* chore: remove dev artifacts from installer scan surface
Hermes (and other harnesses that clone raw GitHub instead of honoring
.clawhubignore) scan files that never reach an installed skill, producing
a wall of false-positive security findings. Remove the stale SKILL-original.md
backup, internal docs/plans and docs/test-results, and release-notes.md so
the scanned tree matches what actually ships.
These were already excluded from the ClawHub bundle via .clawhubignore and
from git archives via .gitattributes export-ignore. No runtime files change.
Refs #464
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: drop dangling SKILL-original.md reference in AGENTS.md
Greptile-flagged: the deletion left a 'kept for reference only' pointer to
the removed file. Refs #465
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
v3.0.1 added .gitattributes rules that excluded both directories from
git archive output, shrinking the claude.ai .skill bundle. But Claude
Code's /plugin install fetches the SAME archive, so users installing
v3.0.1 or v3.0.2 received a tarball with no plugin manifest and no
skill files. Install appeared successful but the plugin was a useless
empty shell.
Proof:
git archive v3.0.0 | grep 'skills/|\.claude-plugin/' | wc -l # 8
git archive v3.0.1 | grep 'skills/|\.claude-plugin/' | wc -l # 0
git archive v3.0.2 | grep 'skills/|\.claude-plugin/' | wc -l # 0
No issue reports yet because:
- Cached pre-v3.0.1 installs keep working (it's the new-install path
that's broken)
- The breakage is under 24 hours old
- Users invoking the skill via natural language go through
skill-selector rather than /last30days slash command
Also reverts v3.0.2's "skills": ["skills"] back to "./", the value
that shipped in every tag from v2.1.0 through v3.0.0. That change was
a misdiagnosis; the manifest wasn't in the tarball anyway so it had
no effect on user-visible installs.
Archive file count after fix: 97 (cap is 200, plenty of room).
Follow-up: move claude.ai-specific bundle exclusions into
scripts/build-skill.sh where they belong, rather than .gitattributes
which cannot distinguish between the two distribution channels.
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Matt Van Horn