v3.1.0 — ai-slop: prune code comments and trace workarounds to their cause

Added

AI-Slop Plugin (v1.1.0 → v1.2.0)

• /slop-comments — finds code comments that add nothing to the code, and the workarounds they explain. Agents copy what's already in a codebase, so a comment that narrates the code or excuses a workaround spreads. With no arguments it reviews the comments the current branch adds or changes against the default branch. A path or glob, or all for the whole repo, widens it, and large scopes are split across read-only subagents. It skips vendored and generated code, migrations that have run, config files and prose. Every comment gets one verdict: delete (narration, history, commented-out code, stale notes, signature restatements, banners, agent leftovers, vague TODOs), rewrite, encode (a "must be called after init" note becomes a type, assertion, test, lint rule or CODEOWNERS entry), workaround, or keep. Keeps are a short list in comment-rules.md: tooling directives, legal headers, public API contracts, reasons a reader can't see in the code, surprises, dense notation and TODOs that link an issue. Doc comments a lint rule or doc generator needs stay. For each workaround, including lint and type suppressions, it reads the git history, names the cause and checks whether it still exists, then plans to fix the cause, delete the workaround with its comment, or keep it with a comment that names the cause and when it can go. It never deletes a workaround's comment and leaves the workaround. The report ends with a batched plan and numbered questions, and nothing changes until you answer. Applying runs the typecheck, lint and tests between batches and reverts a cause fix that breaks tests. --fix applies the plan unattended, leaving medium and large refactors, code changes no test covers, and anything waiting on a question. Afterward it offers a comment rule for AGENTS.md, CLAUDE.md or a Cursor rule. The agent can run it when you ask to prune or clean up code comments.
• Marketplace metadata version bumped 3.0.1 → 3.1.0.

Full Changelog: v3.0.1...v3.1.0

v3.0.1 — ai-workflow: babysit a change only as far as staging, and watch Xcode Cloud builds

Added

AI-Workflow Plugin (v3.0.0 → v3.0.1)

• /workflow-babysit --to staging — ends the run once the PR is merged into staging and the staging deploy has finished, and leaves the release PR for later. It's meant for repos where staging builds go to testers first, such as an internal TestFlight group, and production waits for their sign-off. "Babysit this to staging" works too. With --to staging, a staging branch on origin counts as a staging flow even before any release PR, and the step 0 question about other people's unreleased staging commits is skipped. The skill doesn't run CLAUDE.md's cleanup for when staging is done, such as taking staging services down, and lists it in the report as pending. The report says how to promote: run /workflow-babysit from the staging branch, which starts at the release step. If there's no staging branch or an existing PR targets the default branch, it stops before doing anything.
• Xcode Cloud deploy target — /workflow-babysit now finds Xcode Cloud through its xcode-cloud check runs. It treats a workflow that archives commits on staging or the default branch as that branch's deploy, and watches its check runs and commit status on the merge commit. On failure it reports the App Store Connect build link, and on success it notes that TestFlight processing takes a few more minutes and isn't reported to GitHub.
• Marketplace metadata version bumped 3.0.0 → 3.0.1.

Full Changelog: v3.0.0...v3.0.1

v3.0.0 — AI Agent Plugins: Codex and Cursor support, merged plugins, and ai-knowledge on Claude Code rules

The repository and marketplace are renamed from claude-code-plugins-dev to ai-agent-plugins, and 8 plugins are now packaged for Codex and Cursor as well as Claude Code. Four plugins merge into others (ai-aeo and ai-geo into ai-seo, ai-cvp into ai-security, ai-writing into ai-slop), which leaves 13. Skills that repeated another skill are merged, skills that Claude Code now covers are removed, ai-knowledge moves to Claude Code's path-scoped rules, and five wrapper subagents that couldn't load their skills are removed. The marketplace goes from 64 skills to 41.

Removed

• ai-aeo and ai-geo — merged into ai-seo (see Changed). /aeo-audit and /geo-audit are now /seo-audit aeo and /seo-audit geo, /aeo-fix and /geo-fix are folded into /seo-fix, and /aeo-faq, /aeo-questions and /geo-llms-txt are now /seo-faq, /seo-questions and /seo-llms-txt. The Claude Code catalog's new renames map points both names at ai-seo, so Claude Code switches an existing install's setting over to ai-seo. Users then run /plugin install ai-seo@ai-agent-plugins once to install it.
• ai-cvp — merged into ai-security. /cvp-defense-audit is now /security-cvp-audit (see Added). renames points ai-cvp at ai-security, and users who only had ai-cvp run /plugin install ai-security@ai-agent-plugins once.
• ai-writing — merged into ai-slop. /writing-humanize is now /slop-rewrite (see Added), and its pattern catalog is merged into ai-slop's signals.md, so the audit and the rewrite share one list. renames points ai-writing at ai-slop, and users run /plugin install ai-slop@ai-agent-plugins once.
• ai-git /git-commit-push and /git-pr-codex-loop — /git-commit-push is now /git-commit-push-pr --no-pr. The Codex review loop is removed: Claude Code's /code-review --fix and /autofix-pr loop on review comments and CI failures, and /workflow-babysit still triages Codex Code Review findings. Major version bump: ai-git 1.3.2 → 2.0.0.
• ai-workflow /workflow-ship, /workflow-preflight, /workflow-claude-actions and /workflow-principles — /workflow-ship is now /git-commit-push-pr --preflight and /workflow-preflight is now /git-preflight, both in ai-git. Claude Code's /install-github-app replaces /workflow-claude-actions: its review workflow posts inline comments since v2.1.229, and without --model the workflows use Claude Code's default model, Opus 5.5. /init replaces /workflow-principles. Major version bump: ai-workflow 2.1.0 → 3.0.0.
• Five /workflow-rules rules — no-generated-by-footers (Claude Code's attribution setting does this), no-internal-narration and match-response-to-task (the built-in concise output style, /output-style concise), and no-unrequested-features and confirm-risky-actions (covered by Claude Code's built-in instructions). The list and remove modes still find copies already installed in CLAUDE.md and say what replaces each one.
• ai-ado /ado-create-feature, /ado-create-story, /ado-create-task and /ado-work-items — replaced by /ado-create (see Added). The /ado-work-items guidelines are now /ado-create's references/work-items.md. Major version bump: ai-ado 1.3.3 → 2.0.0.
• ai-modernize /modernize-scan — use /modernize-audit <path> --defaults (see Changed).
• ai-knowledge Obsidian support — the vault instructions, [[wiki-link]] syntax and the related and sources frontmatter. Cross-references are plain paths in an optional Related section, the only place Claude sees them, since Claude Code strips frontmatter.
• ai-knowledge /kb-auto, /kb-load, /kb-ingest, /kb-import, /kb-harvest, /kb-absorb, /kb-search, /kb-list, /kb-organize, /kb-remove and /kb-upgrade — 17 skills become 7. Auto-capture replaces /kb-auto (see Added), and an @-mention replaces /kb-load. /kb-add takes over ingest, import, harvest and absorb, /kb-query takes over search and list, /kb-prune takes over organize and remove, and /kb-migrate takes over upgrade. The plugin README maps each one. Major version bump: ai-knowledge 1.5.2 → 2.0.0.
• Wrapper subagents — accessibility-auditor, modernize-auditor, performance-auditor, security-dependency-scanner and swift-release-auditor. Each one's instructions were to load its plugin's skill, which Claude Code refuses because those skills set disable-model-invocation: true, so a skill that handed off to one reached a subagent without the methodology or report template. /accessibility-audit, /modernize-audit, /performance-audit and /security-scan-dependencies now run their audits themselves. For unattended runs, pass the settings as arguments (see Changed); /swift-preflight --check-only replaces swift-release-auditor. security-auditor stays: it's a separate reviewer role with its own instructions that /security-audit runs in parallel. Major version bumps: ai-accessibility 1.4.2 → 2.0.0, ai-modernize 1.1.1 → 2.0.0, ai-performance 1.2.2 → 2.0.0, ai-security 2.0.1 → 3.0.0, ai-swift 1.0.2 → 2.0.0.

Changed

• Repository and marketplace renamed — charlesjones-dev/claude-code-plugins-dev is now charlesjones-dev/ai-agent-plugins, and the marketplace name in .claude-plugin/marketplace.json changed to match. Install IDs change from <plugin>@claude-code-plugins-dev to <plugin>@ai-agent-plugins. GitHub redirects the old URLs, so existing installs and links keep working, but Claude Code keeps those installs under the old marketplace name. To switch, remove the old marketplace, add charlesjones-dev/ai-agent-plugins and reinstall. Removing the old marketplace uninstalls its plugins. The README has the commands, and a table of renamed commands.
• ai-seo covers SEO, AEO and GEO — six skills, all ai-aeo and ai-geo checks and fixes carried over. Major version bump: ai-seo 1.0.1 → 2.0.0.
  • /seo-audit [seo|aeo|geo|all] audits one lens or all three (the default, asked first when missing) and takes every setting as an argument, with defaults for unattended runs. It writes one report to docs/seo-audit/ with a section and a score per lens and no combined score. Findings carry lens-prefixed IDs (SEO-1, AEO-1, GEO-1). The report index gets a column per lens, rows from 1.x are converted, and trends compare against reports in the old docs/aeo-audit/ and docs/geo-audit/ folders.
  • /seo-fix applies the newest report for every lens it covers, keeps every fix type, confirmation rule and --dry-run from the three fix skills, applies fixes two lenses share once, and acts as --dry-run in an unattended run. It takes an optional report path, so an older AEO or GEO report can still be applied.
  • /seo-schema owns all JSON-LD generation and validation, including FAQPage/QAPage and Organization/Person with sameAs. /seo-schema, /seo-fix and /seo-faq share one json-ld.md rule set.
  • /seo-faq, /seo-questions and /seo-llms-txt take their setup as arguments and have unattended defaults. With no arguments they behave as before. /seo-questions can also start from an earlier question map, including one in the old folder.
• Audit skills take their settings as arguments — each asks only for what the arguments leave out, and asks nothing when they cover everything, so the audits can run unattended.
  • /accessibility-audit [WCAG version] [level] [path or URL], such as /accessibility-audit 2.2 AA src/. With a URL from the arguments, it uses Playwright visual testing when the Playwright MCP server responds and otherwise audits the HTML and notes that visual testing was skipped. The Playwright setup step now covers Claude Code (.mcp.json), Cursor (.cursor/mcp.json) and Codex (codex mcp add).
  • /modernize-audit [path] [ai=…] [era=…] [stack=…|auto] [categories=all|…] [severity=all|medium|high] [--defaults]. --defaults asks nothing and uses the defaults for any setting the arguments leave out, which replaces /modernize-scan. The same defaults apply when no one can answer, and the report marks each one "(default)". The audit also takes a single file as its scope, and skips categories that can't apply to it. Its category checklist moved to skills/modernize-audit/references/categories.md.
  • /performance-audit [path] limits the audit to one directory.
  • /security-scan-dependencies [URL] [frontend|cms|headers|all]. With only a URL in an unattended run, the scope is all. The skill also gained build-tool detection (Webpack, Vite, Turbopack, Parcel), including a warning when a Vite dev server is exposed.
  • Their report paths are repository-relative (docs/accessibility/, docs/modernize/, docs/performance/, docs/security/) rather than written with a leading slash.
• ai-git /git-commit-push-pr — takes --preflight, which runs /git-preflight --fix first and stops if it applied fixes or problems remain, and --no-pr, which stops after the push. It used to ignore all arguments. It reads the default branch from gh instead of assuming main, returns the URL of a PR that's already open, stops when a push is rejected or gh is missing, and writes a test plan with only what was actually run. In Codex and Cursor it runs preflight by loading the git-preflight skill.
• ai-git /git-preflight — moved from ai-workflow, so it now runs in Codex and Cursor too. It no longer depends on Claude Code for platform detection or questions.
• ai-workflow /workflow-babysit — points to /install-github-app instead of /workflow-claude-actions when Claude Code review is off, including its "Update workflow file with latest version" option, and treats the summary comment a v2.1.229 or later review workflow posts as a clean pass.
• ai-security /security-cvp-audit — its ignore rule no longer hides /security-audit reports. When git already tracks files in docs/security/, it ignores only the audit's own paths (/docs/security/*cvp*audit*, `/docs/security/tes...

v2.12.0 — ai-workflow: babysit a branch to production, and set up the Claude Code GitHub Actions on the newest Opus

Added

AI-Workflow Plugin (v2.0.1 → v2.1.0)

• /workflow-babysit — takes the current branch to production in one unattended run. Runs from /workflow-babysit or when you say "babysit this to prod", and invoking it is the approval to merge.
  • Opens the PR itself when there isn't one: commits uncommitted changes in the repo's style, branches off the default or staging branch, pushes, and targets staging when the repo has a staging flow. It doesn't need /workflow-ship first.
  • Asks every question at the start (which uncommitted files to leave out if some look unrelated, what to do when the Claude Code review action isn't set up, and whether to promote other people's unreleased commits already on staging, read from GitHub logins), and warns when a branch rule needs a human approval. Then it runs without stopping. It stops only for a blocking finding still open after 3 rounds, a teammate requesting changes, CI it can't fix, a merge GitHub refuses, or a failed deploy or health check. Every wait has a deadline. Running it again after a stop picks up the open PR, or the release step when run from staging.
  • Waits for CI, the Claude Code GitHub Action, Codex Code Review and Cursor Bugbot on the head commit. Claude Code counts as on only when a workflow running anthropics/claude-code-action on pull requests is on the default branch and enabled, has its secret set, and posts its findings to the PR. A workflow that runs /code-review without --comment or another way to comment would otherwise pass as a clean review. A run whose log says Skipping action due to workflow validation counts as no review. A clean Codex pass that posts only a 👍 reaction counts as done. Each reviewer has a time limit.
  • Fixes correctness, data-loss, security and regression findings in code the PR changed, opens issues for the rest or replies "by design", and resolves every bot thread. Claude Code re-reviews by itself after each push and Codex gets one scoped @codex review per round, with 3 rounds of fixes at most. A finding Claude Code raises again after it was answered gets a link to the earlier reply instead of a second round. When the review workflow doesn't run on pushes, the local /code-review covers the new commits. It never resolves a person's thread or merges over a requested change. A repo's CLAUDE.md can set its own triage rules.
  • Cursor Bugbot — detected by its Cursor Bugbot check run. A pass is done when a <!-- BUGBOT_REVIEW --> review names the head commit, and reviews marked BUGBOT_REVIEW_STALE are ignored. Only cursor[bot] comments with a BUGBOT_BUG_ID count as findings, so Cursor Automations approvals and Autofix results aren't triaged. Findings are handled High Severity first, and every location listed under "Additional Locations" is checked. Bugbot re-reviews by itself on pushes; when it doesn't run on the new commit within 5 minutes, the skill posts one bugbot run. It also posts one after resolving findings when a required Bugbot check failed on unresolved issues. It never writes @cursor, because a mention starts a Cursor agent that can push to the branch.
  • Bugbot Autofix — when Autofix commits to the PR branch, the skill waits for the Cursor Bugbot Autofix check, pulls its commits, fixes only what it left, and runs git pull --rebase before every push. When Autofix makes a separate branch, the skill fixes the finding in the PR and doesn't merge that branch.
  • When the Claude Code action isn't set up, it can run the built-in /code-review locally on each PR in its place and post the findings and what happened to them as a PR comment.
  • Merges only the commit that passed the review gate (--match-head-commit), never with --admin, and uses a merge commit for release PRs so staging and the default branch don't diverge. Each PR's own base decides whether it goes on to the release step. If GitHub's automatic branch deletion removes staging when the release PR merges, it recreates staging at the same commit.
  • With a staging flow, it watches the staging deploy before promoting, opens or reuses a Release: PR, and reviews it the same way.
  • Watches the production deploy without deploying anything itself: GitHub deployments first (Vercel, Railway and other hosts that report to GitHub), then GitHub Actions deploy runs, then a linked host CLI. Railway gets per-service status, logs and domains through its CLI, since Railway reports one GitHub deployment per environment. The health check skips environment_url values that point at a host dashboard, and treats a 401 or 403 from a protected URL as inconclusive.
  • Follows deploy rules from CLAUDE.md, such as starting staging services before a staging deploy.
• /workflow-claude-actions — sets up or updates the Claude Code GitHub Actions so PR reviews post inline comments and both workflows run on the newest Opus. Builds on the built-in /install-github-app.
  • Passes --model opus on the review and @claude mention workflows. The alias follows the newest Opus the action's bundled Claude Code knows about, and the floating @v1 tag picks up new releases without edits. It asks before moving a pinned action to @v1 or replacing a different model.
  • Edits existing workflows in place: adds the model, --comment on the code-review prompt and the inline-comment tool, and keeps triggers, filters, permissions and auth. Workflows from older versions of /install-github-app ran /code-review with no way to post, so their findings never reached the PR. For pre-v1 workflows it recommends regenerating them with /install-github-app first.
  • Copies the bundled workflows when one is missing, with a subscription token (CLAUDE_CODE_OAUTH_TOKEN) or an Anthropic API key (ANTHROPIC_API_KEY). For a missing workflow next to one on Bedrock, Vertex, Foundry or workload identity federation, it copies that workflow's whole auth setup. The bundled review workflow skips fork PRs and bot PRs, which get no OIDC token or are refused by the action. On public repos the skill offers to add that guard to an existing review workflow.
  • Checks for the secret on the repo and the organization, and gives you the commands to set a missing one in your own terminal. It never asks for, prints or passes a token.
  • Checks ANTHROPIC_MODEL, which overrides --model, and edits every action step in a workflow. It adds the inline-comment tool without quotes so a double-quoted claude_args stays valid, and parses every edited file as YAML before showing the diff.
  • Skips asking about the Claude GitHub App when claude[bot] has commented in the repo recently. It commits, pushes and opens one PR only after you approve the diff, targets staging when work lands there, switches back to your branch whenever it stops, and never merges or changes repo settings.
  • Explains why the PR's own review check passes without reviewing (and, in staging repos, why reviews pause on staging PRs until promotion), why pull-requests: read findings from bot reviewers are false positives, and how to confirm the model from the run log.
• /workflow-babysit points to /workflow-claude-actions when Claude Code review is off or its review workflow can't post to the PR.

Fixed

AI-Workflow Plugin (v2.0.1 → v2.1.0)

• /workflow-ship preflight step — /workflow-preflight had disable-model-invocation: true, so Claude Code refused the Skill tool call that /workflow-ship makes in its first step and told Claude not to run the checks another way. /workflow-preflight can now be invoked by Claude, and /workflow-ship passes --fix so preflight applies auto-fixes without stopping at its numbered menu. Claude can also run preflight when you ask to check code before committing.
• Marketplace metadata version bumped 2.11.3 → 2.12.0.

Full Changelog: v2.11.3...v2.12.0

v2.11.3 — ai-cvp: output contract for audits, and a fix prompt that normalizes what the audit left

Fixed

AI-CVP Plugin (v1.0.2 → v1.0.3)

• Audit prompt output contract — an audit whose sandbox blocked the repo's own test harness invented its own layout: a misnamed report, different finding IDs, no test-path column, and live source files outside docs/security/tests/. The final git status check passed because git ignores docs/security/, and the fix prompt pointed at files that didn't exist. The archive rule was a step ("once it has run, move it"), so it never fired when no test ran in the source tree. The prompt now ends with one output contract that describes the end state:
  • the report at exactly the prompt's path, even if the audit runs on a later date, with CVP-NN IDs and each test's archived path in the summary table;
  • every proof test, helper and fixture at docs/security/tests/<path it would run from>.disabled, whether or not it ever sat in the source tree;
  • alternative-harness scripts and run logs in docs/security/harness/, with no extension the repo's compiler, test runner, formatter or linter picks up, since most of those tools don't read git's ignore rules;
  • build staging in a mktemp -d folder outside the repo.
• Contract check — before finishing, the audit model runs find docs/security -type f ! -path '<report>' ! -path 'docs/security/tests/*.disabled' ! -path 'docs/security/harness/*', which should print nothing, and git status --porcelain. When docs/security/ already holds earlier reports, the check adds -newermt with the planning time so it lists only the audit's files, and the contract says to leave earlier files alone.
• Alternative harness — when the sandbox blocks the repo's test command, the audit model may build its own harness under the contract. A result counts as Confirmed only if the test would also compile and run unchanged in the real project, and the report gives the command that runs each such test there.
• Fix prompt — step 1 no longer assumes the contract held. It runs the same check, moves the newest .md directly under docs/security/ to the expected report path if the report isn't there, moves misplaced tests into docs/security/tests/<path>.disabled (including tests stored relative to a test target's folder), disables source-extension files in docs/security/harness/, tells you what moved, reruns the check, and then uses the report's own IDs. Step 2 runs every test the sandbox kept from running through the real project, checks that each one actually ran, and tries to settle Unconfirmed findings with local tests, never real servers. When the project file lists sources explicitly (XcodeGen, or an Xcode project without synchronized folders), it regenerates or updates the project whenever a test moves in or out.
• Apple apps — recon now warns that the strict sandbox can block xcodegen and xcodebuild entirely, not just the test run: Foundation writes temp files under getconf DARWIN_USER_TEMP_DIR rather than $TMPDIR, and the sandbox denies writes there. For apps whose only harness is xcodebuild, the checklist offers an optional launch line that adds that folder to sandbox.filesystem.allowWrite. Tested on an XcodeGen iOS app under Claude Code 2.1.295 and Xcode 27: with the line, xcodegen generate and xcodebuild build-for-testing (DerivedData under $TMPDIR, -disable-sandbox for macro plugins) succeed in the sandbox. xcodebuild test still fails on iOS and macOS, because the simulator and testmanagerd are out of reach, so tests run through an alternative harness and the fix session reruns them.
• Project MCP servers — recon checks .mcp.json and .claude/settings*.json for servers that start without a prompt (enableAllProjectMcpServers, enabledMcpjsonServers). MCP tools run outside the sandbox, so the reply warns about them, the checklist says to disable them with /mcp before pasting the prompt, and the audit prompt tells the audit model not to call MCP tools.
• Launch checklist — the final step runs the contract check as well as git status; anything either prints is normalized by the fix prompt's first step.
• Marketplace metadata version bumped 2.11.2 → 2.11.3.

Full Changelog: v2.11.2...v2.11.3

v2.11.2 — ai-statusline: sandbox indicator, plus a one-line sandboxed launch for ai-cvp audits

Added

AI-Statusline Plugin (v1.4.1 → v1.5.0)

• Sandbox indicator — the Bash script template can show Sandbox in orange right after the effort level while Claude Code's Bash sandbox is on for the session, and hides it while the sandbox is off. New SHOW_SANDBOX toggle (default off). Existing status lines don't change; to add it, re-run /statusline-wizard and select it.
  • The status line payload has no sandbox field, so the script resolves sandbox.enabled the way Claude Code does, taking the first layer that sets it: managed settings (managed-settings.json and managed-settings.d/), --settings on the claude command line (inline JSON or a file path, read from the process found through $CLAUDE_PID or by walking up the process tree), .claude/settings.local.json at the repository root (the main checkout's root in a worktree) and then in the starting directory, .claude/settings.json, and the user's settings.json (respecting CLAUDE_CONFIG_DIR). A /sandbox change shows up on the next refresh.
  • On Linux and WSL2 the indicator stays hidden when bwrap or socat is missing, since the sandbox can't start without them. It can't read MDM profiles or server-managed settings, and the docs say to confirm with the touch ~/sandbox-probe check when it matters.
  • Native Windows has no sandbox, so the PowerShell template has no indicator, and both wizards leave the option out on Windows.
• /statusline-wizard and /statusline-edit — "Sandbox indicator" is a new option in the Project Display question. /statusline-edit leaves it out for scripts generated before 1.5.0 and points to /statusline-wizard.

Changed

AI-CVP Plugin (v1.0.1 → v1.0.2)

• Launch checklist — the audit session now starts with one command instead of the /sandbox panel and Shift+Tab: claude --model <audit-model-id> --permission-mode auto --settings '{"sandbox":{"enabled":true,"autoAllowBashIfSandboxed":true,"allowUnsandboxedCommands":false,"failIfUnavailable":true}}'.
  • The settings last one session and write nothing to .claude/settings.local.json.
  • Strict mode set through --settings makes the sandbox admin-required, so on Claude Code v2.1.285 or later the audited repo's own .claude/settings.json and .claude/settings.local.json can't loosen it (their excludedCommands, allowWrite and allowedDomains entries are ignored). The README's requirements now list v2.1.285.
  • failIfUnavailable makes Claude Code exit at startup instead of running commands unsandboxed when the sandbox can't start.
  • The checklist checks /status for Command line arguments instead of opening /sandbox, which can't change settings that come from the command line.
• Shorter reply — /cvp-defense-audit no longer prints the audit prompt in the conversation. The reply gives the path to each prompt, whether the audit prompt is on the clipboard, whether the ignore rule was added, an audit checklist, a fix checklist and the warnings. The fix checklist covers phase 3: quit the audit session, start claude --model opus unsandboxed, copy the fix prompt with the same clipboard tool, and paste it. Without a clipboard tool, both checklists say to open the file and copy it, replacing the /copy fallback, which needed the prompt in the conversation.
• Marketplace metadata version bumped 2.11.1 → 2.11.2.

Full Changelog: v2.11.1...v2.11.2

v2.11.1 — ai-cvp: archive proof tests under docs/security and keep them out of git

Fixed

AI-CVP Plugin (v1.0.0 → v1.0.1)

• /cvp-defense-audit audit prompt — the audit session no longer leaves failing proof tests across the source tree, where a commit would turn CI red. It still writes each test where the repo keeps its tests and runs it, then moves it to docs/security/tests/ under the same repo-relative path with .disabled appended (for example docs/security/tests/src/auth/session.cvp.test.ts.disabled). Before finishing, it checks git status for strays. The report now always goes to docs/security/<date>-cvp-security-audit.md, and the summary table lists each finding's archived test.
• /cvp-defense-audit ignore rule — the planning session now adds /docs/security/ to .git/info/exclude unless git already ignores it, so the report and archived tests stay out of commits in open-source repos and repos with confidential findings. The exclude file is never committed, so the repo carries no hint of the folder, and it applies to every worktree of the clone. The warnings list any files git already tracks under docs/security/. The rule also covers ai-security's reports in the same folder.
• Launch checklist — drops the security/cvp-audit-<date> branch, which would now hold nothing. Instead it asks for a clean git status before launch and adds a final git status check that should come back empty.
• Fix prompt — checks that docs/security/ is ignored (adding the exclude line if it isn't) and archives any stray proof tests. It runs each proof from a temporary copy, and restores the proof test with mv (dropping .disabled, which removes the archived copy) on the fix branch. It never commits anything under docs/security/.
• Marketplace metadata version bumped 2.11.0 → 2.11.1.

Full Changelog: v2.11.0...v2.11.1

v2.11.0 — ai-cvp: plan sandboxed security audits with /cvp-defense-audit

Added

AI-CVP Plugin (new — v1.0.0)

New plugin for planning a defensive security audit of code you own or are authorized to test. The audit itself runs in a strict sandbox on the strongest security-capable model you can use.

• /cvp-defense-audit — phase 1 of a three-phase audit. The planning session does read-only recon and writes a paste-ready audit prompt, a sandbox launch checklist and a fix prompt. The audit session (auto mode, /sandbox in strict mode) maps the attack surface, writes one failing test per finding as proof, and writes a report without fixing anything. The fixing session verifies each proof and ships each fix with its proof test as the regression test.
  • Asks what authorizes the audit (Cyber Verification Program enrollment, ownership or maintenance, or authorized third-party testing) and writes only that into the prompt. It never claims enrollment by default, and stops if there's no authorization.
  • Recon covers entry points, auth and tenancy, untrusted-input sinks, billing, secrets (names only), integrations, CI and supply chain, deploy config, the test harness and earlier audits. With gh signed in, it adds open Dependabot and code-scanning alerts and notes when either feature is disabled.
  • Picks 5 to 9 attacker goals from attack-catalog.md (web apps and APIs, Apple apps, libraries, CLIs and Claude Code plugins, Home Assistant integrations, static sites) and rewrites each in the repo's own actors, assets and files.
  • The prompt names the test framework, a file name with a cvp marker (*.cvp.test.ts, test_cvp_*.py) placed by the repo's convention, an existing test whose mocking to copy, libraries to mock because they call the network during verification, the single-file run command for each package, and a report path that matches the repo's audit naming. Recon also flags stale workspace builds and tests that bind localhost ports.
  • fix-prompt-template.md drives phase 3: re-run each proof outside the sandbox, propose checks for what code couldn't settle, triage, fix only what you pick on branches from the integration branch, never merge the audit branch, and update the report's status for each finding.
  • Saves both prompts to ~/.claude/cvp-audit-prompts/, copies the audit prompt to the clipboard (pbcopy, wl-copy, xclip or clip.exe), and warns that the files map the attack surface and shouldn't be committed or posted.
  • Model-agnostic: --model <audit-model-id> fills in the launch line, and the skill refers to the planning, audit and fixing models by tier rather than by name.
• Marketplace metadata version bumped 2.10.0 → 2.11.0 (new plugin).

Changed

• CONTRIBUTING.md — test a fix by loading the plugin from your clone with claude --plugin-dir, instead of adding the clone as a local marketplace. The flag needs no install, and for that session it replaces an installed copy of the same plugin.

Full Changelog: v2.10.0...v2.11.0

v2.10.0 — ai-aeo: Answer Engine Optimization, plus ai-geo rebuilt around citations

AEO and GEO are now separate plugins. AEO (Answer Engine Optimization) is about being the direct answer in a featured snippet, voice reply or answer box. GEO (Generative Engine Optimization) is about being cited and mentioned inside AI answers that draw on many sources. ai-geo's direct-answer checks moved to the new ai-aeo plugin, and both plugins were checked against vendor documentation current as of October 2026.

Added

AI-AEO Plugin (new — v1.0.0)

• /aeo-audit — scores how ready answer pages are to be lifted as the direct answer, across nine weighted categories: answer-first formatting, question headings, concise definitions, real lists and tables, snippet eligibility controls, FAQ sections and structured data, voice and assistant readiness, answer trust signals, and technical accessibility. Writes timestamped reports to docs/aeo-audit/ with a README.md index (trend indicators 📈 📉 ➡️), latest.md and an optional .gitignore entry, the same way /geo-audit does.
  • Searches every source of noindex, nosnippet, max-snippet, data-nosnippet and Bing nocache / noarchive: meta tags, framework metadata APIs, header config, middleware and robots.txt. Lists the Search Console "Search generative AI" setting as a manual check.
  • Flags accordions that render answers only after a click ({open && …}, v-if, {#if}), main answers collapsed by default, and lists or tables drawn with divs.
  • Optional live URL check: fetches up to ten deployed pages to confirm answers are in the served HTML and to read the robots directives actually sent.
• /aeo-fix — applies fixes from the latest audit: safe fixes as one batch, a keep/remove/narrow question for every snippet control, answer-first rewrites and question headings drawn only from the page's own text, and refactors for click-to-load accordions and CSS-grid tables. Supports --dry-run.
• /aeo-questions — builds a question map from the site's own headings plus typed questions, a Search Console or Bing Webmaster Tools export, or web search suggestions (each linked to its source). Merges duplicates, assigns one owner page per question, and marks each answered first, buried, partial, missing or competing. /aeo-audit scores question coverage against the latest map.
• /aeo-faq — builds, updates or validates visible FAQ sections, with optional FAQPage or QAPage JSON-LD rendered from the same data. Drafts answers only from site content or the user, and keeps the main answers open.
• Marketplace metadata version bumped 2.9.0 → 2.10.0 (new plugin).

Changed

AI-GEO Plugin (v1.1.1 → v1.2.0)

• /geo-audit categories rebuilt around GEO — AI Crawler Access, Technical AI Accessibility, Topical Authority (new), Original Research & Evidence (new), Expert Perspectives & Authorship, External Validation (new), Entity Clarity, Extractable Passages, Content Freshness, and llms.txt & Markdown Access. FAQPage, speakable, question headings, definitional openings and conversational heading checks moved to /aeo-audit. Scores aren't comparable with earlier audits; the index marks the first 1.2.0 run with 🔄 instead of a trend.
• Three bot groups instead of two — training crawlers, AI search indexers and user-triggered fetchers, plus Googlebot, Bingbot and Applebot. Adds AI search indexers from more vendors (Meta-WebIndexer, Amzn-SearchBot, MistralAI-Index, DuckAssistBot) and more user fetchers (meta-externalfetcher, Amzn-User, MistralAI-User, Google-Agent), and notes which fetchers say robots.txt may not apply to them.
• Optional live URL check and web search — /geo-audit can compare the deployed robots.txt with the repo (CDNs such as Cloudflare can add rules), confirm content is in the served HTML, and test responses to AI user agents. With web search it adds a dated off-site snapshot of brand mentions and reviews, which isn't scored.
• Measuring citations section in the report: Bing Webmaster Tools AI Performance, Search Console's Generative AI performance report, server logs and a fixed question panel.
• /geo-fix asks three separate robots.txt questions, offers to swap retired bot names for current ones, hands snippet controls to /aeo-fix, asks for sources behind unsourced statistics, scaffolds author pages and topic hubs, and prints off-site work as manual steps.
• /geo-llms-txt and the README now state that Google Search ignores llms.txt, that some coding tools read it, and that Lighthouse's agentic browsing audit checks for it. Markdown companion routes are optional and recommended only for developer docs.

Fixed

• ai-geo — /geo-audit listed Google-Extended in its citation crawler table. It's a robots.txt token, not a crawler, and covers Gemini training and grounding in Gemini Apps and Vertex AI only. It doesn't affect Google Search, so it can't remove a site from AI Overviews or AI Mode; those follow nosnippet, max-snippet, data-nosnippet, noindex and the Search Console "Search generative AI" setting.
• ai-geo — a missing llms.txt could be rated Critical and the category carried 15% of the score. It's now Low (Medium for developer docs) at 5%, since Google says Google Search ignores the file and no AI search provider has said it uses it.
• ai-geo — removed claims that FAQPage and HowTo "are disproportionately cited by AI engines", that AI engines "prefer markdown", and that Markdown companions are "the single biggest citation-quality improvement". None has a primary source. Google stopped showing HowTo rich results in 2023 and FAQ rich results in May 2026.
• ai-geo — Dataset markup is described as used by Google Dataset Search rather than Search, and ClaimReview as being phased out of Google Search.
• ai-geo — FacebookBot and Omgilibot were dropped from the bot tables (Meta no longer documents FacebookBot; Omgilibot has no vendor documentation), and bot documentation links point to current pages (OpenAI's moved to developers.openai.com, Anthropic's to support.claude.com).
• ai-geo — skill examples quoted the owner's own sites and name; they now use generic examples.
• ai-geo — /geo-llms-txt asked a site-type question with six options (AskUserQuestion allows four) and offered llms-full.txt as an alternative to generating llms.txt. It now asks mode, full-text companion and site type as separate questions.
• ai-geo — JSON-LD examples escape < so text in the data can't close the script tag.

Full Changelog: v2.9.0...v2.10.0

v2.9.0 — ai-slop: /slop-audit, plus a docs cleanup across every plugin

Added

AI-Slop Plugin (new — v1.0.0)

New plugin for auditing what a codebase shows its users: copy that reads as AI-written, layouts that read as templates, metadata built from boilerplate, and factual errors in all of them.

• /slop-audit — report-only audit of every user-facing surface: pages and shared layout, data files that feed cards, forms, emails, visible error text, legal pages, meta and OG tags, JSON-LD, llms.txt, app strings and store metadata, README and --help text.
  • Reads the project's voice rules, documented house style and earlier audit decisions first, so deliberate choices aren't flagged and settled questions aren't asked again.
  • Counts habits that repeat across the site (em dashes, the main tagline, triplets, "X, not Y" slogans, a word the copy leans on) and how many files each appears in.
  • Checks facts: legal pages against the third parties the code loads (and the live page's scripts when given a URL), figures and names that differ between pages, claims another page contradicts, and links or components that lead nowhere.
  • Scores each area 0–100, quotes every finding with file:line and a concrete fix, then ends with a fix plan, its defaults and numbered questions. Edits start only after you answer; it then removes old wording from every metadata surface, runs the project's checks, and records your answers as project rules.
  • Ships its checklist as signals.md: sentence, structure, claims, positioning, visual and metadata tells, plus a list of things not to flag.
• Marketplace metadata version bumped 2.8.1 → 2.9.0 (new plugin).

Changed

• Docs rewrite after an AI slop audit (October 2026) — root README, CONTRIBUTING.md, SECURITY.md, every plugin README, all 15 marketplace and plugin.json descriptions, and several skill and agent descriptions.
  • Plugin descriptions now open with what the plugin does. "AI-powered" and the "Noun - Clause" shape are gone.
  • Removed emoji headings, "Built with ❤️" closers, "Time Savings" sections with estimated hours, and unmeasured percentages.
  • Cut repeated lists and IS / IS NOT blocks. Plugin READMEs are shorter, with a short "Limits" section where one is needed.
  • The GitHub repository description now matches the README tagline.
• CONTRIBUTING.md — covers bug reports and fix PRs only (new plugins and features start as an issue), and describes the current skills/ and agents/ layout instead of the removed commands/ folder and /plugins-scaffold.
• SECURITY.md — only the latest marketplace release gets security fixes. Reports go through the contact form, with a reply within one business day.
• CLAUDE.md — new Documentation Style rules that record these decisions.
• Patch releases for the docs and fixes below: ai-accessibility 1.4.2, ai-ado 1.3.3, ai-compliance 1.0.1, ai-geo 1.1.1, ai-git 1.3.2, ai-knowledge 1.5.2, ai-modernize 1.1.1, ai-performance 1.2.2, ai-security 2.0.1, ai-seo 1.0.1, ai-statusline 1.4.1, ai-swift 1.0.2, ai-workflow 2.0.1, ai-writing 1.0.1. Every plugin.json keyword list now matches its marketplace.json entry.

Fixed

• ai-accessibility — WCAG criteria counts in the README and in /accessibility-audit reports were WCAG 2.0's numbers. They now give 78 criteria for 2.1 and 86 for 2.2, with per-level counts. The touch-target rule is 24×24px at AA (SC 2.5.8) and 44×44px at AAA (SC 2.5.5), and focus-indicator contrast cites SC 1.4.11. The README now lists the 508 / WCAG 2.0 AA option and has a Plugin Details section.
• ai-geo — /geo-fix and the README used anthropic-ai and Claude-Web, which Anthropic doesn't document. They now use ClaudeBot, Claude-User and Claude-SearchBot. Google-Extended is described as a robots.txt control token, and "SearchGPT" is now ChatGPT search. /geo-llms-txt no longer calls the blockquote required (the llms.txt spec requires only the H1). The README documents --dry-run and the v1.1.0 discoverability checks.
• ai-knowledge — the auto memory comparison now matches the Claude Code docs: a MEMORY.md index plus topic files, the first 200 lines loaded at session start, and /memory for browsing.
• ai-modernize — removed "Claude Sonnet 2" (no such model) from the README and /modernize-audit, and dropped stale model names from its time estimates. The README's stack list names only stacks the skill checks.
• ai-seo — nuxt-simple-sitemap is now @nuxtjs/sitemap, TanStack Start's head component is <HeadContent />, and a dead web.dev link is gone.
• ai-writing — /writing-humanize counts 26 patterns, not 24, and its before/after example no longer invents a citation.
• ai-git — the README no longer says the plugin has agents or that /git-commit-push stages all changes. It stages the changed files by name and skips secrets.
• ai-ado — /ado-init had lost its README heading and was described as writing work item guidelines. The timesheet example totals now add up, and the roadmap of unbuilt skills is gone.
• ai-performance — the README no longer promises custom analysis templates or CI/CD gates.
• ai-statusline — "three categories" of display options is now four, and the examples use a current model label.
• ai-swift — removed unverified figures from the README and /swift-preflight.
• ai-workflow — added the missing /workflow-ship section and removed unbacked "syncs via /plugin update" claims. The README's check order matches what /workflow-preflight runs, and its argument-hint is quoted so YAML reads it as a string.
• ai-compliance — Apache 2.0's NOTICE requirement applies only when the project ships a NOTICE file, and BSD licenses use their SPDX names.

Full Changelog: v2.8.1...v2.9.0