refactor: cleanup submodules and add depth support

[amondnet]

Summary

• Remove all vendor and source submodules that are no longer needed (sources/, vendor/)
• Remove vendor-synced skills and update plugin manifests accordingly
• Add depth option to SubmoduleMeta, VendorMeta, and ExtensionMeta interfaces for shallow cloning
• Pass --depth flag to git submodule commands and set shallow=true in .gitmodules

Commits

1. chore: remove vendor and source submodules — deinit and remove 16 submodules
2. chore: remove vendor-synced skills and update plugin manifests — clean up generated skill files
3. feat(scripts): add shallow clone depth support for submodules — new depth option in meta.ts/cli.ts

Test plan

• Verify bun scripts/cli.ts init works with depth-enabled entries
• Verify bun scripts/cli.ts sync passes depth to submodule update
• Verify remaining plugins still load correctly

---

Summary by cubic

Removed obsolete sources/* and vendor/* submodules, migrated plugin skills to skills.sh with lock files, and added shallow clone depth to speed up setup. Also fixed vendor skill sync to preserve symlinks.

• Refactors

  • Removed 19 submodules from .gitmodules; remaining vendor submodule: web-design-guidelines.
  • Moved skills/ → .agents/skills/ across migrated plugins and added "skills": "./.agents/skills/" to each plugin.json.
  • Deleted vendor-synced skills and old SYNC.md/LICENSE.md files; restored verbatimSymlinks in vendor skill copy to keep symlinks intact.
  • Updated agent-browser skill docs (CDP install/upgrade, auth import, iframe/webview support, get cdp-url, retina viewport).

• New Features

  • Added depth to SubmoduleMeta, VendorMeta, and ExtensionMeta; CLI passes --depth to git submodule commands and marks shallow = true for depth-enabled entries.
  • Switched to skills.sh-managed installs with per-plugin skills-lock.json for reproducible skills.

^{Written for commit 000f8e1. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
claude-code-plugins	Ready	Preview, Comment	Mar 25, 2026 11:54am

[cubic-dev-ai]

4 issues found across 1151 files

Confidence score: 3/5

• There is concrete user-impact risk in documentation: plugins/agent-browser/.agents/skills/dogfood/SKILL.md shows unquoted shell interpolation, which can break arguments and may enable shell-injection-style mistakes when users copy commands.
• plugins/agent-browser/.agents/skills/agent-browser/references/authentication.md has an incorrect .gitignore pattern, so auth-state.json may be committed and expose session-token state; this is a meaningful security hygiene concern.
• The remaining issues in plugins/agent-browser/.agents/skills/agent-browser/references/proxy-support.md and plugins/agent-browser/.agents/skills/agent-browser/references/commands.md are lower severity doc correctness problems, so this is not necessarily merge-blocking but does add avoidable confusion/risk.
• Pay close attention to plugins/agent-browser/.agents/skills/dogfood/SKILL.md and plugins/agent-browser/.agents/skills/agent-browser/references/authentication.md - they carry the highest-impact command-safety and credential-leak guidance issues.

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/agent-browser/.agents/skills/dogfood/SKILL.md">

<violation number="1" location="plugins/agent-browser/.agents/skills/dogfood/SKILL.md:53">
P1: Unquoted placeholder interpolation in shell commands allows argument breaking and potential shell injection; quote dynamic values in command examples.

(Based on your team's feedback about vendor-synced, read-only skill files.) [FEEDBACK_USED]</violation>
</file>

<file name="plugins/agent-browser/.agents/skills/agent-browser/references/authentication.md">

<violation number="1" location="plugins/agent-browser/.agents/skills/agent-browser/references/authentication.md:181">
P1: The `.gitignore` pattern is incorrect and does not ignore `auth-state.json`, which can lead to committing session-token state files.</violation>
</file>

<file name="plugins/agent-browser/.agents/skills/agent-browser/references/proxy-support.md">

<violation number="1" location="plugins/agent-browser/.agents/skills/agent-browser/references/proxy-support.md:94">
P2: The region parsing regex does not match proxied URLs with a scheme, so `region` becomes empty in the geo-testing loop.</violation>
</file>

<file name="plugins/agent-browser/.agents/skills/agent-browser/references/commands.md">

<violation number="1" location="plugins/agent-browser/.agents/skills/agent-browser/references/commands.md:9">
P2: The documented data URL scheme is incorrect (`data://`); it should be `data:`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[gemini-code-assist]

Warning

Gemini encountered an error creating the summary. You can try again by commenting /gemini summary.

[cubic-dev-ai]

1 issue found across 723 files

Confidence score: 3/5

• The plugins/ai-sdk/.agents/skills/ai-sdk/ai-sdk symlink points to a non-existent target, so consumers attempting to resolve ai-sdk will fail at runtime.
• Severity is moderate (7/10) with high confidence, indicating a concrete resolution failure rather than a minor housekeeping issue.
• Pay close attention to plugins/ai-sdk/.agents/skills/ai-sdk/ai-sdk - incorrect symlink target breaks skill resolution.

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/ai-sdk/.agents/skills/ai-sdk/ai-sdk">

<violation number="1" location="plugins/ai-sdk/.agents/skills/ai-sdk/ai-sdk:1">
P1: This symlink target is incorrect for its location and resolves to a non-existent path, so consumers of this skill link will fail to resolve `ai-sdk`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}