You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vendor-scoped nested .markdownlint-cli2.jsonc (default: false) — verbatim third-party content exempted from local style rules without touching the managed root config (same pattern as PR feat: add thariq-skills plugin #53).
Gate evidence
claude plugin validate ./plugins/boris --strict — PASS
claude plugin validate . --strict (catalog manifest) — PASS
claude plugin details token cost: ~211 tok always-on, ~3.7k on-invoke (single skill)
--plugin-dir smoke test in a clean non-source repo — PASS: skill invoked, routed worktrees question to reference/worktrees.md, namespace confirmed as boris:boris
No hooks, no MCP servers, no agents, no userConfig — pure skill content.
Code execution surface: scripts/update.sh only, run solely on explicit maintainer invocation (never automatic). Sole network egress: curl to https://howborisusesclaudecode.com/api/version and /api/install (the upstream source, which publishes these endpoints for exactly this consumption) — no other outbound calls, no eval, no untrusted input into shell.
Cache isolation: no ../ reach-outs; script resolves paths relative to itself; update path in the skill body anchored via ${CLAUDE_SKILL_DIR}.
Taught placeholder names are written without their dollar-brace wrapper so Claude Code's inline substitution cannot rewrite the teaching content (lesson from PR feat: add thariq-skills plugin #53 review).
No PII / secrets.
Repo-agnostic: no source-repo references; body + script rewritten for plugin form (namespaced self-references, script-relative path resolution).
Merge note: expected marketplace.json + root README.md conflict with PR #53 (thariq-skills) — the playbook prescribes serializing final merges; whichever lands second rebases the two shared files.
Note
Low Risk
Read-only knowledge skill with no hooks or MCP; network use is limited to maintainer-invoked update.sh against the documented upstream URLs.
Overview
Adds the boris marketplace plugin: Boris Cherny’s Claude Code tips from howborisusesclaudecode.com, packaged like thariq-skills with progressive disclosure instead of one huge skill file.
Catalog:boris is registered in .claude-plugin/marketplace.json (learning) and summarized in the root README.md.
Skill shape: Hub SKILL.md (/boris:boris) with a topic index, quick reference, and update actions; eight reference/*.md topic slices (foundations through orchestration); verbatim vendor/SKILL.md for SHA drift checks. The hub tells agents to treat vendor content as untrusted (ignore upstream’s self-install UPDATE CHECK block).
Maintainer tooling:scripts/update.sh (--check / --apply) hits the site’s version/install APIs, syncs vendor + frontmatter, and leaves reference integration manual; update.test.sh covers helpers offline; vendor gets a nested markdownlint off config so third-party text isn’t restyled locally.
Reviewed by Cursor Bugbot for commit 7b85408. Bugbot is set up for automated code reviews on this repo. Configure here.
Ships Boris Cherny's Claude Code workflow tips
(howborisusesclaudecode.com) as an on-demand knowledge skill: 107 tips
across 95 sections, split into eight topic reference files behind a hub
SKILL.md. Bundles the verbatim upstream baseline under vendor/ plus a
maintainer-facing drift-check update script (--check/--apply) with
self-contained regression tests. A vendor-scoped nested markdownlint
config exempts the verbatim third-party baseline from local style rules
without touching the managed root config.
Co-Authored-By: Claude <noreply@anthropic.com>
This is a well-structured plugin addition that follows the marketplace playbook. The hub-and-spokes skill design (one SKILL.md hub routing to eight topic reference files) is context-efficient and well-documented. Security posture is minimal by design — no hooks, no MCP servers, no agents, no userConfig. Two substantive findings below; several minor notes.
Findings
1. replace_metadata_field — unchecked sed failure can corrupt SKILL.md (minor risk)
sed -E "s|^([[:space:]]+${field}:[[:space:]]+).*\$|\\1${value_safe}|" \
"$FRONTMATTER_FILE">"$tmp"
mv "$tmp""$FRONTMATTER_FILE"
If sed fails or produces empty output (e.g., the pattern didn't match), $tmp is created but may be empty, and the subsequent mv would silently overwrite FRONTMATTER_FILE with nothing. In practice the risk is low because field is always a hardcoded literal and value_safe is escaped — but the write-then-move pattern should still guard the sed exit code:
upstream_ver=$(fetch_upstream_version)|| {
err "failed to reach $VERSION_URL — network or DNS issue"return 2
}
run_check returns 2 on network error, but main calls run_check and propagates its return value directly as the exit code. The header comment documents exit 2 as "prereq missing or network failure" — that matches. However, run_apply has the same pattern and calls return 2 inside, which becomes the main exit code via run_apply's return. The logic is correct; the only gap is the tests don't cover this path (network calls are explicitly excluded as "network-free"). Worth noting but not a blocker.
Observations (no action required)
plugin.json has no skills array — discovery must be convention-based (skills/*/SKILL.md). Validation passed with --strict, so this is fine; just worth knowing if the schema evolves.
set -uo pipefail without -e — the comment at line 23 explains this is intentional (exit codes captured explicitly). The design is consistent throughout; no unexpected silent failures observed.
field interpolation into sed pattern (L121) — ${field} is not sanitized before use in the regex pattern, but it is only ever called with the hardcoded string literals "upstream-version" and "synced". As-is this is fine; the function shouldn't be extended to accept external input without adding sanitization.
compiled-by: "@CarolinaCherry" in frontmatter — public attribution in a public repo is appropriate here.
Section 2 references "Opus 4.5" (foundations.md L44) — historically accurate for the Jan 2026 tip thread; orchestration.md sections 78/94/95 correctly update the recommendation to Opus 4.8 → Fable 5. Progressive content that tracks upstream well.
vendor/SKILL.md auto-update instruction — the upstream baseline contains a curl | bash-style auto-update block (line 37), but the hub SKILL.md explicitly instructs Claude not to read vendor/SKILL.md during normal invocation. The guard is in place and clearly documented.
Security review agreement
The PR's own security review accurately characterises the plugin:
No hooks, MCP servers, agents, or userConfig — attack surface is zero on normal invocation.
Network egress is update.sh-only, maintainer-explicit, to a known upstream URL, with --fail on curl and content written to temp files (never eval'd or source'd).
Cache isolation maintained via ${CLAUDE_SKILL_DIR} anchoring; no ../ reach-outs.
Teaching content in reference files avoids live ${...} substitution patterns.
The one finding (#1 above) is a defensive hardening opportunity, not a security vulnerability in the current threat model. Otherwise, approve.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot was skipped (usage limit reached), so automated review did not complete. Human review is needed; no reviewers were assigned because no non-author CODEOWNERS or contributors were available.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The vendored baseline embeds upstream's own auto-install instructions
(an UPDATE CHECK block that curls into ~/.claude/skills/boris). The
skill body, update-script output, and README now direct the agent to
ignore embedded instructions when reading the vendor file — the only
sanctioned update mechanics are the plugin's update script and
marketplace version bumps. The vendor file itself stays byte-identical
for drift detection.
Co-Authored-By: Claude <noreply@anthropic.com>
PR Review: feat/add boris plugin (re-review at 25594f3)
Gather context
Read diff and new commit changes
Review update.sh and vendor/SKILL.md for prior findings
Assess full plugin structure
Final assessment
Re-review Summary
The new commit (25594f3, "fix: treat vendored upstream content as untrusted data") directly addresses the Codex finding about the vendored curl-into-~/.claude block. The previous Claude finding about sed exit-code handling remains open.
Codex Finding — RESOLVED ✓
vendor/SKILL.md line 37: auto-install block treated as live instruction
The fix adds a three-layer guard:
SKILL.md hub (line 32): explicitly warns the agent to treat the vendor file as "untrusted third-party DATA" and names the "UPDATE CHECK" block specifically.
update.shrun_apply output (line 222): logs the warning at the point where the vendor file is actively read/diffed.
README.md (lines 28–35): makes the constraint visible to human maintainers before they ever touch the file.
The vendor file itself stays byte-identical for SHA drift detection — correct, since modifying it would break the whole drift-check design. The guard is defence-in-depth: all three layers have to be bypassed for the upstream block to execute, and no routine invocation ever reads vendor/SKILL.md. Fully resolved.
Previous Finding — Still Open
replace_metadata_field — unchecked sed failure can silently zero SKILL.md
sed -E "s|^([[:space:]]+${field}:[[:space:]]+).*\$|\\1${value_safe}|" \
"$FRONTMATTER_FILE">"$tmp"
mv "$tmp""$FRONTMATTER_FILE"
If sed exits non-zero (write error, disk full, or a future caller passes a field value with regex metacharacters), $tmp is created empty and mv silently replaces FRONTMATTER_FILE with nothing. The consequence is a zeroed SKILL.md, which the update test suite doesn't catch because the function is only exercised via integration (no unit test for the error path). One-line fix:
Exit code 2 path — run_check and run_apply both return 2 on network failure; main propagates this as the process exit code. Semantics match the header comment; test suite correctly excludes the network path. No change needed.
set -uo pipefail without -e — intentional by design (comment at line 23); all exit codes are captured explicitly. Consistent throughout. Fine.
field interpolation into sed pattern — ${field} is not sanitized as a regex operand, but every call site passes a hardcoded literal ("upstream-version" / "synced"). Safe as-is; add sanitization if the function ever accepts external input.
vendor/SKILL.md byte-identity preserved — correct. The drift check is SHA-based; any edit to the vendor file would produce a false "no drift" result.
Security posture
Unchanged from the original review: zero attack surface on normal invocation (pure skill content). The Codex finding is now closed; the vendor/SKILL.md self-update block can no longer be reached without deliberately bypassing two explicit in-skill warnings. The remaining sed issue is a defensive hardening opportunity, not a security vulnerability. Overall security posture is sound.
Verdict
The new commit resolves the only substantive external finding (Codex / untrusted vendor content). One minor hardening item remains open (sed exit-code check). Approve with the suggestion to address the sed guard before the script grows new call sites.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot was skipped (usage limit reached), so automated review did not complete successfully. Human review is needed; no reviewers were assigned because no non-author contributors are available.
Sent by Cursor Approval Agent: Pull Request Router and Approver
For `update` actions, dispatch to `bash "${CLAUDE_SKILL_DIR}/scripts/update.sh" …`
I WebFetched the plugins reference (as required by CLAUDE.md's fresh-docs mandate). The docs state: "Claude Code provides three variables for referencing paths" — ${CLAUDE_PLUGIN_ROOT}, ${CLAUDE_PLUGIN_DATA}, and ${CLAUDE_PROJECT_DIR}. ${CLAUDE_SKILL_DIR} is not among them and is not mentioned anywhere in the reference.
When Claude Code performs inline variable substitution in skill content, ${CLAUDE_SKILL_DIR} either expands to empty (if the shell env var is unset) or is left as a literal string. Either way, the bash "${CLAUDE_SKILL_DIR}/scripts/update.sh" dispatch resolves to a non-existent path and the /boris:boris update action silently fails.
Fix — replace with the canonical path:
-For `update` actions, dispatch to `bash "${CLAUDE_SKILL_DIR}/scripts/update.sh" [--check|--apply|--help]`.+For `update` actions, dispatch to `bash "${CLAUDE_PLUGIN_ROOT}/skills/boris/scripts/update.sh" [--check|--apply|--help]`.
This was Codex's P2 comment on the prior round. The PR author replied to the vendor finding but not to this one. It is still open in the current HEAD.
sed -E "s|^([[:space:]]+${field}:[[:space:]]+).*\$|\\1${value_safe}|" \
"$FRONTMATTER_FILE">"$tmp"
mv "$tmp""$FRONTMATTER_FILE"
If sed exits non-zero (write error, disk full, or a future caller passes a field value with regex metacharacters), $tmp is created as an empty file and the mv silently replaces FRONTMATTER_FILE with nothing — zeroing the skill's frontmatter with no error output.
This has been flagged in both previous Claude reviews (rounds 1 and 2). It is not a blocker in the current call sites (both callers pass hardcoded literals), but remains an unaddressed defensive hardening item. The test suite exercises the happy path (case 6) but not the error path.
Test suite (update.test.sh) — 19 checks cover help flags, source-guard, frontmatter parsing, field mutation, and SHA helpers. Coverage matches the stated network-free scope. No gaps beyond the sed error path noted above.
plugin.json has no skills array — discovery is convention-based. Passed --strict validation; no action needed.
Security posture — unchanged from previous rounds: zero attack surface on normal invocation (pure skill content). update.sh network egress is maintainer-explicit, --fail-guarded, never eval'd.
Finding #1 (${CLAUDE_SKILL_DIR}) is a functional bug that breaks the /boris:boris update dispatch on every invocation. It should be fixed before merge — the one-word replacement is confirmed against the live docs. Finding #2 is defensive hardening worth addressing alongside it. Everything else is sound. Request changes on finding #1; finding #2 is a strong suggestion.
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Cursor Bugbot was skipped (usage limit reached), so automated review did not complete successfully. Human review is needed; no reviewers were assigned because no non-author contributors are available.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Refresh upstream before the initial publish
This publishes the new skill as synced to upstream v8.8.1 on 2026-06-12, but the linked source currently advertises 118 tips and includes newer sections such as Finding Your Unknowns, Getting Started With Loops, and /checkup; the split reference files here still stop at sections 78–95/Fable 5. Users installing the plugin now will get stale workflow guidance from the first release, so please refresh the vendor baseline and manually port the new sections before publishing 0.1.0.
The reason will be displayed to describe this comment to others. Learn more.
Stop --apply when the vendor copy fails
When --apply runs with an unwritable/full destination, this cp failure is ignored because the script intentionally does not use set -e; the following log and metadata bump still run and run_apply returns 0, which can leave vendor/SKILL.md unsynced while SKILL.md is stamped to the new upstream version. Please make the mutating steps (mkdir, cp, and the metadata writes) return a non-zero error before reporting success.
Closesmelodic-software/medley#1285.
Publishes the `docs-hygiene` plugin per `docs/MIGRATION-PLAYBOOK.md`
(per-plugin gate + acceptance security review). One cohesive capability
— documentation hygiene — bundling five skills.
## What ships
- `/docs-hygiene:compress` — flavor-trims markdown behind a mandatory
fresh-context semantic-diff audit that reverts any semantic loss;
optional `caveman` plugin backend (qualified `/caveman:compress`
invocation, graceful in-session Edit fallback); optional snapshots
persist under the plugin data directory.
- `/docs-hygiene:declutter` — read-only classifier for five markdown
noise shapes with internalized shape definitions, tier semantics,
exemptions, and opt-out markers (no source-repo rule dependencies).
- `/docs-hygiene:extract-ssot` — Rule-of-Three deduplication into a
single source of truth with refuse-fast verification gates and
internalized evidence discipline.
- `/docs-hygiene:encapsulation-audit` — detects citations into
skill-private surfaces; ships its own
`context/public-surface-contract.md`; detector generalized to scan any
consumer repo's instruction surfaces.
- `/docs-hygiene:rename-references` — 12-form stale-reference pattern
library (slash tokens, moved-file relative paths, frontmatter
chains/globs) with audit, half-rename, and apply modes.
Adaptation notes: source-repo rule citations internalized or routed to
the consuming repo's own CLAUDE.md/rules; scripts resolve paths via
BASH_SOURCE and scan the repo they run in; `${CLAUDE_SKILL_DIR}` anchors
all script invocations; taught placeholder names written without
dollar-brace wrappers (substitution lesson from PR #53); eval suites
intentionally NOT shipped (the eval runner is authoring-repo-side;
shipping them would be dead weight with broken references).
## Gate evidence
- `claude plugin validate ./plugins/docs-hygiene --strict` — PASS;
`claude plugin validate . --strict` (catalog) — PASS
- `claude plugin details` token cost: **~1,161 tok always-on** (compress
~340, declutter ~280, encapsulation-audit ~150, extract-ssot ~170,
rename-references ~230); on-invoke ~2.6k–6.4k per skill
- Script tests: 73 checks across 4 self-contained suites (compress 9,
declutter 17, encapsulation-audit 32, extract-ssot 15) — all pass,
network-free, fixture-repo based
- shellcheck (repo rcfile) clean on all 9 shell files; shfmt clean;
markdownlint 0 errors (24 files); typos clean; editorconfig-checker
clean
- `--plugin-dir` smoke test in a clean non-source repo — PASS:
`/docs-hygiene:declutter` invoked, answered the five noise shapes,
namespace confirmed as `docs-hygiene:declutter`
## Security review (playbook acceptance)
- No hooks, no MCP servers, no agents, no `userConfig`.
- Code execution surface: bundled scripts are read-only detectors and
fact emitters (grep/awk over the consuming repo's tracked files). **Zero
network egress** — verified by grep over all shell files (no
curl/wget/nc; the only `http` hit is a URL string inside a test
fixture).
- Cross-plugin trust: `compress` can delegate mechanical compression to
the third-party `caveman` plugin ONLY when the consumer has installed
it; detection is capability-probing, invocation is the qualified
`/caveman:compress` form, and the built-in fallback keeps the skill
fully functional without it. No other plugin is referenced.
- Cache isolation: no `../` reach-outs; state (optional compress
snapshots) goes to the plugin data directory.
- No PII / secrets.
Merge note: PRs #53 and #56 also touch `marketplace.json` + root
`README.md` — the playbook prescribes serializing final merges;
whichever lands later rebases the two shared files.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Documentation and read-only/local shell tooling only—no hooks, MCP,
network calls, or automatic repo writes beyond what users invoke via
skills; optional third-party `caveman` compression is opt-in.
>
> **Overview**
> Adds the **`docs-hygiene`** plugin to the marketplace catalog and root
README, bundling five on-demand skills for keeping tracked markdown
lean, deduplicated, and correctly referenced in any consumer repo.
>
> **`/docs-hygiene:compress`** tightens prose by cutting flavor while a
mandatory fresh-context semantic-diff pass reverts semantic loss; it
optionally uses the **`caveman`** plugin as a mechanical backend with an
in-session Edit fallback, snapshots, and `markdownlint-cli2` gates.
**`declutter`** is read-only noise classification (five shapes, tiered
findings) backed by **`detect.sh`** and shared shape detectors.
**`extract-ssot`** encodes Rule-of-Three markdown dedup with `identify`
/ `verify` / `plan` / `execute` / `batch` / `unwind`, private action
docs, and **`emit-verify-facts.sh`**. **`encapsulation-audit`** ships
**`public-surface-contract.md`** plus **`detect.sh`** (private skill
paths, heading anchors, schemas; `scripts/` carve-out).
**`rename-references`** is documented as the post-rename sweep skill
(12-form patterns); sibling skills cite it after migrations.
>
> Scripts are repo-local, read-only where applicable, always-exit-0 or
explicit exit codes for audits, and covered by self-contained bash test
suites (`detect-caveman`, declutter, encapsulation-audit, extract-ssot).
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
e19b05c. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
Closesmelodic-software/medley#1293.
Publishes the `fable-5-playbook` plugin per `docs/MIGRATION-PLAYBOOK.md`
(per-plugin gate + acceptance security review).
## What ships
- `plugins/fable-5-playbook/` — one knowledge skill
(`/fable-5-playbook:fable-5-playbook`): Claude Fable 5's operating
doctrine, authored by Fable 5 as introspected standing instructions.
Core doctrine arms the session on invocation; twelve trigger-routed
chapters under `context/` (calibration, reasoning-moves,
problem-framing, planning, execution, debugging, orchestration,
verification, communication, recovery, context-economy,
trust-and-authority) plus `context/opus-adaptation.md` for non-Fable
models.
- Marketplace entry: `category: learning`, tags `knowledge` + component
tags. Explicit `version: 0.1.0` in `plugin.json` only.
- The source skill was already repo-agnostic (no repo-specific paths,
tools, or slash references); the only content deltas from the source are
the frontmatter description compressed to two sentences and one typo fix
(`mis-framed` → `misframed`).
## Gate evidence
- `claude plugin validate ./plugins/fable-5-playbook --strict` — PASS;
`claude plugin validate . --strict` (catalog) — PASS
- `claude plugin details` token cost: **~207 tok always-on**, ~4.7k
on-invoke (single skill)
- markdownlint 0 errors (15 files); typos clean; editorconfig-checker
clean
- `--plugin-dir` smoke test in a clean non-source repo — PASS: skill
invoked, answered the four meta-rules (Precedence, One home per
doctrine, Model adaptation, Silent application), namespace confirmed as
`fable-5-playbook:fable-5-playbook`
## Security review (playbook acceptance)
- Pure knowledge skill: no hooks, no MCP servers, no agents, no
`userConfig`, no scripts, no state, zero network access.
- Cache isolation: all references are skill-internal (`context/*.md`
self-citations); no `../` reach-outs.
- No PII / secrets.
Merge note: open PRs #53, #56, #57 also touch `marketplace.json` + root
`README.md` — merge serially; later ones rebase/merge the two shared
files (this branch is based on post-context7 main, so it conflicts only
with those unmerged siblings).
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Markdown-only plugin packaging and catalog updates; no executable
code, credentials, or runtime side effects beyond skill text loaded into
Claude Code.
>
> **Overview**
> Adds the **`fable-5-playbook`** plugin to the marketplace and root
catalog — a pure knowledge skill (no hooks, MCP, scripts, or
`userConfig`) that arms sessions with Claude Fable 5’s operating
doctrine.
>
> **`SKILL.md`** loads core standing instructions on invoke (bare /
`full` / chapter name), defines four meta-rules, effort floors, a
chapter routing table, and cites twelve on-demand **`context/*.md`**
chapters (calibration through trust-and-authority) plus mandatory
**`opus-adaptation.md`** for non-Fable models. Plugin **`README.md`**
and **`plugin.json`** (`0.1.0`, learning category) document install and
scope.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
03fa989. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude <noreply@anthropic.com>
Closesmelodic-software/medley#1296.
Publishes the `firecrawl` plugin per `docs/MIGRATION-PLAYBOOK.md`
(per-plugin gate + acceptance security review).
## What ships
- `plugins/firecrawl/` — one skill (`/firecrawl:firecrawl`): wraps the
`firecrawl-cli` binary for
scrape/search/crawl/map/parse/interact/agent/monitor with the core
write-to-disk-then-Read pattern (results land in tempfiles via `-o`; the
agent reads only the needed slice — 32–35× token savings vs the MCP per
the Scalekit benchmark cited in the skill).
- `context/commands.md` (full flag tables, carried verbatim),
`context/configuration.md` + `context/update-flow.md` (adapted
repo-agnostic).
- Maintainer-facing `scripts/update.sh` (`--check` read-only CLI-version
+ upstream-SHA drift report; `--apply` npm upgrade + `UPSTREAM.md`
rewrite behind approval gates; never touches SKILL.md — content
integration is a gated manual step) with a new self-contained
`update.test.sh` (17 checks, network-free).
- `UPSTREAM.md` sidecar (SHA-tracking sync state + rollback version).
- Marketplace entry: `category: utilities`. Explicit `version: 0.1.0` in
`plugin.json` only.
## Gate evidence
- `claude plugin validate ./plugins/firecrawl --strict` — PASS; catalog
`--strict` — PASS
- `claude plugin details` token cost: **~253 tok always-on**, ~4.9k
on-invoke
- `update.test.sh` 17/17 PASS; shellcheck (repo rcfile) clean; shfmt
clean; markdownlint 0 errors; typos clean; editorconfig-checker clean
- Smoke test via `--plugin-dir` — PASS: skill body loaded, answered the
write-to-disk flag (`-o`) from the body, namespace confirmed as
`firecrawl:firecrawl`. The smoke run surfaced two real
headless-permission defects that are fixed in this PR: a
credential-shaped `printenv FIRECRAWL_API_KEY` preamble line was
rejected by permission preflight (removed — `firecrawl --status` already
reports auth), and the status/sync preamble lines needed narrow
`allowed-tools` grants (`Bash(command -v firecrawl*)`, `Bash(firecrawl
--status*)`, `Bash(grep -m1 *UPSTREAM.md*)`). Caveat: in a fully
sandboxed scratch dir the preamble lines may still fall back to their
error text; the skill body loads and functions regardless.
## Security review (playbook acceptance)
- No hooks, no MCP servers, no agents, no `userConfig`.
- Data egress (normal invocation): the user-installed `firecrawl-cli`
calls `api.firecrawl.dev` (or a self-hosted `FIRECRAWL_API_URL`) — that
is the plugin's documented purpose. The credential is the consumer-owned
`FIRECRAWL_API_KEY` env var; never stored in or written by the plugin.
Env-var auth is preferred over `firecrawl login`/`config` explicitly to
avoid a second credential store.
- Data egress (update path, maintainer-invoked only):
`registry.npmjs.org` (version metadata) + `www.firecrawl.dev` (upstream
skill source, hashed in a tmpdir). `npm install -g` and any SKILL.md
rewrite sit behind two explicit approval gates; `--check` is read-only.
- The skill hard-prohibits `firecrawl init` (would install a parallel
MCP + skill copy) and documents the login/config divergence risk.
- Cache isolation: script resolves paths relative to itself; preamble
reads its own `UPSTREAM.md` via the skill-dir substitution; no `../`
reach-outs.
- No PII / secrets.
Merge note: open PRs #53, #56, #57, #59 also touch `marketplace.json` +
root `README.md` — merge serially; later ones need a conflict-merge of
the two shared files.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> New plugin steers agents toward external Firecrawl API egress and
credit use via a user-installed CLI and `FIRECRAWL_API_KEY`; maintainer
`--apply` runs `npm install -g`, but there are no hooks/MCP and updates
are gated.
>
> **Overview**
> **Adds a new `firecrawl` plugin** to the marketplace and root catalog,
shipping `/firecrawl:firecrawl` as the maintained `firecrawl-cli`
integration (scrape, search, crawl, map, parse, interact, agent,
monitor) instead of the Firecrawl MCP.
>
> The skill centers on **write-to-disk then `Read`** (`-o` tempfiles)
with escalation tables for when to use Firecrawl vs WebFetch, narrow
**`allowed-tools`** for the status/sync preamble (`firecrawl --status`,
`UPSTREAM.md` grep), and prohibitions against `firecrawl init` /
login-style config drift. Supporting **`context/`** docs cover flags,
env defaults, and the maintainer update pipeline; **`UPSTREAM.md`**
records upstream SHA and CLI rollback versions.
>
> **Maintainer tooling:** `scripts/update.sh` (`--check` read-only drift
vs npm + upstream skill; `--apply` global `npm install` + `UPSTREAM.md`
rewrite only, not `SKILL.md`) and network-free **`update.test.sh`**
regression checks.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
3184b4e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Closes melodic-software/medley#1292.
Publishes the
borisplugin perdocs/MIGRATION-PLAYBOOK.md(per-plugin gate + acceptance security review).What ships
plugins/boris/— one knowledge skill (/boris:boris): Boris Cherny's Claude Code workflow tips (howborisusesclaudecode.com), 107 tips across 95 sections, hub SKILL.md + eight topic reference files (progressive disclosure).skills/boris/vendor/SKILL.md(SHA-verified byte-identical to the source repo copy) for drift detection.scripts/update.sh(--checkread-only drift report /--applyvendor + frontmatter sync; reference-file integration stays manual) with self-containedupdate.test.sh(19 checks, network-free).category: learning, tagsknowledge+ component tags. Explicitversion: 0.1.0inplugin.jsononly..markdownlint-cli2.jsonc(default: false) — verbatim third-party content exempted from local style rules without touching the managed root config (same pattern as PR feat: add thariq-skills plugin #53).Gate evidence
claude plugin validate ./plugins/boris --strict— PASSclaude plugin validate . --strict(catalog manifest) — PASSclaude plugin detailstoken cost: ~211 tok always-on, ~3.7k on-invoke (single skill)--plugin-dirsmoke test in a clean non-source repo — PASS: skill invoked, routed worktrees question toreference/worktrees.md, namespace confirmed asboris:borisupdate.test.sh19/19 PASS; shellcheck (repo rcfile) clean; shfmt clean; markdownlint 0 errors (11 files); typos clean; editorconfig-checker cleanSecurity review (playbook acceptance)
userConfig— pure skill content.scripts/update.shonly, run solely on explicit maintainer invocation (never automatic). Sole network egress:curltohttps://howborisusesclaudecode.com/api/versionand/api/install(the upstream source, which publishes these endpoints for exactly this consumption) — no other outbound calls, noeval, no untrusted input into shell.../reach-outs; script resolves paths relative to itself; update path in the skill body anchored via${CLAUDE_SKILL_DIR}.Repo-agnostic: no source-repo references; body + script rewritten for plugin form (namespaced self-references, script-relative path resolution).
Merge note: expected
marketplace.json+ rootREADME.mdconflict with PR #53 (thariq-skills) — the playbook prescribes serializing final merges; whichever lands second rebases the two shared files.Note
Low Risk
Read-only knowledge skill with no hooks or MCP; network use is limited to maintainer-invoked
update.shagainst the documented upstream URLs.Overview
Adds the
borismarketplace plugin: Boris Cherny’s Claude Code tips from howborisusesclaudecode.com, packaged likethariq-skillswith progressive disclosure instead of one huge skill file.Catalog:
borisis registered in.claude-plugin/marketplace.json(learning) and summarized in the rootREADME.md.Skill shape: Hub
SKILL.md(/boris:boris) with a topic index, quick reference, andupdateactions; eightreference/*.mdtopic slices (foundations through orchestration); verbatimvendor/SKILL.mdfor SHA drift checks. The hub tells agents to treat vendor content as untrusted (ignore upstream’s self-install UPDATE CHECK block).Maintainer tooling:
scripts/update.sh(--check/--apply) hits the site’s version/install APIs, syncs vendor + frontmatter, and leaves reference integration manual;update.test.shcovers helpers offline; vendor gets a nested markdownlint off config so third-party text isn’t restyled locally.Reviewed by Cursor Bugbot for commit 7b85408. Bugbot is set up for automated code reviews on this repo. Configure here.