docs(philosophy): disposition every uncited doc page and settle two deferred gate calls

[kyle-sexton]

No linked issue

Summary

Three deferred judgment calls, all made here.

The uncited doc pages were never dispositioned, and the set is larger than recorded. PR #2177
worked from an index of 112 core /docs/en/ pages with ~33 uncited. Re-derived today, the index
lists 135 core pages and this repo cites 78, leaving 57 unevaluated. #2177 also
demonstrated the miss rate of dismissing by eye: it took six pages that had been written off as
irrelevant and found every one load-bearing enough to warrant a verdict. So all 57 get a recorded
disposition here rather than a second eyeball pass.

The finding that mattered is in the cross-platform contract. It reads one axis — the operating
system — and names feature-availability as its canonical input. That page carries two axes,
model provider and subscription plan, and scopes itself to what runs locally: "The Claude Code CLI
and everything that runs locally work on every provider." The host surface a consumer runs in
was therefore never read at all, by either the contract or its input. It has to be, because a host
can withhold the plugin system itself rather than one capability, and where no plugin loads there is
no portable path for one to owe.

check-skill.sh check 5 and check 12's 4-skill warning floor were both left open as "a
separate call". Both are decided, at their own sites, with the reasoning recorded so neither is
re-litigated from a false premise.

Fix

1. Uncited-page disposition (57 pages)

One stated relevance test, applied to all 57 so the dismissals are auditable rather than tacit:

Relevant if the page describes a surface a plugin author can declare, invoke, or must
accommodate. Otherwise not relevant.

Split: 1 adopt / 0 defer / 3 decline / 4 relevant-as-evidence / 49 not relevant.

Verdicts land in docs/PLUGIN-PHILOSOPHY.md under Native-first → Recorded gate runs, in the
upstream-drift
four-part shape (claim, basis, as-of date, recheck trigger), following #2177's form.

Page	Disposition
platforms	Relevant → ADOPT, as a citation. The canonical host-surface index; the axis feature-availability does not carry. Lands doctrine.
github-enterprise-server	Relevant → DECLINE. A real plugin-distribution surface ("Plugin marketplaces | ✅ Supported") — declines on need, not subject: nothing here documents a GHES-hosted mirror or fork.
ultrareview	Relevant → DECLINE. Fails gate 1: every run is human-confirmed and metered, so no skill can reach it.
chrome	Relevant → DECLINE. Ships as the built-in claude-in-chrome skill; nothing to declare. Recorded because it only looked cited — see the dead-link note below.
desktop, vs-code, mobile, desktop-wsl	Relevant → read in full as the evidence base for the platforms row; no separate verdict, because they are one finding seen from four pages rather than four surfaces. Quoted verbatim in that row.
jetbrains	Not relevant — false friend: "plugin" there is the JetBrains IDE plugin, a different sense. Ranked 2nd by plugin-keyword density and is the one page where that signal is pure noise.
desktop-quickstart, desktop-linux, desktop-ios-simulator, web-quickstart, troubleshoot-install	Not relevant — install and first-run recipes; nothing declarable.
slack, claude-tag	Not relevant on their own — delegation front ends indexed by platforms, which is the adopted citation; slack is additionally being retired for Team/Enterprise.
devcontainer	Not relevant — container recipe; its only marketplace hit is a VS Code extension link.
gitlab-ci-cd, github-actions-cloud-providers	Not relevant — CI recipes and provider IAM routing; zero plugin or skill surface (gitlab-ci-cd: 0 keyword hits).
amazon-bedrock, google-vertex-ai, microsoft-foundry, claude-platform-on-aws	Not relevant — provider auth/IAM config; the plugin-facing consequence is the availability matrix, already adopted as feature-availability.
gateways, llm-gateway, llm-gateway-connect, llm-gateway-protocol, llm-gateway-rollout	Not relevant — org request-routing plane between the client and a provider; no plugin declares or observes it.
claude-apps-gateway, claude-apps-gateway-config, claude-apps-gateway-deploy, claude-apps-gateway-on-aws, claude-apps-gateway-on-gcp, claude-apps-gateway-spend-limits	Not relevant — deploying and operating Anthropic's gateway product; gateway.yaml, Kubernetes, spend caps.
self-hosted-environments, self-hosted-environments-quickstart, self-hosted-environments-configuration, self-hosted-environments-deploy, self-hosted-environments-identity, self-hosted-environments-reference, self-hosted-environments-testing	Not relevant — standing up and operating cloud-session runners on org infrastructure.
admin-setup, authentication, legal-and-compliance, third-party-integrations	Not relevant — enterprise deployment, identity, and policy plane; no surface a plugin declares or observes.
analytics	Not relevant — but fetched, not assumed, because per-skill or per-plugin cost attribution would have bound instruction economy. It has none: attribution is PR-level only. (The per-skill/per-plugin usage breakdown is a consumer-side /usage dialog, not an authoring input.)
network-config	Not relevant, and the third clause of the test is why rather than the family label: proxy, custom CA, and mTLS are transport configured on the client, so a skill making a network call either succeeds or sees an ordinary failure — there is nothing to declare or degrade. Its two plugin-adjacent lines are egress allowlist entries a network admin sets, not a plugin (downloads.claude.ai for "Plugin executable downloads"; storage.googleapis.com for "plugin metadata shown in /plugin").
corporate-launcher	Not relevant, checked against the page rather than dismissed as admin tooling: CLAUDE_CODE_PROCESS_WRAPPER wraps "every process Claude Code launches from its own binary — the background service, every session it hosts in agent view, and Claude Code's relaunches after an update". A plugin's ${CLAUDE_PLUGIN_ROOT}/bin/ invocation is a Bash-tool subprocess, not a Claude Code self-spawn, so the bin/ stance is unaffected and owes no change.
champion-kit, communications-kit	Not relevant — internal-advocacy and rollout-comms collateral.
accessibility, keybindings, terminal-config, voice-dictation, fullscreen, fast-mode	Not relevant — consumer client settings; no plugin declares or must accommodate them.
prompt-library	Not relevant — copy-paste prompts for users, not an authoring surface.

Doctrine added — one paragraph, plus four table rows. The cross-platform contract gains the host
axis, citing platforms and restating none of its facts. The three verbatim host facts (Desktop-in-WSL
sessions lack "connectors and plugins"; /plugin "[doesn't] work from the app" on mobile; Desktop's
Cowork tab sources plugins "not from the CLI's ~/.claude directory") live in the gate-run row, where
they carry a recheck trigger — not in the contract, which states only the rule they establish.

A dead citation, deliberately not fixed. Every doc URL this repo cites was checked live — all 81
slugs plus the 4 subpath citations (agent-sdk/overview, agent-sdk/agent-loop, agent-sdk/plugins,
whats-new/2026-w32). 84 of 85 return 200. One does not:
code.claude.com/docs/en/browser now 404s (chrome is the live page). Its sole occurrence
is plugins/playbooks/skills/boris/vendor/SKILL.md:938 — a verbatim upstream baseline kept for
drift detection, which the plugin README says to treat as untrusted and which /playbooks:update
owns. Hand-editing it would corrupt the vendor SHA it exists to compare. Recorded in the chrome row
with that path as its recheck trigger instead.

2. check-skill.sh check 5 — KEEP the extractor as-is (decided, recorded at the site)

Two premises are usually offered for narrowing to markdown-link targets. Both are false, and the
comment now says so, because the premise is what keeps the question alive:

1. "It matches bare paths in prose." It does not, and never did. Both generators are delimited —
   backtick-wrapped, or a ](…) link target — and both are scoped to the INTERNAL_DIRS allowlist.
   Naked prose cannot match. (fix(skill-quality): name the sibling skill when a cross-skill citation misses #2179's own summary and CHANGELOG entry describe it as extracting
   "prose and inline-code refs"; the in-script wording is corrected here to match what the greps do.)

2. "The backtick branch is redundant." Measured over the 196-skill corpus rather than argued:

   Measure	Count
   Backtick-form refs, all SKILL.md	282
   Link-form refs, all SKILL.md	475
   Unique backtick-form refs with no link form anywhere in the same file	122
   …spread across	39 skills
   …of those 122, resolving to a real file today	122 (100%)

   Narrowing would drop 122 real, currently-resolving supporting-file references across 39 skills.
   The link branch being the larger share is not the question; the overlap is, and 122 refs sit
   outside it.

The false-positive risk that motivated the proposal is real but latent, not observed — zero on
the current corpus. It is handled by message wording (every failure carries hand-verify the line before fixing, may be an illustrative example) rather than by deleting coverage of 39 skills.
Reopen only if a false positive is actually observed.

3. Check 12's 4-skill warning floor — INTENTIONAL, no dmi carve-out (all 4 confirmed)

#2181's reasoning holds, and upstream states the premise more strongly than #2181 did. The skills
doc's frontmatter-behavior table gives, for disable-model-invocation: true:
"Description not in context, full skill loads when you invoke" — so trigger phrasing on such a
skill cannot route anything, at all. user-invocable defaults to true (confirmed on the same page,
not assumed), so github:setup omitting it is slash-command-only, exactly its declared contract.

The load-bearing half of #2181's argument is the stranded-phrase test, which is an empirical claim
about the current tree, so each was re-checked against the tree rather than against #2181's prose:

Skill	Verdict	Confirmed against the tree
discipline:wait-what	Right to leave	Its description is the instruction; the trigger is noticing you have stopped following. No sibling needed — by construction the model cannot detect it.
firecrawl:update	Right to leave	Maintainer-only. Sibling firecrawl:firecrawl verified to carry the consumer phrases ('scrape this page', 'crawl this site', 'WebFetch is blocked', …). Nothing stranded.
playbooks:update	Right to leave	Maintainer-only. Sibling playbooks:boris verified to carry 'how does Boris use Claude Code', 'Claude Code workflow tips', 'optimize my CLAUDE.md', … Nothing stranded.
github:setup	Right to leave — the weakest of the four as originally argued, and it holds	#2181 argued from intent ("user-invoked only"). Checked instead for a stranded phrase: model-invocable siblings github:advise and github:audit carry the plugin's consumer-facing routing, including 'help me set up Y'. setup covers plugin prerequisites (gh auth, writing .claude/github/), which is a deliberate slash command, not a routing target.

No carve-out is added, and that is the recorded call. Exempting dmi-true from check 12 would
suppress a warning that is doing no harm while hiding the kindle-dedrm failure mode #2181 itself
surfaced — a phrase reachable only from a skill the model can never match. The floor stays; the
exemptions stay documented at the check-12 site.

Verification

Method. Every page was fetched with curl -sL …/<slug>.md — the raw markdown, not WebFetch.
That removes the summarizer and the truncation window from the loop entirely, so the METHOD RULE
holds trivially: every upstream sentence quoted in this PR and in the doctrine is verbatim from a
complete page, and a genuine "the page never states X" is a checkable claim rather than a routine
false negative. Byte counts confirm no truncation (e.g. desktop.md 96,288 bytes, vs-code.md
49,764). No page was asked to confirm a sentence from this repo.

The uncited set was re-derived, not inherited. The grep was also re-run with no --include
filters to be sure no citation lives in a file type the filter misses — identical result, 81
slugs, so 57 uncited is the real number.

Every cited URL was checked live: 84 of 85 (81 slugs + 4 subpath citations) return 200; the
single 404 is the vendored browser link described above.

The gate-1 check that decided the headline adopt was run against the page rather than assumed:
feature-availability's section headings are Availability by model provider, Availability by
subscription plan, and Model availability — no host-surface axis — and its only feature table
header row is | Feature | Pro | Max | Team | Enterprise |. Had it carried a host axis, platforms
would have been a redundant second index and this would be a decline instead.

Gates run the CI way, against the committed tree, base-ref form:

Gate	Result
bash scripts/check-contract-slice-prune.sh --check-diff origin/main	pass — leaves no path under docs/topics/
bash scripts/check-changelog-parity.sh --check-bump origin/main	pass
bash scripts/check-changed-skills.sh origin/main	pass — no changed skills
bash scripts/check-skill-portability.sh origin/main	pass — no skill files in scope
bash scripts/check-shell-portability.sh origin/main	pass — no unexcused GNU-only constructs
npx --yes markdownlint-cli2 over all 3 changed .md	0 errors
shellcheck + shfmt -i 2 -d on check-skill.sh	clean
bash -n check-skill.sh	clean
Line endings	all 5 changed files i/lf w/lf

Because the change to check-skill.sh is comments only, check-changed-skills.sh exercises
nothing — so the script was run directly to prove it still parses and behaves:

• check-skill.sh measure → PASS — 0 errors, 0 warning(s), all 10 base-ref trigger phrase(s) preserved.
• check-skill.sh wait-what → PASS — 0 errors, 2 warning(s), one of which is verbatim
  description has no 'Use when:' trigger phrasing — confirming the documented floor still fires as
  described rather than being silently suppressed.
• check-skill.test.sh runs to completion in CI (plugin-gate); locally on Windows/Git Bash it is
  impractically slow, per the coverage note fix(skill-quality): name the sibling skill when a cross-skill citation misses #2179 recorded. Nothing here is behavioral.

plugins/skill-quality → 0.15.2 with a matching ## [0.15.2] entry. The docs/ changes are
docs-only and owe no plugin bump; the upstream-drift Adopters registry already carries a row
for the gate-run table (added in #2177), and these rows join that table rather than create a new
adopter, so that convention needs no version change.

docs/OFFICIAL-DOCS.md gains the four newly load-bearing pages, per the rule its own warning states
and the precedent #2177's review set: a needed page that is not listed must be added.

No docs/topics/<slug>/ directory was created — the durable outcome is doctrine text, as the
Contract-tier prune rule requires.

Review rounds

Three threads, all real, all answered and resolved. Each found a defect in the basis of a row
rather than in its verdict, which is the failure mode a decision record most needs caught: a verdict
outlives the reasoning nobody re-reads.

• The GHES row's premise was overstated and its trigger fired on arrival (chatgpt-codex-connector).
  It claimed "every plugin README ships the github.com shorthand". Re-derived from the tree: 54 of 65
  carry the literal string, 9 carry no install block, dometrain points at another github.com
  marketplace, and plugins/github/README.md — deliberately marketplace-agnostic — uses the
  <marketplace-owner>/<marketplace-repo> placeholder. All are still owner/repo shorthand, so the
  trigger now names the form that actually signals a non-github.com host, a full git URL, of
  which the tree has none. The verdict stays Decline, but the review surfaced a real finding that had
  been waved through and is now recorded in the row: a consumer redistributing the github plugin
  from a GHES-hosted marketplace would follow that README and have the shorthand silently resolve to
  github.com instead of their own instance.
• "Platform" was doing two jobs (chatgpt-codex-connector). The existing feature-availability
  row and docs/OFFICIAL-DOCS.md both described that page as covering "platform, provider, and plan",
  while this change rests on the host axis being absent from it. Both senses of the word in one table
  would let a future audit read the host axis as already covered and retire the new row as redundant.
  The page's own sense is the provider platform — its axis headings are Availability by model
  provider and Availability by subscription plan — and both sites now say so explicitly.
• The platforms row claimed four evidence pages and quoted three (claude). Correctly
  diagnosed as a missing fact rather than an overstated page: vs-code does carry a host-axis fact,
  and the most directly plugin-relevant of the four — its CLI-vs-extension table gives
  Commands and skills as All for the CLI against Subset (type / to see available) for the
  extension, so a skill this fleet ships may not be reachable there. It is now quoted in the row.

All gates and markdownlint-cli2 re-run clean over the changed files after these edits. CI is green,
including plugin-gate — which runs check-skill.test.sh, the only executable proof that the
check-5 comment insertions changed no behavior.

Related

• docs(philosophy): run the Native-first adoption gate against six unevaluated platform surfaces #2177 — established the Recorded-gate-runs table and its four-part row form; this run extends it
  and corrects its page census (112 → 135 core pages, ~33 → 57 uncited)
• fix(skill-quality): name the sibling skill when a cross-skill citation misses #2179 — deferred the check-5 extractor question as "a separate call"; decided here
• fix(skills): give every skill description real 'Use when:' trigger phrasing #2181 — swept 196 skills for Use when: phrasing and left 4 with stated reasoning; all 4 re-reviewed
  and confirmed here
• fix(session-flow,discipline): drop the per-session subagent cap that no longer exists, and record the doc-currency audit #2169 — the gate doc-currency audit these findings trace back to

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 14s —— View job

---

Security review complete

• Gather context (PR diff via gh pr diff 2186)
• Read changed files: docs/OFFICIAL-DOCS.md, docs/PLUGIN-PHILOSOPHY.md, plugins/skill-quality/.claude-plugin/plugin.json, plugins/skill-quality/CHANGELOG.md, plugins/skill-quality/scripts/check-skill.sh
• Security review: injection surfaces, secrets handling, permission changes, shell script safety
• Post findings

No security issues found.

Scope of this PR's diff (+76/-2 across 5 files):

• docs/OFFICIAL-DOCS.md — adds 3 table rows citing code.claude.com URLs. Prose/markdown only, no executable content.

• docs/PLUGIN-PHILOSOPHY.md — adds doctrine text and 4 disposition table rows plus one paragraph in the cross-platform contract section. Prose only.

• plugins/skill-quality/.claude-plugin/plugin.json — version bump 0.15.1 → 0.15.2 only. No manifest field changes (permissions, hooks, MCP config, etc. are untouched).

• plugins/skill-quality/CHANGELOG.md — adds a changelog entry. Prose only.

• plugins/skill-quality/scripts/check-skill.sh — the only file with executable content, and the diff is comments-only. I diffed the actual code lines around both touched checks:

  • Check 5 (skill-internal ref resolution, check-skill.sh:369-449): the INTERNAL_DIRS allowlist, the git check-ignore gitignore check, the existence test ([[ ! -e "$SKILL_DIR/$ref" ]]), and the sibling-lookup loop are byte-for-byte unchanged except one in-place comment wording edit ("prose and inline-code refs" → "inline-code refs as well as link targets") — a factual correction to a comment, not a behavior change.
  • Check 12 (trigger-phrasing warning, check-skill.sh:554-576): a 16-line comment block was inserted immediately above the existing if [[ -n "$CUR_DESC" ]]; then ... block. The conditional logic, the grep -qi 'use when' test, and the skill_frontmatter::extract_triggers call are unchanged.

  No new shell constructs, variable expansions, eval, subprocess calls, or file writes were introduced anywhere in this file. No quoting regressions were introduced (all pre-existing "$var" quoting is untouched).

No GitHub Actions workflow files, hook scripts, MCP server configs, or permission-bearing manifests are touched by this PR, so there's nothing here that falls into the injection/secrets/permission-widening/supply-chain categories this review targets.

[claude]

Claude finished @kyle-sexton's task in 4m 4s —— View job

---

Review complete

• Gather context (PR diff, changed files)
• Review check-skill.sh changes (check 5 comment rewrite)
• Review docs/PLUGIN-PHILOSOPHY.md doctrine addition
• Review docs/OFFICIAL-DOCS.md additions
• Review plugins/skill-quality CHANGELOG + version bump
• Post findings

Summary

This is a docs/comments-only PR (check-skill.sh behavior is unchanged — I traced disable-model-invocation and confirmed it's read nowhere in the actual check-12 logic, and check-5's extraction generators were unchanged, only the comments around them). Cross-checked the internal consistency of the PR's own claims against the diff:

• The doctrine table's escaping is correct and deliberate: \| inside the GHES row's "Plugin marketplaces \| ✅ Supported" quote (needed so the pipe doesn't break the table), and \$ in the Ultrareview row's "\$5 to \$25 in usage credits" (needed to stop GitHub's inline-math renderer from treating $5 to $25 as LaTeX). Both are correct calls, not accidental escaping.
• The #cross-platform-contract anchor the new doctrine paragraph links to exists (## Cross-platform contract at PLUGIN-PHILOSOPHY.md:479).
• The 4 new docs/OFFICIAL-DOCS.md rows (platforms, ultrareview, chrome under Authoring; github-enterprise-server under Distribution) line up 1:1 with the 4 new gate-run table rows in PLUGIN-PHILOSOPHY.md, all dated 2026-08-10.
• The chrome row's dead-link claim checks out: plugins/playbooks/skills/boris/vendor/SKILL.md:938 does contain the docs/en/browser URL verbatim.
• The 1/0/3/4/49 = 57 disposition arithmetic in the PR body is internally consistent (I recounted the "not relevant" bullet list against the 49 figure, accounting for the desktop-wsl† dual-listing note — it sums correctly).
• check-skill.sh v0.15.2 bump + matching CHANGELOG.md entry + plugin.json version are all consistent with each other.

One finding, left as an inline comment on docs/PLUGIN-PHILOSOPHY.md:151:

• The PR description claims desktop, vs-code, mobile, and desktop-wsl are all "quoted verbatim" in the new platforms gate-run row. Only three of the four are — the row's WSL/mobile/Cowork-tab quotes trace to desktop-wsl, mobile, and desktop, but nothing traceable to vs-code appears anywhere in the diff. Given the PR's own standard (every claim traces to a fetched quote), this is worth tightening: either the row is missing a vs-code fact, or the description overstates that page's evidentiary contribution.

Everything else — the doctrine addition, the citation index updates, the check-skill.sh comment corrections, and the changelog/version bump — reads as accurate and well-supported by what's actually in the diff.

Not independently verified (author-claimed only, outside what I can check with available tools): the live 200/404 URL-fetch results, the byte-count/truncation claims, the shellcheck/shfmt/markdownlint/gate-script run outputs, and the 196-skill-corpus backtick/link-ref measurement (122 refs / 39 skills) cited in the check-5 comment and changelog.
(branch: gap/uncited)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74991f2893

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @kyle-sexton's task in 4m 20s —— View job

---

Code review complete

• Gather context (PR diff, changed files)
• Review docs/PLUGIN-PHILOSOPHY.md doctrine addition + gate-run rows
• Review docs/OFFICIAL-DOCS.md additions
• Review plugins/skill-quality/scripts/check-skill.sh comment changes
• Review plugins/skill-quality/CHANGELOG.md + version bump
• Cross-check against prior review threads (Codex, earlier Claude pass) for unresolved items
• Post findings

Summary

The follow-up commit (b924291) correctly resolves all three prior review findings:

• Codex's "reconcile the feature-availability axes" — fixed. docs/OFFICIAL-DOCS.md:76 and the gate-run row now both say "model provider and subscription plan," and the row explicitly distinguishes feature-availability's "platform" sense (provider platform) from the host-surface axis.
• Codex's "re-derive the GHES verdict" — fixed, and I independently re-ran the census against the current tree: grep -l "marketplace add melodic-software/claude-code-plugins" */README.md returns exactly 54; of the remaining 11, only dometrain (claude plugin marketplace add dometrain/mcp) and github (<marketplace-owner>/<marketplace-repo> placeholder) contain any marketplace add line at all — the other 9 have none. 54+9+1+1 = 65, matching the row's claim exactly, and no README anywhere uses a full git URL. The revised GHES row is accurate.
• The missing vs-code quote — fixed. I fetched https://code.claude.com/docs/en/vs-code directly and confirmed the "VS Code extension vs. Claude Code CLI" table literally reads Commands and skills | All | Subset (type / to see available), matching the new sentence added to the platforms gate-run row.

One finding (unchanged context line, not part of this diff's hunks — flagged here rather than as an inline comment)

docs/PLUGIN-PHILOSOPHY.md:493 (permalink:

claude-code-plugins/docs/PLUGIN-PHILOSOPHY.md

Line 493 in b924291

canonical input: fetch it when a platform, provider, or plan question decides something, and restate

) still reads:

"[Feature availability] is this contract's canonical input: fetch it when a platform, provider, or plan question decides something..."

This sentence predates the PR and wasn't touched, but the new paragraph inserted five lines below it (PLUGIN-PHILOSOPHY.md:498) now says the opposite: feature-availability "carries two axes, model provider and subscription plan" — explicitly not a platform/host axis, which is why platforms had to be adopted as a separate citation. In this file's own established usage, "platform" in the cross-platform-contract section means the OS axis (see line 482 "platform boundary," line 495 "platform itself does not ship on a supported OS," line 206 "OS platform" elsewhere) — so line 493 is telling an author to fetch feature-availability for OS questions, which the PR's own new text says it cannot answer (it "scopes itself to what runs locally," i.e. identically across every OS). This is the same conflation the PR's headline finding diagnoses in the contract's prior state; it just wasn't fully swept from this one sentence. Worth a one-line fix, e.g. dropping "platform" from that list or pointing it at platforms explicitly, so the two paragraphs don't talk past each other.

Everything else — the 57-page disposition doctrine, the check-skill.sh check-5 and check-12 comment rewrites (verified comments-only against the code diff; no behavior changed), the CHANGELOG.md entry, and the 0.15.1 → 0.15.2 version bump — is accurate and internally consistent.

Not independently re-verified (author-claimed, outside what this review checked): the live 84/85 URL-fetch results, byte-count/truncation claims, the 196-skill backtick/link-ref corpus measurement (122 refs / 39 skills), and the shellcheck/shfmt/markdownlint/gate-script CI run outputs.
· branch gap/uncited

[claude]

Claude finished @kyle-sexton's task in 55s —— View job

---

Security review complete

• Gather context (gh pr diff 2186 against origin/main)
• Read changed files: docs/OFFICIAL-DOCS.md, docs/PLUGIN-PHILOSOPHY.md, plugins/skill-quality/.claude-plugin/plugin.json, plugins/skill-quality/CHANGELOG.md, plugins/skill-quality/scripts/check-skill.sh
• Review for injection surfaces, secrets handling, permission changes, shell script safety
• Post findings

No security issues found.

Scope of this PR's diff (+78/-4 across 5 files):

• docs/OFFICIAL-DOCS.md (+5/-1) — adds/edits four table rows citing code.claude.com URLs. Prose/markdown only, no executable content, no secrets.

• docs/PLUGIN-PHILOSOPHY.md (+15/-1) — doctrine text, disposition table rows, and one paragraph in the cross-platform-contract section. Prose only.

• plugins/skill-quality/.claude-plugin/plugin.json (+1/-1) — version bump 0.15.1 → 0.15.2 only. No manifest field changes (no permissions, hooks, MCP config, or command-execution fields touched).

• plugins/skill-quality/CHANGELOG.md (+20/-0) — new changelog entry. Prose only.

• plugins/skill-quality/scripts/check-skill.sh (+37/-1) — the only file with executable content. Verified this is comments-only against origin/main:

  • Check 5 block (INTERNAL_DIRS extraction, ~line 378 onward): a 21-line comment block is inserted; the INTERNAL_DIRS allowlist assignment, the while IFS= read -r ref loop, and every existing conditional/quoting are byte-identical. One inline comment's wording changed ("prose and inline-code refs" → "inline-code refs as well as link targets") — text only.
  • Check 12 block (trigger-phrasing warning, ~line 554 onward): a 15-line comment block is inserted directly above the pre-existing if [[ -n "$CUR_DESC" ]]; then ... grep -qi 'use when' ... logic, which is unchanged.

  No new shell constructs, variable expansions, eval, subprocess/curl/network calls, file writes, or quoting changes appear anywhere in the diff. No $()/backtick command substitution or unquoted expansion was introduced.

Nothing in this diff touches GitHub Actions workflow files, hook scripts, MCP server configuration, or any permission-bearing manifest field, so there's no dangerous-trigger, script-injection-via-github-context, permission-widening, or supply-chain surface for this review to flag (and per instructions, zizmor's advisory lane already covers that class statically for workflow files, none of which are in scope here anyway).
(branch: gap/uncited)