v2.0.0

⚠️ Upgrading from v1.x? /plugin update is not enough

This release renamed the repository (claude-skill-joomla → joomla-skills). Your marketplace is
registered under the old name, so /plugin update refreshes the marketplace clone but leaves the
installed copy pinned at 1.1.0 — you keep seeing only the single joomla skill, with no error.

Remove and re-add the marketplace:

/plugin marketplace remove joomla-bible-study
/plugin marketplace add Joomla-Bible-Study/joomla-skills
/plugin install joomla@joomla-bible-study
/reload-plugins

/reload-plugins should then report 16 more skills than before. Fresh installs are unaffected.

---

Install in Claude Code (all skills in this suite):

/plugin marketplace add Joomla-Bible-Study/joomla-skills
/plugin install joomla@joomla-bible-study
/reload-plugins

Install in Claude.ai / Claude Desktop (one zip per skill):

The consumer apps take one skill per upload. Download only the skills you want, then upload each at Claude.ai → Customize → Skills → + → Create skill. Code execution must be enabled first (Settings → Capabilities) or the Skills menu does not appear.

Skill	Asset	What it does
joomla	joomla-skill-v2.0.0.zip	Joomla 5+ / 6 / 7 extension development for components, modules, plugins, libraries, and templates using modern MVC with PSR-4, DI, and service providers.
audit-authz	audit-authz-skill-v2.0.0.zip	Audit Joomla component controllers for missing anti-CSRF token checks, missing authentication, and missing authorisation.
audit-code-execution	audit-code-execution-skill-v2.0.0.zip	Audit Joomla extensions for attacker-influenced data reaching server-side code, command, or object execution sinks.
audit-controller-exposure	audit-controller-exposure-skill-v2.0.0.zip	Audit Joomla controllers for privilege checks that target the wrong permission or asset, backend-only tasks reachable from the site or api application, and unsafe file uploads.
audit-file-operations	audit-file-operations-skill-v2.0.0.zip	Audit attacker-influenced filesystem paths and archive entries in Joomla extensions for traversal, Zip Slip, symlink escape, and arbitrary read/write/delete.
audit-jexec	audit-jexec-skill-v2.0.0.zip	Audit Joomla extension PHP files for the missing _JEXEC direct-access guard, then add it.
audit-object-access	audit-object-access-skill-v2.0.0.zip	Audit Joomla record access paths for IDOR, BOLA, ownership bypass, and cross-user data leakage.
audit-package-surface	audit-package-surface-skill-v2.0.0.zip	Audit what a Joomla extension's build actually distributes and installs.
audit-secrets-crypto	audit-secrets-crypto-skill-v2.0.0.zip	Audit Joomla extensions for exposed secrets, weak or predictable security tokens, unsafe password handling, and cryptographic designs that do not provide their claimed property.
audit-sensitive-output	audit-sensitive-output-skill-v2.0.0.zip	Audit Joomla extension responses, logs, exports, errors, mail, and caches for injection into a downstream interpreter or disclosure of sensitive data.
audit-sql-filtering	audit-sql-filtering-skill-v2.0.0.zip	Audit Joomla filter, user-state, and user-input values that reach SQL queries for unsafe validation, escaping, or parameterisation.
audit-ssrf-redirects	audit-ssrf-redirects-skill-v2.0.0.zip	Audit Joomla extension URL flows for server-side request forgery and unsafe redirects.
audit-xss	audit-xss-skill-v2.0.0.zip	Audit Joomla extension output paths for reflected, stored, and DOM-based cross-site scripting.
e2e-tests	e2e-tests-skill-v2.0.0.zip	Set up or extend end-to-end integration tests that drive a real, disposable Joomla or standalone PHP stack in Docker over real HTTP, with a version matrix derived from what the project actually declares.
joomla-deprecations	joomla-deprecations-skill-v2.0.0.zip	Find and fix uses of deprecated or removed Joomla core APIs in an extension, sourced from the official Joomla Manual's per-version deprecation lists, while preserving the extension's whole supported Joomla range.
php-conservative	php-conservative-skill-v2.0.0.zip	Check a Joomla extension or any PHP project for compatibility with every stable PHP version it claims to support, using PHP_CodeSniffer with the PHPCompatibility standard over a testVersion range derived from composer.json.
php-upcoming	php-upcoming-skill-v2.0.0.zip	Check a Joomla extension or PHP project against the next, not-yet-released PHP version by executing its test suite on that PHP with full error reporting.

Other AI coding tools (Cursor, GitHub Copilot, Windsurf, Cline, Aider, Codex / AGENTS.md):

Download joomla-skill-universal-v2.0.0.zip and follow the install table in its bundled README.md. One file per tool, all sharing the same references/ directory. This package carries the joomla skill only — the audit workflows are interactive and do not translate to always-on rule files.

See the README for full instructions.

What's Changed

• Release v2.0.0 — 17-skill suite, repo renamed to joomla-skills by @bcordis in #46

Full Changelog: v1.1.0...v2.0.0