct-status, instinct-import, evolve commands to use
      ${CLAUDE_PLUGIN_ROOT} with fallback to manual path
    - Updated observe.sh hook documentation with both install methods
    - Updated SKILL.md with plugin vs manual installation instructions
    - Removed duplicate commands from skills/continuous-learning-v2/commands/
      (already exist in commands/)
    
    Users should use ${CLAUDE_PLUGIN_ROOT} in their hooks config when
    installed as a plugin.
  • feat: v1.1.0 release - session ID tracking, async hooks, new skills
    - Add session ID to session filenames (Issue #62)
    - Add getSessionIdShort() helper for unique per-session tracking
    - Add async hooks documentation with example
    - Create iterative-retrieval skill for progressive context refinement
    - Add continuous-learning-v2 skill with instinct-based learning
    - Add ecc.tools ecosystem section to README
    - Update skills list in README
    
    All 67 tests passing.