v4.0.3 — SKILL.md description compliance (Issue #9)

What's Fixed

Closes #9 — skills/cybersecurity-pro/SKILL.md description: frontmatter trimmed from ~4,663 → 590 characters.

Compliance

Cap	Limit	v4.0.2 (#9 reported)	v4.0.3
Anthropic SKILL.md spec	1024	4,663 ✗	590 ✓
Claude Code skillListingMaxDescChars (default)	1536	4,663 ✗	590 ✓
writing-skills recommended	≤500	4,663 ✗	590 (≈recommended)

Impact

• /doctor warning resolved — no more "descriptions exceed the per-entry cap" notice on every session
• No more silent truncation of trailing trigger keywords (previously Claude Code clipped at the cap boundary with no signal which keywords were lost)
• ~15k tokens/session overhead eliminated for users who opted in to skillListingMaxDescChars: 4096 to retain the full string
• Anthropic spec compliance restored — risk that Claude follows the summary instead of reading the full skill body is gone

What moved where

The long trigger keyword list (15 categories spanning Incident Response, DevSecOps, Cloud, AI/ML, OT/ICS, PQC, Identity, Web3, Thai prompts, and Shannon handoff) was moved from the frontmatter description: to the skill body under a new section "When This Skill Activates / เมื่อใดที่สกิลนี้ทำงาน". Claude reads the body when the skill is invoked anyway, so trigger coverage is preserved without consuming session-listing token budget.

New "Use when…" description

Use when asked to generate professional cybersecurity documents — IR
playbooks, DFIR forensic reports, SOC L1–L3 triage runbooks, DevSecOps
pipeline configs, threat models, compliance gap analyses, or executive
cyber-risk reports. Covers 22 domains across AppSec / Cloud / OT / AI-ML /
API / Identity / Web3, bilingual Thai+English output mapped to NIST 800-53,
MITRE ATT&CK, OWASP, ISO 27001. Also: post-pentest defensive (Shannon
handoff manifest). Triggers: "incident response", "SOC triage", "DFIR",
"threat hunt", "compliance audit", "การตอบสนองต่อเหตุการณ์",
"post-pentest defensive".

Other Changes

• README.md v4.0.3 rework — Table of Contents, NIST CSF 2.0 coverage map, Frameworks (73) badge, structured Support table, Related Plugins refresh
• Manifest version reconciliation — plugin.json / marketplace.json bumped to 4.0.3 (had remained at 4.0.1 when v4.0.2 tag was published on 2026-03-01)

Verification

• bash tests/validate-plugin.sh --skip-install-check — 67 PASS / 0 FAIL (2 advisory framework-staleness WARN: mitre-attack, cisa-kev — unrelated to this release)
• Folded YAML description length verified at 590 chars
• All 22 domain references and trigger keyword categories preserved in skill body

PRs

• #10 — fix: trim SKILL.md description to 590 chars + README v4.0.2 rework
• #11 — chore: bump version to 4.0.3, reconcile manifest with tag history

Credit

Filed by a user hitting the /doctor warning during a normal session — thank you for the detailed reproduction steps and the impact analysis. 🙏

v4.0.2 — D19-D22 Enhancements (Issue #6)

What's New

Addresses all 6 recommendations from Issue #6 — D19-D22 test results and improvement items.

frameworks.json (69 → 73 entries)

• 4 new entries: FIDO2/WebAuthn, SPIFFE, OAuth 2.1, Ethereum Security Best Practices
• 3 used_in updates: owasp-llm-top10, nist-ai-rmf, nist-800-207 now reference new domain files

Quick Reference Summaries (All 4 domains)

• Front-loaded key frameworks, risk tables, essential controls, and Thai context for faster skill response

D19 Agentic AI Security

• 4 real-world attack scenarios: Plugin Hijacking, MCP Tool Misuse, Multi-Agent Cascade, Memory Poisoning
• MITRE ATLAS + OWASP Agentic mapping per scenario
• Defense-in-depth architecture diagram + Splunk SPL / KQL anomaly detection templates

D20 Post-Quantum Cryptography ↔ D22 Web3 Cross-Domain

• D22: "Post-Quantum Impact on Blockchain" — ECDSA/EdDSA quantum vulnerability, 4-phase migration path
• D20: Reciprocal blockchain subsection + CNSA 2.0 timeline for 6 Thai CII sectors

D21 Identity & Access Security

• Entra ID Conditional Access policy JSON, Okta FIDO2 policy (Terraform), AWS IAM Identity Center SCIM config
• PromptPay identity binding architecture with SIM swap security considerations
• NDID protocol details (Tendermint, DID format, assertion signing)

Thai Context Deepening (D20, D21, D22)

• D20: CII sector-specific PQC migration timeline, BAHTNET/PromptPay PQC feasibility
• D21: PromptPay + NDID integration roadmap
• D22: ก.ล.ต. 2025-2026 regulatory updates, ICO Portal security requirements, Digital Asset Custodian standards

Validation

• 68 PASS / 0 FAIL / 1 SKIP
• 6 commits, 4 files changed (reference files), 3 doc files updated

v4.0.0 — 22 Domains: Agentic AI, PQC, Identity, Web3

What's New

4 New Domains (+4,862 lines)

• Domain 19: Agentic AI Security (1,108 lines) — OWASP Agentic Top 10 2026, agent permission models, memory & context security, multi-agent orchestration, MITRE ATLAS 2025 agent techniques
• Domain 20: Post-Quantum Cryptography Migration (1,326 lines) — NIST FIPS 203/204/205, CNSA 2.0 timeline (2025-2035), crypto-agility assessment, hybrid cryptography patterns, TLS/PKI migration
• Domain 21: Identity & Access Security (1,243 lines) — NIST 800-63B Rev 4, FIDO2/Passkeys, non-human identity management, ITDR, SPIFFE/SPIRE, NIST IR 8587 token protection
• Domain 22: Web3 & Blockchain Security (1,185 lines) — OWASP Smart Contract Top 10 2026, smart contract audit methodology, DeFi security patterns, wallet & key management, bridge security

11 Enhancements

• NIST Cyber AI Profile (NISTIR 8596) in D12
• MITRE ATLAS 2025 agent techniques (14 new) in D12
• NIST LEV metric (CSWP 41) in D14
• CWE Top 25 (2025) in D6
• Claude Code Security reference in D6
• Cyber resilience metrics in D17
• Workforce development templates in D17
• Compliance cross-walk matrix in D9
• Guided decision tree fallback
• Template variables for all outputs
• frameworks.json expanded to 69 entries

Impact

Metric	v3.7.0	v4.0.0	Delta
Domains	18	22	+4
Reference file lines	~11,247	~16,109	+4,862
Framework entries	54	69	+15
Validation checks	60	68	+8

Validation: 68 PASS, 0 FAIL

v3.6.1 — Shannon Cross-References & Version Fix

Cybersecurity-Pro Plugin v3.6.1

Maintenance release: cross-reference integration with Shannon pentest plugin and version footer fix.

Added

• Shannon pentest cross-references across 3 domain files + README
  • code-security-analysis.md — link to Shannon for automated vulnerability discovery
  • api-security.md — link to Shannon for API endpoint testing
  • vulnerability-management.md — link to Shannon for continuous scanning
  • README updated with Shannon integration workflow

Fixed

• cross-domain-integration.md document footer version corrected: 3.4.0 → 3.6.1

Complementary Workflow

Shannon (offensive)              cybersecurity-pro (defensive)
  Find vulnerabilities    →        Remediation plans
  OWASP/CVSS findings     →        Compliance mapping
  PoC evidence             →        IR playbooks
  Scan reports             →        Executive summaries

---

Full Changelog: v3.6.0...v3.6.1

Install: claude plugin install cybersecurity-pro@pitimon-cybersecurity

v3.6.0 — Domain 18: OT/ICS Security

What's New

Domain 18: OT/ICS Security (NEW)

New domain covering Operational Technology and Industrial Control System security — the first dedicated OT security domain in the plugin.

Reference file: references/ot-ics-security.md (814 lines, 10 sections)

Frameworks covered:

• NIST SP 800-82 Rev.3 — OT security guide
• IEC 62443 (ISA/IEC) — Industrial automation and control system security
• Purdue Model / ISA-95 — OT network segmentation architecture
• MITRE ATT&CK for ICS — ICS-specific TTPs
• NERC CIP — Electric grid reliability standards

Key content:

• IT vs OT comparison table (priorities, protocols, lifespan)
• Purdue Model 6-level ASCII diagram with firewall/DMZ placement
• IEC 62443 zones and conduits architecture + Security Levels SL 1-4
• OT asset discovery (passive vs active) with tool recommendations (Claroty, Nozomi, Dragos, Tenable.ot)
• Industrial protocol analysis (Modbus TCP, DNP3, OPC UA, BACnet, EtherNet/IP, PROFINET)
• MITRE ATT&CK for ICS technique mapping (T0858, T0855, T0831, T0886, etc.)
• Safety-first OT incident response decision tree
• PLC/HMI/SCADA hardening checklists
• Thai CII context under พ.ร.บ. ไซเบอร์ 2562 (Energy, Water, Transport, Healthcare, Telecom, Finance, Government)
• Quick Win / Standard / Advanced implementation checklist

Minor Enhancements

• D4 (SOC Operations): Added SIEM/XDR Platform Options table — Splunk, Elastic Security, Microsoft Sentinel, Defender XDR, Google Chronicle, Wazuh, IBM QRadar
• D9 (Compliance Frameworks): Added CIS v8.1 Asset Class Mapping table (Devices, Software, Data, Users, Network) with OT Relevance column
• D11 (Zero Trust Architecture): Added MCRA (Microsoft Cybersecurity Reference Architecture) as vendor-specific implementation reference alongside NIST 800-207
• D10, D16: Added cross-references to D18

Infrastructure

• frameworks.json: 50 → 54 entries (+NIST 800-82, IEC 62443, Purdue Model/ISA-95, MITRE ATT&CK for ICS)
• Updated all supporting files: CLAUDE.md, validate-plugin.sh, smoke-test-prompts.md, INSTALL.md, CHANGELOG.md

Stats

• 16 files changed: 1,075 insertions, 61 deletions
• 18 domains total (up from 17)
• 54 frameworks tracked in frameworks.json
• Validation: 60 PASS, 0 FAIL, 0 WARN

Full Changelog

v3.5.1...v3.6.0

v3.5.1 — Man-Day Cost Estimation

What's New

Man-Day Cost Estimation (docs/MANDAY-ESTIMATION.md)

Full project cost estimation based on v3.5.0 metrics (14,073 lines, 33 files, 17 domains, 50 frameworks).

63 man-days across 6 phases:

Phase	Man-Days	%
Research & Architecture	12	19%
Core Skill Engine	3	5%
Domain Reference Files (17)	34	54%
Testing & QA	5	8%
Documentation	6	10%
Framework Tracking	3	5%

Cost range: 500K - 1.5M THB (Senior Cybersecurity Engineer, Thai market rate)

AI acceleration: ~15x — 63 man-days equivalent completed in 4 calendar days (12 sessions)

Docs-only release. No functional changes.

Full Changelog: v3.5.0...v3.5.1

v3.5.0 — Documentation Completeness + Framework Maintenance

What's New

Framework Version Maintenance Workflow

• frameworks.json — single source of truth for 50 versioned framework references (versions, grep patterns, file locations, staleness tracking)
• tests/check-framework-updates.sh — ad-hoc CLI with color-coded staleness report (CRITICAL/DUE/OK)
• .github/workflows/framework-review.yml — quarterly CI (Jan/Apr/Jul/Oct) auto-creates GitHub Issues with review checklists
• docs/FRAMEWORK-UPDATE-RUNBOOK.md — step-by-step update procedure with post-update checklist
• tests/validate-plugin.sh Section 5 — framework pattern consistency checks

Documentation Completeness Update

• README.md — repo structure updated with 4 new files, framework count 30+ → 50+, contributing guide adds frameworks.json step, validation count 55+ → 58+
• docs/INSTALL.md — version refs updated to 3.5.0, cache directory structure includes new files
• docs/TROUBLESHOOTING.md — new section for framework validation errors (Section 5 FAIL, stale WARN, JSON syntax)
• tests/smoke-test-prompts.md — new meta-test section for framework maintenance validation
• CLAUDE.md — contributing guide adds frameworks.json step for new domains

Version Bump

• plugin.json and marketplace.json bumped to v3.5.0

Validation

• 58 PASS, 0 FAIL, 1 SKIP (install state)
• 50/50 frameworks within staleness thresholds
• Version 3.5.0 consistent across all config and documentation files

Stats

• 8 files changed, 154 insertions, 16 deletions
• 17 domains, 50+ frameworks, 58+ validation checks

Full Changelog: v3.4.0...v3.5.0

v3.4.2: Framework Version Maintenance Workflow

What's New

Automated tracking and update process for 50 versioned framework references across 17 domains. Eliminates the reactive, manual QA that found stale versions in v3.3.1 (PCI DSS, CIS Controls, CSA CCM, OWASP LLM Top 10).

New Files

File	Purpose
frameworks.json	Single source of truth — 50 frameworks with versions, grep patterns, used_in files, staleness thresholds
tests/check-framework-updates.sh	Ad-hoc CLI showing color-coded staleness report (CRITICAL / DUE / OK)
.github/workflows/framework-review.yml	Quarterly CI (Jan/Apr/Jul/Oct) auto-creates GitHub Issues with review checklists
docs/FRAMEWORK-UPDATE-RUNBOOK.md	Step-by-step update procedure for version-string and substantive changes

Enhanced

• tests/validate-plugin.sh — Section 5: framework JSON validity, grep pattern matching in declared files, staleness warnings (WARN counter added to summary)
• CLAUDE.md — Framework Maintenance section with key commands and quarterly review info
• CHANGELOG.md — [Unreleased] entry documenting the maintenance workflow

How It Works

frameworks.json (source of truth)
  ├── validate-plugin.sh Section 5   → CI catches pattern mismatches on every push
  ├── check-framework-updates.sh     → Developer checks staleness ad-hoc
  └── framework-review.yml           → Quarterly GitHub Issue with checklist

Validation

• validate-plugin.sh: 58 PASS, 0 FAIL, 0 WARN
• check-framework-updates.sh: 0 CRITICAL, 0 DUE, 50 OK
• 7 files changed, 1,299 insertions

Framework Categories Tracked

Category	Count	Examples
NIST SPs	9	CSF 2.0, 800-53 Rev 5, 800-61 Rev 2, 800-207, AI RMF
ISO/IEC	5	27001:2022, 27014:2020, 42001:2023
OWASP	4	Top 10 2021, LLM Top 10 2025, API Top 10 2023, SAMM
MITRE	3	ATT&CK v15, ATLAS 4.0, D3FEND
Compliance	7	PCI DSS v4.0.1, SOC 2, GDPR, HIPAA, PDPA
CIS	3	Controls v8.1, Docker Benchmark, Kubernetes Benchmark
Threat Intel	4	STIX 2.1, TAXII 2.1, TLP 2.0, Diamond Model
Vuln Mgmt	5	CVSS v4.0, EPSS, CISA KEV, SSVC 2.0
Supply Chain	3	SLSA 1.0, CycloneDX 1.6, SARIF 2.1.0
Cloud/AI Gov	7	CSA CCM v4.1, EU AI Act, C2M2, SEC Rules

Full Changelog: v3.4.1...v3.4.2

v3.4.1 — README Professional Redesign

README Professional Redesign for Adoption

Docs-only release — README.md redesigned from internal documentation style to a professional product page targeting Thai cybersecurity professionals and CISOs.

New Sections

• Hero section — Centered layout with 5 Shields.io badges (version, CI, license, domains, language)
• Key Stats — 17 Domains | 30+ Frameworks | < 5% Context Budget highlight block
• Quick Win demo — Ransomware IR playbook with sample output showing what the plugin generates in 30 seconds
• NIST CSF 2.0 Coverage Map — ASCII diagram mapping all 17 domains to GOVERN / IDENTIFY / PROTECT / DETECT / RESPOND / RECOVER
• Comparison table — Manual Prompting vs cybersecurity-pro vs Enterprise Tools across 8 dimensions

Improved Sections

• Capabilities tables — Domain numbers (D1–D17), removed trigger keywords column, regrouped into 5 categories
• Usage Examples — Top 6 hero examples + collapsible <details> with remaining 9
• Frameworks & Standards — Regrouped from flat 26-item list into 7 audience-based categories (SOC/IR, DevSecOps, Compliance, Executive, Cloud, AI, Threat Intelligence)
• Architecture + Token Budget — Merged into single compact section
• Why This Plugin — Enhanced value propositions, Thai regulatory context (พ.ร.บ. ไซเบอร์, PDPA) highlighted

Stats

• 2 files changed: README.md, CHANGELOG.md
• 283 insertions, 153 deletions
• No plugin code changes — docs-only release
• Validation: 55 PASS, 0 FAIL

Full Changelog: v3.4.0...v3.4.1

v3.4.0 — Security Governance & Executive Leadership

What's New

Domain 17: Security Governance & Executive Leadership — the strategic governance layer for the cybersecurity-pro skill, covering the "why" and "who decides" at board and C-suite level.

New Reference File

references/security-governance-executive.md (797 lines, 9 sections):

Section	Content
1. Governance Landscape & Role Architecture	Hierarchy diagram, governance vs management distinction
2. NIST CSF 2.0 GOVERN Function	6 categories (GV.OC/RM/RR/PO/OV/SC), 31 subcategories
3. ISO 27014:2020 Governance	5 processes (Evaluate/Direct/Monitor/Communicate/Assure)
4. Security Maturity Models	C2M2 v2.1 (10 domains, MIL 0-3), CMMI, self-assessment
5. Executive Roles: CISO, CAIO, CAISO	Role definitions, reporting structures, decision tree
6. Board Reporting & SEC Disclosure	SEC 8-K/S-K rules, materiality template, KPI dashboard
7. AI Governance at Executive Level	NIST AI RMF GOVERN, ISO 42001, EU AI Act obligations
8. Implementation Roadmap	5-phase (Month 1-12), KPIs, operating model diagram
9. Framework References & Checklist	10-framework table, Quick Win/Standard/Advanced checklist

Key Frameworks

• Primary: NIST CSF 2.0 GOVERN, ISO/IEC 27014:2020
• Supporting: NACD Handbook 2023, C2M2 v2.1, SEC Disclosure Rules 2023, NIST AI RMF 1.0, ISO 42001:2023, EU AI Act, Singapore IMDA, CMMI

Changes

• 15 files changed (1 new + 14 modified), 999 insertions
• SKILL.md: 17 domains with full keyword set and decision tree
• Cross-references backfilled in D4, D8, D9, D12, D16
• D16 updated: GOVERN mapping table includes D17, dependency diagram with GOVERN box
• docs/INSTALL.md: updated version refs and file lists to 17
• QA fixes: subcategory count (31 not 32), SEC URL, CISO keyword precision
• Validation: 55 PASS, 0 FAIL

Full Changelog

v3.3.1...v3.4.0