I32 routes to nowhere: 14 skill-body references name skills this marketplace does not ship

[kyle-sexton]

Summary

The 2026-09-08 to 2026-09-11 run of /claude-config:audit-instructions (catalog 1.21.1) over this marketplace retained 14 I32 findings: routing text that names a /<plugin>:<skill> target with no plugins/<plugin>/skills/<skill>/SKILL.md here, not marked as bundled or external, not named by class, and not inside a fenced example. 12 are error (upheld by fresh-context verifiers; two with a corrected diff, one description-level row unverified) and 2 were demoted to info. The I32 Remediate rule is "never leave a route to nowhere". Parent decisions for the skill itself are in #4113.

#	Surface	Severity	Verdict
1	plugins/firecrawl/skills/update/SKILL.md:55	error	upheld
2	plugins/implementation/skills/implement/context/feature.md:34	error	upheld
3	plugins/fleet/skills/reach/SKILL.md:147	error	upheld; diff needs the stated correction
4	plugins/fleet/skills/reach/SKILL.md:2 (description)	error	unverified; report only
5	plugins/work-items/skills/decompose/SKILL.md:87	error	upheld
6	plugins/planning/skills/wayfind/SKILL.md:92	error	upheld
7	plugins/planning/skills/wayfind/context/map-anatomy.md:76	error	upheld
8	plugins/claude-memory/skills/audit/SKILL.md:27	error	upheld
9	plugins/claude-memory/skills/audit/reference/official-guidance.md:261	error	upheld
10	plugins/provenance/skills/audit/SKILL.md:237	error	upheld
11	plugins/education/skills/teach/context/lessons.md:65	error	upheld
12	plugins/ai-briefing/skills/generate/reference/build-pipeline.md:314	error	upheld; diff needs the stated correction
229	plugins/event-storming/skills/methodology/SKILL.md:207	info	demoted
230	plugins/ai-briefing/skills/generate/reference/slide-generation.md:206	info	demoted

Why the existing hook did not catch them

plugins/guardrails/hooks/skill-reference-verify.sh is a PostToolUse hook on Write and Edit of markdown files, so resting text is never scanned; its plugin-scope gate adjudicates a reference only when the plugin half resolves locally; and its extractor matches backticked /<plugin>:<skill> tokens only. Of the 12 error rows, 8 name plugins absent from this marketplace (skill-creator, dotnet-ai, dotnet-template-engine, claude-md-management, frontend-design, document-skills, ui-ux-pro-max), 3 are bare plugin tokens with no skill half (repo-fleet-hygiene, /prototype, /work-items), and one is a plain word (automation-gaps). None is inside the hook's designed reach.

Question for the guardrails owner: should the extractor widen to bare /<plugin> tokens and absent-plugin references inside a marketplace repo, or should a one-shot resting-text scan (the audit itself, re-run after #4113 unit 3 lands) remain the oracle for this class?

Proposed changes (from the audit report, verifier notes inline)

1. L05-F1 | I32 | plugins/firecrawl/skills/update/SKILL.md:55 | error

Finding: The route names /skill-creator:skill-creator as a "plugin skill (if installed)", but no plugins/skill-creator/skills/skill-creator/SKILL.md exists in this marketplace; the only skill-creator that resolves is the bundled Claude Code skill, invoked without a plugin prefix. The presence gate does not cure the route: the token it gates on never resolves here. The same token recurs at context/update-flow.md:39 inside a fenced text block (fence exemption, not reported separately).

-does the Claude-facing decisions (integration and approval). For a non-trivial content delta, the
-`/skill-creator:skill-creator` plugin skill (if installed) can drive the rewrite under the
-preservation rules above; otherwise inline-edit.
+does the Claude-facing decisions (integration and approval). For a non-trivial content delta, a
+skill-authoring capability (the bundled `skill-creator` skill, when it resolves in the session) can
+drive the rewrite under the preservation rules above; otherwise inline-edit.

2. L06-F1 | I32 | plugins/implementation/skills/implement/context/feature.md:34 | error

Finding: The spoke routes the reader to dotnet-ai:mcp-csharp-create (line 34) and dotnet-template-engine:template-instantiation (line 35), and no plugins/dotnet-ai/ or plugins/dotnet-template-engine/ exists in this marketplace. The "invoke only when installed" gate softens the failure but the binding is still to a named skill that resolves nowhere here; the seam-phrasing remedy is to name the capability by class (or, if a sibling marketplace publishes them, to name that marketplace the way prototype:explore-directions names the playground plugin's).

-## Marketplace plugin skills (invoke only when installed)
-
-These are .NET-ecosystem plugin skills — invoke each only when your stack is .NET and its plugin is installed; otherwise fall back to the project's own scaffolding tooling:
-
-- **`dotnet-ai:mcp-csharp-create`** — when implementing a new C# MCP server, invoke for scaffolding guidance (project templates, tool/prompt/resource implementation, stdio and HTTP transport configuration)
-- **`dotnet-template-engine:template-instantiation`** — when creating a new .NET project, invoke for template selection with CPM adaptation and latest NuGet version resolution
+## Ecosystem scaffolding skills (invoke only when installed)
+
+When the session's skill listing carries a scaffolding skill for the artifact being created (a C# MCP-server scaffold with transport configuration, a .NET project-template instantiation skill with package-version resolution), invoke it for scaffolding guidance; otherwise fall back to the project's own scaffolding tooling. Resolve the skill from what is actually installed; never invent a skill name.

3. L07-F1 | I32 | plugins/fleet/skills/reach/SKILL.md:147 | error

Finding: The Boundary table routes repository-fleet work to repo-fleet-hygiene, a plugin name where the convention requires a skill.

Verifier (fix-diff): The plugin-name route is real, but the finding's rationale is false: plugins/repo-fleet-hygiene/skills/ holds apply, audit, and setup, not only audit; keep the diff (repo-fleet-hygiene:audit is the fleet-audit entry the neighbour row means) and correct the finding text.

-| `repo-fleet-hygiene`                  | Fleets of REPOSITORIES. Same word, different subject                                                                                                  |
+| `repo-fleet-hygiene:audit`            | Fleets of REPOSITORIES. Same word, different subject                                                                                                  |

4. L07-F2 | I32 | plugins/fleet/skills/reach/SKILL.md:2 | error

Finding: The description's Not for clause names repo-fleet-hygiene (plugin, not skill) beside session-flow:continue-in-background (skill); same defect as row 3, but it sits in the frontmatter description. No independent verifier reached this finding. No change proposed (description-level; owner: fleet plugin author).

5. L08-F1 | I32 | plugins/work-items/skills/decompose/SKILL.md:87 | error

Finding: The investigation-ticket routing table routes prototype tickets to /prototype, a plugin name where a skill is required; there is no plugins/prototype/skills/prototype/SKILL.md. The two real targets are named correctly elsewhere in this plugin and in the marketplace.

-| prototype | Feasibility or design-feel unknown | `/prototype` |
+| prototype | Feasibility or design-feel unknown | `/prototype:pressure-test` (feasibility, logic) or `/prototype:explore-directions` (design feel), when that plugin is installed |

6. L08-F2 | I32 | plugins/planning/skills/wayfind/SKILL.md:92 | error

Finding: The no-fog bail-out routes "a set of sharp tickets" to /work-items, a plugin name with no skill part, so the route resolves to nothing. The same bare token recurs at lines 190 and 202 of this file and in the frontmatter description ("use /planning:interview or /work-items"); the description occurrence is routing text and is reported to the human, not edited here.

-   sharp tickets → `/work-items`; small enough to just do → say so. (The trigger is too-big
+   sharp tickets → `/work-items:decompose` (or `/work-items:track add` for one ticket); small enough to just do → say so. (The trigger is too-big

7. L08-F3 | I32 | plugins/planning/skills/wayfind/context/map-anatomy.md:76 | error

Finding: Invariant 3 and the Graduation bullet (line 86) route buildable work to "the ordinary tracker (/work-items)", a plugin token with no skill, so a reader following the route has nowhere to go. The wayfind hub already names the concrete skills it means.

-   graduated — move it to the ordinary tracker (`/work-items`), off the map.
+   graduated: move it to the ordinary tracker (`/work-items:track add`, or `/work-items:decompose` for a plan-shaped chunk), off the map.

8. L12-F1 | I32 | plugins/claude-memory/skills/audit/SKILL.md:27 | error

Finding: The scope paragraph routes MCP, agent, and skill coverage to "the audit and automation-gaps skills in the claude-config plugin". No plugins/claude-config/skills/automation-gaps/SKILL.md exists; the skill is audit-automation-gaps. The same wrong token recurs in the Scope table at line 39.

-shape Claude's behavior, not the entire context window (MCP tools, agents, and skills are covered by
-the `audit` and `automation-gaps` skills in the `claude-config` plugin).
+shape Claude's behavior, not the entire context window (MCP tools, agents, and skills are covered by
+the `audit` and `audit-automation-gaps` skills in the `claude-config` plugin).

-| Settings, hooks, MCP, agents, skills | Various | Various | No. Use `claude-config`'s `audit` / `automation-gaps` |
+| Settings, hooks, MCP, agents, skills | Various | Various | No. Use `claude-config`'s `audit` / `audit-automation-gaps` |

9. L12-F2 | I32 | plugins/claude-memory/skills/audit/reference/official-guidance.md:261 | error

Finding: The spoke names /claude-md-management:claude-md-improver as a plugin skill, and the hub's "Complementary workflows" section (SKILL.md:164-167) routes to the claude-md-management plugin's claude-md-improver and revise-claude-md skills. No plugins/claude-md-management/ exists in this marketplace and the route is neither marked as an external-marketplace plugin nor phrased by class. The reference is presence-gated in the hub, so the defect is the unmarked binding rather than the mention.

-There is no official scoring rubric for CLAUDE.md quality. The `/claude-md-management:claude-md-improver` plugin's 6-category, 100-point rubric is invented by the plugin author, not derived from official documentation.
+There is no official scoring rubric for CLAUDE.md quality. The 6-category, 100-point rubric shipped by the `claude-md-improver` skill of the `claude-md-management` plugin (Anthropic's `claude-plugins-official` marketplace, not this one) is invented by the plugin author, not derived from official documentation.

-If the `claude-md-management` plugin is installed, its `claude-md-improver` skill audits CLAUDE.md
-structure and content quality, complementary to this health check. Run this audit FIRST to identify
-issues. `revise-claude-md` captures session learnings after a fix pass. Absent that plugin, the
-fix mode here stands on its own.
+If the `claude-md-management` plugin from Anthropic's `claude-plugins-official` marketplace is
+installed, its `claude-md-improver` skill audits CLAUDE.md structure and content quality,
+complementary to this health check. Run this audit first to identify issues. Its `revise-claude-md`
+skill captures session learnings after a fix pass. Absent that plugin, the fix mode here stands on
+its own.

10. L13-F1 | I32 | plugins/provenance/skills/audit/SKILL.md:237 | error

Finding: The "Does not scan" routing sentence names review:doc-drift-detector in plugin:skill form, but plugins/review/skills/doc-drift-detector/SKILL.md does not exist; the target is the agent plugins/review/agents/doc-drift-detector.md, which no slash route reaches. The same sentence (line 238) routes AI-writing style to the bare plugin name ai-slop where the skill ai-slop:audit is the owner.

- - **Does not scan** code comments (`code-tidying:audit-comment-residue`), in-repo duplication
-   (`docs-hygiene:extract-ssot`), doc-vs-code drift (`review:doc-drift-detector`,
-   `codebase-health:audit`), or AI-writing style (`ai-slop`, same corpus, different defect).
+ - **Does not scan** code comments (`code-tidying:audit-comment-residue`), in-repo duplication
+   (`docs-hygiene:extract-ssot`), doc-vs-code drift (the `review` plugin's `doc-drift-detector`
+   agent, or `codebase-health:audit`), or AI-writing style (`ai-slop:audit`, same corpus,
+   different defect).

11. L13-F2 | I32 | plugins/education/skills/teach/context/lessons.md:65 | error

Finding: The spoke routes HTML lesson design to /frontend-design:frontend-design, and no plugins/frontend-design/skills/frontend-design/SKILL.md exists in this marketplace. The reference carries an installed-ness gate but nothing marks the target as an external plugin, unlike the sibling eli5 skill, which labels its upstream eli5:eli5 as a community plugin.

- An HTML lesson keeps the markdown format's spine — Teach → Practice → Go deeper, one tightly-scoped thing, inline citations, the follow-up close — with *Teach* and *Practice* carrying the interactivity: a quiz block after each Teach chunk, editable snippets whose results the learner reports back in chat. If `/frontend-design:frontend-design` is installed, delegate the visual design to it by invoking it via the Skill tool; otherwise generate a plain, self-contained single-file page inline. Constraints in either case:
+ An HTML lesson keeps the markdown format's spine, Teach then Practice then Go deeper, one tightly-scoped thing, inline citations, the follow-up close, with *Teach* and *Practice* carrying the interactivity: a quiz block after each Teach chunk, editable snippets whose results the learner reports back in chat. If a frontend-design skill is installed (an external plugin, not one this marketplace ships; the upstream `frontend-design` plugin registers `/frontend-design:frontend-design`), delegate the visual design to it via the Skill tool; otherwise generate a plain, self-contained single-file page inline. Constraints in either case:

(Alternative that avoids a binding entirely: "If a frontend-design skill is installed, delegate ..." per the seam-phrasing convention.)

12. L15-F2 | I32 | plugins/ai-briefing/skills/generate/reference/build-pipeline.md:314 | error

Finding: /document-skills:pptx (314, 329) and /frontend-design:frontend-design plus /ui-ux-pro-max:slides (337) are named as fallback skills that do not exist in this marketplace. Line 329 additionally prescribes "follow the install steps in slide-generation.md 'PPTX fallback'", which that section does not contain.

Verifier (fix-diff): The tokens at 314 and 337 point at the marked section one hop away, but line 329's pointer is broken; narrow the diff to that broken pointer (and the ui-ux-pro-max token).

- **Fallback path** (`/document-skills:pptx` skill): only when in-tree pipeline cannot run (Node missing, etc.). See `slide-generation.md` "Fallback skill paths" for skill-stack delegation. Default = in-tree.
+ **Fallback path** (an installed PPTX-generation skill): only when the in-tree pipeline cannot run (Node missing, etc.). See `slide-generation.md` "Fallback skill paths" for the presence check. Default = in-tree.

- If `document-skills:pptx` is not available, follow the install steps in `slide-generation.md` "PPTX fallback".
+ If no PPTX-generation skill is installed, report the gap and emit markdown only; `slide-generation.md` "PPTX fallback" states the brand-token caveat for when one is.

- **Fallback path** (`/frontend-design:frontend-design` + `/ui-ux-pro-max:slides`): see `slide-generation.md` "Fallback skill paths".
+ **Fallback path** (an installed frontend-design skill, plus a slide-layout skill when present): see `slide-generation.md` "Fallback skill paths".

229. L09-F1 | I32 | plugins/event-storming/skills/methodology/SKILL.md:207 | info (demoted)

Finding: Lines 207-209 route to document-skills:pptx, document-skills:docx, and document-skills:pdf; no plugins/document-skills/ exists here and the bundled document skills resolve as bare pptx / docx / pdf.

Verifier (demoted): The reference names an external marketplace plugin as such, presence-gated, with a class fallback and a markdown fallback, so no reader is stranded; the class rewrite would erase a correct plugin name. Watch item; the lane's diff is in the report.

230. L15-F1 | I32 | plugins/ai-briefing/skills/generate/reference/slide-generation.md:206 | info (demoted)

Finding: The fallback section routes by literal tokens to /document-skills:pptx, /frontend-design:frontend-design, and /ui-ux-pro-max:slides (lines 7, 206, 210, 232).

Verifier (demoted): The first two are already marked with their source marketplace and presence-gated; only /ui-ux-pro-max:slides carries no source marker, so report that token at info.

- Invoke `/frontend-design:frontend-design` via the Skill tool (marketplace `claude-plugins-official`) for `--format html` when in-tree `build-html.js` is unavailable, paired with `/ui-ux-pro-max:slides` for slide layout patterns.
+ Invoke a frontend-design skill via the Skill tool when one is installed (the `claude-plugins-official` marketplace ships one) for `--format html` when in-tree `build-html.js` is unavailable, paired with a slide-layout skill when one is installed.