chore: declare shell: bash on every skill with dynamic-context injections

[kyle-sexton]

What

Fleet sweep: every SKILL.md using !`command` dynamic-context injection now declares shell: bash in frontmatter — 65 skills across 26 plugins, each plugin patch-bumped with a CHANGELOG entry.

Why

The pinned precompute convention (plugins/playbooks/skills/skill-authoring/reference/precompute-context.md, "Windows / shell: awareness") requires portable injection commands or an explicit shell: declaration. The fleet's injections are bash-only (|| fallbacks, 2>/dev/null, pipes), and with shell: undeclared they fall through to the PowerShell tool on a Windows host without Git Bash, silently inlining broken output into every skill load. Originally surfaced against knowledge:youtube-digest; a census showed the same gap in all 64 injection-bearing skills, so the sweep fixes the class, not the instance.

shell is the official frontmatter key (bash default | powershell), verified against the skills documentation this session.

Gates

• claude plugin validate . — PASS
• markdownlint-cli2 — 0 errors on all changed CHANGELOGs
• scripts/check-changelog-parity.sh --check — PASS (all 26 bumps carry CHANGELOG entries)
• skill-quality check sample (youtube-digest) — PASS

Follow-up

Enforcement (skill-quality check: injections present ⇒ shell: declared or commands portable) tracked separately.

Related

• No linked issue — fleet hygiene sweep from a carried handoff item; closes nothing.

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 3m 23s —— View job

---

PR Review

• Gather context and understand request
• Review PR diff and changed files
• Verify shell: bash placement and correctness in SKILL.md files
• Verify plugin.json version bumps and CHANGELOG entries
• Check for missed skills / completeness
• Post review findings

---

Overall: ✅ LGTM — fleet sweep is correct and complete.

The PR does exactly what it says: adds shell: bash to the frontmatter of every SKILL.md that uses bash-only ! dynamic-context injections, patch-bumps all 26 affected plugins, and logs a CHANGELOG entry for each. No issues found.

Completeness check

Cross-referenced every SKILL.md file in the repo against what the PR touched:

• 64 skills patched — all have bash-specific injection commands (2>/dev/null, || fallbacks, pipes, $() subshells).
• 10 skills excluded — already declared shell: bash before this PR (source-control/pull-request, resolve-conflicts, worktree; all testing/, toolchain/, and verification/ skills). Confirmed by reading their current frontmatter.
• No injection-bearing skill missed.

The PR description's stated count of "64 skills across 26 plugins" matches exactly.

Placement and syntax

shell: bash is placed consistently as the last key before the closing ---, after disable-model-invocation, which is the same position used by skills that already had the declaration. This is correct — the key is valid YAML frontmatter and the runtime resolves it before evaluating ! blocks.

Version bumps

All 26 plugins receive a patch bump (x.y.Z → x.y.(Z+1)), which is the appropriate semver level for a non-breaking metadata-only change. No minor/major bumps applied where they weren't warranted.

CHANGELOG entries

Every bumped plugin carries a new entry at the top of its CHANGELOG with a consistent explanation tied to the convention. The entries correctly reference the precompute convention's "Windows / shell: awareness" requirement.

Incidental changes in plugin.json

Several plugin.json files reformatted their keywords arrays from inline (["a","b","c"]) to multiline form. This is cosmetic and correct JSON, but it does expand the diff beyond the stated one-liner-per-plugin scope. It's harmless — noting it only so reviewers aren't confused by the larger +/- counts on those files.

Convention alignment

The change directly implements the pinned policy in plugins/playbooks/skills/skill-authoring/reference/precompute-context.md:

"Write injection commands portably, or declare shell: explicitly, so a bash-only pipeline doesn't silently break on a PowerShell host."

No gaps between the convention and the implementation found.

[claude]

Claude finished @kyle-sexton's task in 2m 33s —— View job

---

Security Review

• Gather context and understand request
• Fetch PR diff and changed files
• Review SKILL.md changes for injection surfaces
• Review plugin.json changes for security implications
• Assess shell injection risks in dynamic-context commands
• Post security findings

---

Scope

This PR makes exactly two kinds of changes across 100 files: adding shell: bash to SKILL.md frontmatter and bumping patch versions in plugin.json manifests. No injection commands, hook scripts, MCP configs, or GitHub Actions workflows were modified.

---

Findings

No security vulnerabilities introduced by this PR.

The review covered every changed file category:

SKILL.md changes (64 files — each adds shell: bash to frontmatter only)

The injection commands (! precompute context lines) are pre-existing and unchanged. I examined the full set including the most complex ones: observability, orient, handoff, retro, running-retro, fanout, youtube-digest, and skill-authoring. Across all of them:

• user_config.* variables appear only in prose/instruction content, never inside !-injection command strings — so there is no vector for a consumer's userConfig value to escape into shell command evaluation.
• Framework environment variables (CLAUDE_CODE_SESSION_ID, CLAUDE_PLUGIN_ROOT, CLAUDE_PLUGIN_DATA) are used inside double-quoted contexts. In bash, variable expansion inside double quotes does not re-evaluate the expanded string as shell code, so even a pathological value like $(id) stored in CC_OTEL_STORE would be treated as a literal string when assigned to a variable and subsequently used in [[ -f "$d/$f" ]] or wc -c < "$d/$f".
• The source "${CLAUDE_PLUGIN_ROOT}/skills/observability/otel/net-probe.sh" pattern sources a script from the plugin installation root — a path controlled by the Claude Code framework, not by user configuration. This is a pre-existing pattern not introduced or worsened by this PR.
• Read-only commands (git branch, git log, git status, command -v, wc -l, version flags) dominate the injection set; none accept untrusted input.

plugin.json changes (26 files — version bumps and keywords array reformatting only)

No new capabilities, MCP server entries, subagent definitions, install hooks, remote references, or permission widening. The reformatting of keywords arrays from inline to multi-line is cosmetic. Version bumps are patch-level and consistent with the stated change.

GitHub Actions / CI

No workflow files were modified.

---

Net assessment

The shell: bash declaration makes the existing bash dependency explicit rather than implicit — a correctness fix, not an attack-surface expansion. The change is safe to merge from a security standpoint.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af6944e0cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 1m 14s —— View job

---

PR Review (synchronize)

• Gather context on incremental commits since last review
• Review the stateless SKILL.md fix (deac426)
• Review the source-control sentence wrap fix (80bda95)
• Verify no regressions from the merge commit (4fd2c72)
• Post review findings

---

Incremental review — commits since af6944e

Three commits landed after the prior LGTM review. All three are correct.

deac426 — plugins/claude-memory/skills/stateless/SKILL.md

shell: bash added at line 7, consistent placement with the rest of the fleet (after disable-model-invocation, before the closing ---). The skill's injection is a fenced ```! block, not the inline backtick form the original census searched — the miss was mechanical, not editorial. The fix is correct: bash "${CLAUDE_PLUGIN_ROOT}/skills/stateless/scripts/scope-report.sh" is bash-specific and required the declaration.

80bda95 — plugins/source-control/skills/babysit-prs/SKILL.md

The shell: bash line added in the main sweep pushed babysit-prs from 499 to the 500-line hard cap. Rejoining one wrapped sentence at line 287 restores the file to 499 lines — confirmed by wc -l. The prose meaning is unchanged; the join is semantically clean.

4fd2c72 — merge from origin/main

Standard merge commit; no content changes beyond what the two fixes introduced.

---

Overall: ✅ LGTM — the two fixes are correct and the PR is ready to merge.

The Codex-reported miss (stateless) is resolved, the 500-line cap compliance is restored, and a re-run of the census over both injection forms (inline backtick and fenced block) confirms no remaining gaps.

[claude]

Claude finished @kyle-sexton's task in 3m 57s —— View job

---

Security Review

• Gather context and understand request
• Fetch PR diff and examine changed files
• Inspect SKILL.md injection commands for shell injection surfaces
• Check plugin.json changes for permission or capability widening
• Review new shell scripts for injection surfaces and unsafe patterns
• Assess GitHub Actions patterns (none changed)
• Post security findings

---

Scope

This PR makes changes across four categories:

1. 65 SKILL.md files — each adds shell: bash to frontmatter only; injection commands are untouched.
2. 26 plugin.json files — version bumps and keywords array reformatting only.
3. New file — plugins/docs-hygiene/skills/audit-noise/scripts/lib/parse-concern-value.sh
4. Modified files — noise-shapes.sh (refactored to call parse-concern-value.sh) and detect.test.sh (new test case).

No GitHub Actions workflow files were modified.

---

Findings

SKILL.md changes — no new surfaces

All 65 diffs are single-line additions of shell: bash. None modify the existing !-injection commands. The bash-only constructs (|| fallbacks, pipes, 2>/dev/null, $()) are pre-existing and unchanged; confirming the declared shell is a correctness fix, not an attack-surface change.

plugin.json changes — no capability widening

Every plugin.json diff is a patch version bump and/or a keywords array reformat (inline → multi-line JSON). Spot-checked all 26: no new MCP server entries, no install hooks added, no permission grants widened, no new userConfig keys, no new external dependencies or unpinned remote references.

parse-concern-value.sh — one latent concern worth noting

SUGGESTION · confidence: PLAUSIBLE

Line 106:

raw_line=$(sed -n "s/^${key}:[[:space:]]*//p" "$concern_file" | head -1)

$key (the script's second positional argument) is interpolated into a double-quoted sed pattern without any format validation. The inline comment states "keys are [a-z_]+ identifiers, no metachars" but that constraint is never enforced. A caller that passes a key value containing / would break the s/…/…/ delimiter; other sed-regex metacharacters (., *, [, ^, $) could cause unexpected pattern matches.

Why this is not exploitable today: every call site in the current codebase passes hardcoded literal keys (memory_dir, contract_dir). Even a future tainted key could only corrupt the sed output — it cannot execute arbitrary shell code, because the sed output is captured into $raw_line and subsequently used only in string comparisons and a bash [[ =~ ]] regex (which is pure pattern matching, not code evaluation).

Recommendation: guard the key parameter with a format check at the top of the function to make the documented invariant machine-enforced:

if [[ ! "$key" =~ ^[a-z_]+$ ]]; then
  echo "parse-concern-value: key must be [a-z_]+ — got: $key" >&2
  exit 2
fi

noise-shapes.sh escaping — correct for current use

Line 31:

pattern+="|$(printf '%s' "$val" | sed "s/[.[\\*^\$()+?{|]/\\\\&/g")"

This escapes the consumer-controlled $val before splicing it into a bash ERE pattern. # is not in the escape set, but # carries no special meaning in POSIX ERE or bash [[ =~ ]], so its omission is harmless. The ] omission is similarly safe: ] is only special inside a character class opened by [, and [ is escaped here. No injection risk in the bash [[ =~ ]] context.

---

Net assessment

The primary PR changes (65 × shell: bash, 26 × patch version bump) introduce zero new security surface. The secondary changes (new parse-concern-value.sh helper, noise-shapes.sh refactor) are locally safe: the one latent concern (unvalidated $key in sed) cannot execute code and has no current exploitable call site. It warrants a defensive guard if the helper API is ever widened to accept caller-supplied key names.

No CRITICAL or IMPORTANT security findings. One SUGGESTION (input validation on parse-concern-value.sh's $key parameter) — safe to merge as-is; the guard is defensive hygiene for a future widened API.