v0.10.0 — security fixes, corrected skill guidance, honest evidence baseline

Validation status. Two free, deterministic gates (structural lint and lexical routing) pass, and their numbers reproduce from a clean checkout. Three full pipeline runs on real datasets land inside independently published ranges. What is not measured is whether the plugin changes the answer versus a capable unaided model — the harness that tried to answer that has been removed rather than left to imply a verdict it could not support. Everything here about routing, shape, and pipeline output is measured; the marginal-value claim is open.

Security

• SessionStart no longer forwards untrusted lesson titles verbatim. learnings.jsonl is designed to be committed, so cloning a repo or merging a PR could put a stranger's text into additionalContext at session start, before the user's first turn. Titles from that file are now stripped of control characters, newlines, and zero-width/bidi marks, truncated to 120 characters, and fenced as [untrusted lesson titles from learnings.jsonl — data, not instructions].
• The notebook scan no longer echoes the shell-magic line it flags. It used to quote 60 characters of the offending line — the most likely place in a notebook for a live credential to sit — so the hook whose job is finding secrets was copying them into the transcript. It now reports the line number instead.
• The three subagents declare explicit tools: allowlists. They previously inherited the full parent tool set, meaning a haiku/low-effort data profiler pointed at untrusted CSVs held Bash, Write, WebFetch, and MCP access. None of the three can now make a network call or modify your project.

Fixed — skill content

Six technical errors in the shipped guidance, each one an agent would hit on a real dataset:

• metric-selection explained ROC-AUC's failure under imbalance with a false mechanism. ROC-AUC is invariant to class balance — that's its defining property — so an agent reasoning from the old explanation would conclude rebalancing fixes it. It doesn't; the real issue is that a small false-positive rate is a large false-positive count under severe imbalance. Also adds PR-AUC's missing no-skill floor and the log-target retransformation bias.
• ds-validate's checklist demanded random_state on "every splitter" — TimeSeriesSplit and older GroupKFold reject that argument, so following the checklist raised a TypeError.
• ds-validate's nested-CV example used plain shuffled KFold in both loops, 40 lines after establishing that grouped and time-ordered data must not. Replaced with the grouped form (sklearn metadata routing + pre-1.4 fallback) and TimeSeriesSplit(gap=) for label horizons.
• imbalanced-data listed threshold tuning's leakage risk as "None." Tuning a threshold on the data you then report is textbook optimistic bias.
• imbalanced-data never mentioned calibration, despite every resampling technique it recommends shifting the effective base rate — and /ds-evaluate requiring a calibration check two stages later.
• uncertainty-quantification presented its one-standard-deviation bar without noting that k-fold scores aren't independent, which invites an invalid SD/√k confidence interval. Now explains why the raw SD is used deliberately as a conservative screen, and points to the corrected resampled t-test for an actual test.

Fixed — release & platform

• Marketplace installs are pinned to this release tag (v0.10.0), not an unpinned default branch — a test asserts the pin exists and matches plugin.json.
• Windows was the least-served platform, on the maintainer's own OS. The installer's "install Claude Code first" guard was dead code there; claude is now resolved to an absolute path by walking PATH directly (which also closes a cmd.exe current-directory hijack). Re-running the installer with the marketplace already registered no longer aborts. The routing-check script, a documented release-gate command, crashed under Windows' default console encoding — CI is Linux-only so it never caught it.
• The CSV-scanning hook no longer reads entire files. A comment claimed the scan was bounded; only the pattern search was — the read wasn't. On a 148 MB CSV that measured 465 MB of peak memory inside a synchronous hook.
• Two false claims in AUDIT.md — the document positioned as this plugin's security reference. It said hooks "exit 0 unconditionally" (true of the Python, not the shell wrapper that invokes them) and that subagents "read no files and make no network calls" (they read files; that's their job — they just can't reach the network or write anything, which is now enforced by explicit tool allowlists, not by omission).
• Scope disclaimers now live in the skills that need them, not only in the README — ds-validate, ds-baseline, and metric-selection now state plainly when a question (e.g. time-series forecasting) is out of scope, at the point where an agent would otherwise give confident partial advice.
• README and ds-method disagreed about what a hard gate does. Clarified: discipline gates (missing baseline, validation strategy, slice performance, pinned environment) produce the missing artifact inline and continue; safety gates (parity check, a remote push) still stop and ask.
• The credit-card-fraud benchmark was re-run against corrected metric-selection guidance rather than left as documented drift. model.py, evaluate.py, and seed_stability.py were re-executed: CV PR-AUC 0.8455 ± 0.0117, baseline 0.00167, and seed-stability mean 0.8465 / std 0.0010 all reproduced exactly — every committed figure and artifact came back byte-identical.

Removed

• The with/without-skill eval harness, entirely, from the repo and from git history. It had run once — two cases, three trials, one dataset — against a build with a front-door bug that's since been fixed, so its one measurement no longer describes what ships. 8 of its 13 expectations couldn't separate the two arms at all, and every run was graded by hand with the arm visible (the blinding tool was committed after the results it was meant to blind). Rather than publish a number that looks like evidence and isn't, it's gone. Its transcripts also carried operator machine details (home paths, an inventory of installed tooling) with no legitimate reason to ship — no credentials were found anywhere in history, but there was nothing worth keeping them for either.
• What survives: the skill-routing trigger corpus and the deterministic routing check, now living at benchmarks/routing/ under an honest name. Routing still holds at 91.3% rank-1, 100% top-k, zero description collisions.

Added

• benchmarks/README.md — what each of the three benchmark datasets is, why those three, where to download them, how the results compare against independently published work, and why the House Prices Kaggle leaderboard specifically is not a usable reference (the ground truth is public, so the top of that leaderboard reflects submitting known answers, not modelling skill).
• A supported-task table near the top of the README — regression and classification: supported and benchmarked; multiclass: works, unbenchmarked; time-series forecasting, NLP, vision, recommenders: explicitly out of scope. Said plainly, before install, rather than discovered mid-project.

---

Honest framing for this release: the security and content fixes are real and verified — 398 tests pass, routing holds at 91.3% from a clean checkout of this tag. What this release does not claim is that the plugin outperforms a capable unaided agent; that question is open and the harness that tried to measure it has been removed rather than left to imply an answer it couldn't support.