# scan-synced-content.mjs — CHALLENGE / FLAG waivers
#
# One waiver per line:  <path-or-glob>:<rule-id>  <reason>
#   - path-or-glob : repo-relative path; `*` = one segment, `**` = any depth.
#   - rule-id      : the finding id printed by the scanner (e.g. pipe-to-shell-doc,
#                    outbound-network, hook-definition, mcp-remote, dynamic-exec).
#   - reason       : REQUIRED free text (why this dual-use pattern is legitimate).
#                    Separate it from the rule id with 2+ spaces or a `#`.
#
# A waiver downgrades a CHALLENGE or FLAG finding to a reported-but-PASSING note.
# REFUSE findings are NEVER waivable here — a real hard-block must be fixed at the
# source, not signed away. Malformed lines (missing reason) are IGNORED, not honored.
#
# The point of an in-repo allowlist: a legitimate CHALLENGE gets signed off in a
# reviewed commit (this file) instead of by weakening a detection pattern.

# ── Known upstream one-line installers (documented install steps in READMEs). ──
# These are legitimate `curl … | sh` install instructions, not executable payloads
# (they live in markdown docs, hence graded CHALLENGE not REFUSE). Waivers are
# PER-PLUGIN and name the specific installer: the former corpus-wide
# `plugins/**/README.md:pipe-to-shell` line pre-cleared ANY future curl|sh in ANY
# README forever (2026-07-14 ops review) — a new install target in a README not
# listed here now correctly CHALLENGEs and needs its own reviewed, path-scoped line.
plugins/ai-agency/make-scenario-builder/README.md:pipe-to-shell  documented official Ollama installer (https://ollama.com/install.sh) as the local-model setup step
plugins/ai-ml/ai-sdk-agents/README.md:pipe-to-shell  documented official Ollama installer (https://ollama.com/install.sh) as the manual local-model fallback
plugins/community/geepers-agents/README.md:pipe-to-shell  documented official Ollama installer (https://ollama.com/install.sh) as the local-model setup step
plugins/ai-ml/jeremy-vertex-engine/README.md:pipe-to-shell  documented official Google Cloud SDK installer (https://sdk.cloud.google.com) as the gcloud setup step
plugins/ai-ml/jeremy-vertex-validator/README.md:pipe-to-shell  documented official Google Cloud SDK installer (https://sdk.cloud.google.com) as the gcloud setup step
plugins/devops/jeremy-adk-terraform/README.md:pipe-to-shell  documented official Google Cloud SDK installer (https://sdk.cloud.google.com) as the gcloud setup step
plugins/devops/jeremy-vertex-terraform/README.md:pipe-to-shell  documented official Google Cloud SDK installer (https://sdk.cloud.google.com) as the gcloud setup step
plugins/community/mnemos/README.md:pipe-to-shell  upstream's own install.sh (raw.githubusercontent.com/polyxmedia/mnemos) documented as the install step
plugins/community/portaljs/README.md:pipe-to-shell  upstream's own install script (raw.githubusercontent.com/datopian/portaljs) documented as the install step
plugins/ai-ml/ollama-local-ai/**:pipe-to-shell  official Ollama installer is the documented setup path for this skill
plugins/mcp/slack-channel/**:pipe-to-shell  documented Bun/Claude install steps in slack-channel setup docs (covers README.md + .audit-harness/README.md intent-audit-harness installer)
plugins/saas-packs/**/skills/**/SKILL.md:pipe-to-shell  documented vendor-CLI install step inside a SaaS-pack skill

# ── Remote MCP servers that ARE the plugin's engine (reviewed, no credentials embedded). ──
plugins/mcp/servicegraph/.mcp.json:mcp-remote  the plugin IS an agent-skills front-end to the remote ServiceGraph MCP server (https://mcp.servicegraph.co, plain HTTP transport, no embedded credentials) — reviewed 2026-07-07, curated mirror pinned at fork SHA df4648a4
plugins/mcp/servicegraph/README.md:mcp-remote  same remote MCP endpoint documented as the setup step in the upstream README — reviewed 2026-07-07 with the .mcp.json above

# ── skills-janitor (khendzel) — vetted 2026-07-13 @ upstream c63c3478e (PR #1020). ──
# The three GitHub-discovery scripts call out ONLY to api.github.com /
# raw.githubusercontent.com (plus precheck's user-supplied SKILL.md URL, which is
# fetched to a mktemp file and parsed for frontmatter — never executed or sourced).
# GITHUB_TOKEN is sent solely as an Authorization header to api.github.com — the
# credential's own service; precheck's AUTH_ARGS array never accompanies the
# raw/arbitrary-URL fetches. Full-read vet per 699 playbook: 23 admitted files,
# scan 0 REFUSE, all 5 skills j-rig 12/12.
plugins/community/skills-janitor/scripts/search.sh:outbound-network  GitHub skill-search queries api.github.com only (the documented discovery feature) — vetted 2026-07-13 @ c63c3478e
plugins/community/skills-janitor/scripts/precheck.sh:outbound-network  fetches SKILL.md from raw.githubusercontent.com / api.github.com / a user-supplied URL, read-and-parse only, never executed — vetted 2026-07-13 @ c63c3478e
plugins/community/skills-janitor/scripts/compare.sh:outbound-network  keyword market comparison against api.github.com only — vetted 2026-07-13 @ c63c3478e
plugins/community/skills-janitor/scripts/search.sh:secret-exfil-cooccur  GITHUB_TOKEN sent only as an Authorization header to api.github.com, its own service
plugins/community/skills-janitor/scripts/precheck.sh:secret-exfil-cooccur  GITHUB_TOKEN attached only to the api.github.com request (AUTH_ARGS array), never to the raw or arbitrary-URL fetches
plugins/community/skills-janitor/scripts/compare.sh:secret-exfil-cooccur  GITHUB_TOKEN sent only as an Authorization header to api.github.com, its own service

# ── governed-second-brain committed runtime bundle — reviewed 2026-07-16 @ upstream 967fb70f. ──
# The team-mode client sends TEAMKB_API_TOKEN only to the owner-configured
# TEAMKB_API_URL; local mode is in-process and performs no runtime network after
# its one-time pinned native dependency install. The dynamic constructor is
# AJV's bundled schema compiler operating on the plugin's fixed schemas, not
# user-provided source text. The upstream clean-install and full-chain smokes
# exercise both modes, fail-closed dispatch, governance, and audit verification.
plugins/mcp/governed-second-brain/plugin-runtime/governed-brain.cjs:secret-exfil-cooccur  team-mode TEAMKB_API_TOKEN is sent only to its configured TEAMKB_API_URL service; reviewed upstream bundle 967fb70f
plugins/mcp/governed-second-brain/plugin-runtime/governed-brain.cjs:dynamic-exec  AJV schema compiler in the generated bundle compiles fixed plugin schemas, not user-provided source text; reviewed upstream bundle 967fb70f

# ── a2a-client cancellation guard — reviewed 2026-09-01 @ d359d70d. ──
# The only hook is a blocking PreToolUse confirmation for the exact cancel_task
# namespaces. It invokes a fixed in-plugin script, has no network or credential
# access, and complements the server-side default-off and task-bound phrase gates.
plugins/mcp/a2a-client/hooks/hooks.json:hook-definition  fixed blocking PreToolUse confirmation for cancel_task only; no network, credential access, or dynamic command construction — reviewed 2026-09-01
plugins/mcp/a2a-client/dist/index.js:secret-exfil-cooccur  A2A reads only its explicitly named credential variables and sends them solely to the operator-requested HTTPS origin after exact host authorization; SSRF, redirect, and credential-scope tests reviewed 2026-09-01
plugins/mcp/a2a-client/dist/index.js:dynamic-exec  generated AJV schema compiler code from fixed MCP SDK schemas; no untrusted source text reaches the constructor; reviewed bundle and 126-test lane 2026-09-01
plugins/mcp/a2a-client/dist/index.js:long-base64-blob  bundled dependency WASM payload from the pinned A2A and MCP dependency graph; npm provenance, audit, deterministic bundle, and package smoke reviewed 2026-09-01

# ── agent-systems-toolkit — offline evidence-manifest validation. ──
plugins/skill-enhancers/agent-systems-toolkit/skills/production-upgrade/scripts/audit_evidence.py:outbound-network  imports urllib.parse.urlsplit solely for offline HTTPS URL validation; contains no request client, socket use, or command execution — reviewed 2026-09-05

# ── sources-change-unscanned is a ONE-SHOT waiver (enforced in code by
# honoredWaivers, blocker 62ye.3 / #985 defect 3): a line is honored ONLY in the
# PR whose diff adds it, so it can never persistently waive future source-list
# changes. Do NOT leave a standing line here — after its PR merges it is inert
# (the diff-added check ignores it) and only misleads. Each sources PR that needs
# the sign-off adds its own `sources.yaml:sources-change-unscanned  <reason>`.
# (The spent one-shot lines for skills-janitor / walkie-talkie / localplugins /
# quit-sponsor were removed 2026-07-14 per this rule — their vet evidence lives
# in git history and the intake PRs #1020/#1030 that added them.)
sources.yaml:sources-change-unscanned  reviewed quarantine/delist of walkie-talkie: removes the active registry and matching lock approval without introducing any mirrored content
sources.lock.json:sources-change-unscanned  reviewed quarantine/delist of walkie-talkie: removes the matching lock approval after the active registry was removed, without introducing any mirrored content
sources.yaml:sources-change-unscanned  reviewed UIZZE source-selection repair: narrows source_path to upstream plugins/claude-directory and selects the complete anti-ui-slop package while preserving verified:false; no mirror or lock bytes change, and sync remains quarantined until a separate exact-SHA review and relock

# ── hyperflow orchestrator skill: upstream web-research feature. ──
plugins/ai-agency/hyperflow/skills/hyperflow/SKILL.md:allowed-tools-network  upstream v5.8.x added WebFetch/WebSearch to the orchestrator skill for its web-research feature (skills/hyperflow/web-research.md); mirror content hand-reviewed 2026-07-10 (evidence gate on #1008 + the be6ae2d3->eae6e34c5 delta review) — external mirror, upstream's design, no credential surface

# ── E1.13 retired-domain correction: pre-existing dual-use surfaces, content unchanged. ──
# The complete PR diff for each path was reviewed at 921f94c0616f71ba1ed404274eec34b687f7a7fc.
# E1.13 changes only a marketplace URL, author contact, or example target; it does
# not alter the reviewed hook or network-tool capability that the scanner reports.
plugins/productivity/prettier-markdown-hook/README.md:hook-definition  E1.13 changes only the retired marketplace URL; the pre-existing documented hook definition is unchanged — reviewed 2026-08-16
plugins/productivity/youtube-strategy/skills/yt-brief/SKILL.md:allowed-tools-network  E1.13 changes only the author contact; the pre-existing WebSearch capability is unchanged — reviewed 2026-08-16
plugins/productivity/youtube-strategy/skills/yt-ideation/SKILL.md:allowed-tools-network  E1.13 changes only the author contact; the pre-existing WebSearch capability is unchanged — reviewed 2026-08-16
plugins/productivity/youtube-strategy/skills/yt-outline/SKILL.md:allowed-tools-network  E1.13 changes only the author contact; the pre-existing WebSearch capability is unchanged — reviewed 2026-08-16
plugins/productivity/youtube-strategy/skills/yt-packaging/SKILL.md:allowed-tools-network  E1.13 changes only the author contact; the pre-existing WebSearch capability is unchanged — reviewed 2026-08-16
plugins/productivity/youtube-strategy/skills/yt-research/SKILL.md:allowed-tools-network  E1.13 changes only the author contact; the pre-existing WebSearch capability is unchanged — reviewed 2026-08-16
plugins/security/security-headers-analyzer/skills/analyzing-security-headers/SKILL.md:allowed-tools-network  E1.13 changes only the example target domain; the pre-existing WebFetch/WebSearch capability is unchanged — reviewed 2026-08-16

# ── UIZZE free catalogue workflow — vetted 2026-07-22 @ upstream c95111fd1517. ──
plugins/design/uizze/skills/anti-ui-slop/SKILL.md:allowed-tools-network  WebFetch is limited to gathering structural UI evidence from the documented public https://uizze.com catalogue; the complete free workflow requires no account, token, MCP, script, or executable, and the skill forbids copying proprietary assets

# ── Skill Refiner plugin: the 3-layer hook architecture IS the product. ──
# /j-rig is the eval-guided SKILL.md improvement loop; its sinker/line/hook hooks
# are the reviewed, intended feature (not an injected payload). They only invoke
# the published @intentsolutions/refiner CLI + a deterministic validator — no
# network, no embedded credentials, no dynamic-exec of untrusted input. SKILL_ID
# is validated (^[a-zA-Z0-9_-]+$) before any use. Reviewed 2026-07-09.
plugins/productivity/j-rig/**:hook-definition  the sinker/line/hook 3-layer architecture is this plugin's purpose; hooks only wrap the published @intentsolutions/refiner CLI + a deterministic validator, no network/credentials/dynamic-exec — reviewed 2026-07-09

# ── Reviewed defensive scanner signatures. ──
plugins/security/agent-safety-preflight/scripts/agent_preflight_lite.py:outbound-network  defensive scanner regex detects curl/wget install chains; it does not perform network calls
plugins/saas-packs/snowflake-pack/skills/snowflake-cost-leak-hunter/scripts/analyze_cost_evidence.py:outbound-network  Reviewer Jeremy Longshore; expires 2027-08-31; Python stdlib urlsplit validates local strings only and performs no network I/O
plugins/saas-packs/snowflake-pack/skills/snowflake-failover-readiness-drill/scripts/test_analyze_failover_readiness.py:outbound-network  negative AST isolation test names urllib only to assert the analyzer cannot import network/process modules; reviewed exact implementation SHA b6ffdad68d5c

# ── Grammarly v2 operator client — reviewed 2026-09-05 on PR #1449. ──
# OAuth credentials go only to the exact Grammarly token endpoint. Bearer tokens
# go only to exact, fixed api.grammarly.com document contracts and are never sent
# to the presigned upload destination. Uploads accept only HTTPS S3-shaped hosts,
# globally routable DNS results, an exact approved origin, and a pinned address
# while TLS still verifies the approved hostname. The manifest auditor parses an
# origin string offline and performs no network I/O.
plugins/saas-packs/grammarly-pack/skills/grammarly-document-evaluator/scripts/grammarly_api.py:secret-exfil-cooccur  bundled standalone evaluator runtime: OAuth client credentials are form-posted only to auth.grammarly.com; bearer tokens are sent only to fixed api.grammarly.com contracts and never to upload URLs
plugins/saas-packs/grammarly-pack/skills/grammarly-document-evaluator/scripts/grammarly_api.py:outbound-network  bundled standalone evaluator runtime: documented Grammarly control-plane calls plus origin-approved S3 upload with public-address validation, address pinning, and hostname-verified TLS
plugins/saas-packs/grammarly-pack/skills/grammarly-data-safety-guardian/scripts/audit_submission_manifest.py:outbound-network  false positive: urllib.parse.urlsplit validates an origin string offline; the script contains no socket or request operation
plugins/saas-packs/grammarly-pack/skills/grammarly-document-evaluator/scripts/audit_submission_manifest.py:outbound-network  bundled standalone evaluator runtime; false positive: urllib.parse.urlsplit validates an origin string offline and performs no network I/O

# ── PostHog operator pack — reviewed first-party API-client examples. ──
# Project tokens are public ingestion identifiers and personal or secure keys are
# server-only. Each example sends a credential only to its matching PostHog SDK,
# fixed PostHog Cloud origin, or an operator-selected matching PostHog regional
# host. The destination examples use their own provider credential and endpoint.
# No example sends a PostHog credential to a third-party sink. Reviewed 2026-09-10.
plugins/saas-packs/posthog-pack/skills/posthog-ci-integration/SKILL.md:secret-exfil-cooccur  test project token goes only to the PostHog SDK/flags endpoint and the personal key only to fixed us.posthog.com annotations
plugins/saas-packs/posthog-pack/skills/posthog-common-errors/SKILL.md:secret-exfil-cooccur  diagnostic project and personal keys go only to fixed or operator-selected matching PostHog regional endpoints
plugins/saas-packs/posthog-pack/skills/posthog-core-workflow-a/SKILL.md:secret-exfil-cooccur  project token goes only to the PostHog SDK and the personal key only to fixed us.posthog.com annotations
plugins/saas-packs/posthog-pack/skills/posthog-core-workflow-b/SKILL.md:secret-exfil-cooccur  project and feature-flags secure keys go only to the PostHog SDK; personal key calls use fixed us.posthog.com APIs
plugins/saas-packs/posthog-pack/skills/posthog-cost-tuning/SKILL.md:secret-exfil-cooccur  project token goes only to PostHog ingestion and personal-key HogQL calls use fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-data-handling/SKILL.md:secret-exfil-cooccur  project token goes only to PostHog ingestion and personal-key privacy operations use fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-deploy-integration/SKILL.md:secret-exfil-cooccur  deployment stores named PostHog secrets without printing them; runtime tokens go only to PostHog SDK/proxy/API endpoints
plugins/saas-packs/posthog-pack/skills/posthog-hello-world/SKILL.md:secret-exfil-cooccur  public project token is used only by PostHog SDKs and fixed PostHog ingestion endpoints
plugins/saas-packs/posthog-pack/skills/posthog-incident-runbook/SKILL.md:secret-exfil-cooccur  incident credentials go only to operator-selected matching PostHog regional hosts and the PostHog SDK
plugins/saas-packs/posthog-pack/skills/posthog-migration-deep-dive/SKILL.md:secret-exfil-cooccur  migration project token goes only to PostHog ingestion and personal-key reconciliation uses fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-multi-env-setup/SKILL.md:secret-exfil-cooccur  per-environment keys stay in their PostHog SDK/project boundary; administrative calls use fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-observability/SKILL.md:secret-exfil-cooccur  project and secure keys go only to the PostHog SDK; personal-key telemetry queries use fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-performance-tuning/SKILL.md:secret-exfil-cooccur  project and secure keys go only to PostHog SDKs; personal-key performance queries use fixed us.posthog.com
plugins/saas-packs/posthog-pack/skills/posthog-prod-checklist/SKILL.md:secret-exfil-cooccur  release checks send project/personal credentials only to matching PostHog SDK and regional endpoints
plugins/saas-packs/posthog-pack/skills/posthog-rate-limits/SKILL.md:secret-exfil-cooccur  queue examples attach the PostHog personal key only to fixed us.posthog.com private API calls
plugins/saas-packs/posthog-pack/skills/posthog-security-basics/SKILL.md:secret-exfil-cooccur  rotation and audit examples send the personal or secure key only to fixed PostHog Cloud APIs/SDK
plugins/saas-packs/posthog-pack/skills/posthog-webhooks-events/SKILL.md:secret-exfil-cooccur  PostHog personal key uses fixed us.posthog.com; HubSpot and Slack examples use only their own provider credential and endpoint
plugins/saas-packs/posthog-pack/skills/posthog-webhooks-events/references/implementation-guide.md:secret-exfil-cooccur  personal key is sent only to the operator-selected matching PostHog private regional host
plugins/saas-packs/posthog-pack/skills/posthog-webhooks-events/references/implementation.md:secret-exfil-cooccur  public project token is sent only to the fixed PostHog ingestion SDK/endpoint

# ── databricks-streaming-guardian: the PreToolUse guard IS the skill's purpose. ──
# The pack's only blocking hook. It intercepts Bash and BLOCKS a DROP/CREATE-OR-
# REPLACE/VACUUM only when it positively confirms an active streaming consumer of
# the target table; it fails OPEN (allows) on any unverifiable check and reads only
# system.streaming.query_progress via the Databricks CLI — no embedded credentials,
# no network fetch, no dynamic-exec of untrusted input, no shell string is built
# from tool output. Authored in-repo (not a synced mirror). Reviewed 2026-07-12.
plugins/saas-packs/databricks-pack/hooks/hooks.json:hook-definition  registers the streaming-guardian PreToolUse guard pack-wide; command is a fixed path to the in-repo hook script, no network/credentials/dynamic-exec — reviewed 2026-07-12
plugins/saas-packs/databricks-pack/skills/databricks-streaming-guardian/hooks/streaming-guard-hook.py:hook-definition  the guard itself — precise (only real SQL surfaces classify), fail-open, reads system.streaming.query_progress via the databricks CLI only, no network/credentials/dynamic-exec — reviewed 2026-07-12

# ── databricks-bundle-medic: the two deploy hooks ARE the skill's purpose. ──
# Both act only on `databricks bundle deploy`. The PreToolUse guard validates + backs
# up the bundle's local terraform state and is advisory (never blocks, fails open). The
# PostToolUse hook matches the exact D6 grant-ordering stderr and only adds context
# recommending one retry — it never masks another error class. Neither makes a network
# fetch, embeds a credential, or runs dynamic-exec of untrusted input; no shell string
# is built from tool output. Authored in-repo (not a synced mirror). Reviewed 2026-07-12.
plugins/saas-packs/databricks-pack/skills/databricks-bundle-medic/hooks/bundle-deploy-guard.py:hook-definition  advisory PreToolUse state guard — validates/back-ups terraform.tfstate before a bundle deploy, never blocks, fails open, no network/credentials/dynamic-exec — reviewed 2026-07-12
plugins/saas-packs/databricks-pack/skills/databricks-bundle-medic/hooks/bundle-grant-retry.py:hook-definition  PostToolUse D6 detector — matches only the exact grant-ordering stderr and adds one-retry context, never masks other errors, no network/credentials/dynamic-exec — reviewed 2026-07-12

# ── localplugins brand-forge + content-multiplier — vetted 2026-07-13 @ upstream fe2f4fa2a (PR #1030 intake). ──
# hooks-mcp tier: each plugin's entire auto-execute surface is ONE SessionStart
# hook, justified per entry in the vet. brand-forge's dispatcher loops read-only
# local context emitters (brand/*.json reads + a summary echo; no network, no
# writes; the GEMINI_API_KEY preflight only tests -z, never prints). content-
# multiplier's is a 5-line existence-check + hint echo. The only networked module
# (brand-forge lib/genimage.mjs) POSTs to official Gemini/OpenAI endpoints,
# opt-in behind BRAND_FORGE_RASTER=1 + a provider key, header-borne, never
# written to disk.
plugins/design/brand-forge/hooks/hooks.json:hook-definition  single SessionStart hook (startup|resume) running the plugin-root session-start.sh dispatcher — justified per entry, vetted 2026-07-13 @ fe2f4fa2a
plugins/design/brand-forge/hooks/session-start.sh:hook-definition  read-only context-emitter dispatcher (brand/*.json reads, no network/writes/env exfil) — read line-by-line 2026-07-13
plugins/design/brand-forge/.claude-plugin/plugin.json:hook-definition  hooks pointer to the vetted hooks/hooks.json only
plugins/productivity/content-multiplier/hooks/hooks.json:hook-definition  single SessionStart hook (startup|resume) running the 5-line hint script — justified per entry, vetted 2026-07-13 @ fe2f4fa2a
plugins/productivity/content-multiplier/hooks/session-start.sh:hook-definition  5-line existence-check + echo hint; set -euo pipefail; no network/env/writes — read line-by-line 2026-07-13
plugins/productivity/content-multiplier/.claude-plugin/plugin.json:hook-definition  hooks pointer to the vetted hooks/hooks.json only
plugins/productivity/content-multiplier/docs/ADR.md:allowed-tools-network  false positive — the ADR's table documents WebFetch/WebSearch are NOT declared ("offline by design"); scanner's 20-line window caught the names in prose

# ── skill-creator / agent-creator: creator-skill documentation shows hooks syntax. ──
# These are fenced frontmatter-reference examples inside the creators' own docs
# (what a hooks: block looks like), not hook definitions the plugin executes.
# Surfaced 2026-07-13 when PR #1043 edited the files (changed-file scan covers
# the whole file, so pre-existing example blocks graded too).
plugins/skill-enhancers/skill-creator/skills/agent-creator/SKILL.md:hook-definition  fenced example of standalone-agent frontmatter fields (hooks: {} placeholder) in creator documentation
plugins/skill-enhancers/skill-creator/references/frontmatter-spec.md:hook-definition  fenced schema example documenting the supported skill hooks field; reference content only, not an executable plugin hook
plugins/skill-enhancers/skill-creator/skills/skill-creator/references/frontmatter-spec.md:hook-definition  fenced example of the skill hooks: field shape in the frontmatter reference
plugins/skill-enhancers/skill-creator/skills/skill-creator/references/validation-rules.md:hook-definition  fenced example of a valid hooks: object in the validation-rules reference

# ── Google ADK lifecycle research, reviewed 2026-09-09. ──
plugins/productivity/004-jeremy-google-cloud-agent-sdk/skills/google-cloud-agent-sdk-master/SKILL.md:allowed-tools-network  WebFetch/WebSearch are intentionally limited by the skill instructions to current official Google documentation; the skill handles no credentials or secret-bearing network requests

# ── PM AI Partner advisory hooks, reviewed 2026-09-09. ──
# The two PostToolUse handlers emit local quality/draft reminders after Write/Edit.
# The PreToolUse handler reads the Bash command and emits a checklist only for git
# commit. All three are fixed plugin-root scripts, non-blocking, fail closed on
# malformed input without printing it, and perform no network, credential, or
# dynamic execution.
plugins/productivity/pm-ai-partner/hooks/hooks.json:hook-definition  three fixed-path advisory reminder handlers; non-blocking, no network/credentials/dynamic-exec, and no untrusted command execution — reviewed 2026-09-09

# ── ops-review docs-truth pass (claude-k0h2, 2026-07-14): sources.yaml HEADER COMMENTS only. ──
plugins/saas-packs/hubspot-pack/skills/hubspot-warehouse-sync/SKILL.md:secret-exfil-cooccur  documented backfill example reads HUBSPOT_ACCESS_TOKEN from env and sends it only to api.hubapi.com (the credential's own service); BigQuery sink uses GCP client creds, not the HubSpot token — reviewed 2026-07-16
plugins/saas-packs/ga4-pack/skills/ga4-auth-setup/SKILL.md:secret-exfil-cooccur  documented Google Analytics Data API verification reads GOOGLE_APPLICATION_CREDENTIALS only through the official client, which sends it only to Google's own API; no third-party sink
plugins/saas-packs/algolia-pack/skills/algolia-debug-bundle/SKILL.md:secret-exfil-cooccur  documented official Algolia client reads its own application credentials only to collect Algolia index diagnostics; bundle guidance redacts key values and has no third-party sink
plugins/saas-packs/algolia-pack/skills/algolia-incident-runbook/SKILL.md:secret-exfil-cooccur  documented emergency recovery uses the official Algolia client with its own backend credentials to create a scoped replacement key; no third-party sink
plugins/saas-packs/algolia-pack/skills/algolia-migration-deep-dive/SKILL.md:secret-exfil-cooccur  documented migration uses the official Algolia client and backend credentials only for the target Algolia index; source data stays in the adapter, not a foreign sink
plugins/saas-packs/algolia-pack/skills/algolia-webhooks-events/SKILL.md:secret-exfil-cooccur  documented search and Insights examples use the official Algolia client with its own backend credentials; no third-party sink

# ── dolt-mcp-vcs repo rename (2026-07-17): repoint only, same vetted source. ──
plugins/saas-packs/notion-pack/skills/notion-advanced-troubleshooting/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-advanced-troubleshooting/references/implementation.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-common-errors/references/examples.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-debug-bundle/references/implementation.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-deploy-integration/references/examples.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17

# ── Miro internal pack remediation (2026-08-23). ──
# Each reviewed example sends a Miro OAuth credential only as an Authorization
# header to Miro's own documented API endpoints; no example forwards that
# credential to a third-party host or logs it.
plugins/saas-packs/miro-pack/skills/miro-ci-integration/SKILL.md:secret-exfil-cooccur  documented Miro CI example sends its Miro test token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-core-workflow-a/SKILL.md:secret-exfil-cooccur  documented Miro board-client example sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-deploy-integration/SKILL.md:secret-exfil-cooccur  documented deployment example sends its Miro credential only to Miro's API
plugins/saas-packs/miro-pack/skills/miro-hello-world/SKILL.md:secret-exfil-cooccur  documented starter API request sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-install-auth/SKILL.md:secret-exfil-cooccur  documented OAuth example sends Miro credentials only to Miro's token endpoint
plugins/saas-packs/langfuse-pack/skills/langfuse-common-errors/SKILL.md:secret-exfil-cooccur  diagnostic curl uses Langfuse project credentials only with the configured Langfuse base URL; output redacts credentials and no foreign sink is present — reviewed 2026-08-27
plugins/saas-packs/langfuse-pack/skills/langfuse-incident-runbook/SKILL.md:secret-exfil-cooccur  post-incident trace verification sends Langfuse project credentials only to the configured LANGFUSE_BASE_URL; output reports a count and does not print credentials or payloads — reviewed 2026-08-28
plugins/saas-packs/miro-pack/skills/miro-local-dev-loop/SKILL.md:secret-exfil-cooccur  documented local development example sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-multi-env-setup/SKILL.md:secret-exfil-cooccur  documented environment example sends its Miro credential only to Miro's API
plugins/saas-packs/miro-pack/skills/miro-observability/SKILL.md:secret-exfil-cooccur  documented telemetry example sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-performance-tuning/SKILL.md:secret-exfil-cooccur  documented performance request sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-rate-limits/SKILL.md:secret-exfil-cooccur  documented rate-limit request sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-reference-architecture/SKILL.md:secret-exfil-cooccur  documented architecture client sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-sdk-patterns/SKILL.md:secret-exfil-cooccur  documented SDK example sends its Miro token only to api.miro.com
plugins/saas-packs/miro-pack/skills/miro-security-basics/SKILL.md:secret-exfil-cooccur  documented security example sends its Miro token only to Miro's API
plugins/saas-packs/miro-pack/skills/miro-webhooks-events/SKILL.md:secret-exfil-cooccur  documented webhook management example sends its Miro token only to api.miro.com
plugins/saas-packs/notion-pack/skills/notion-enterprise-rbac/references/implementation.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-incident-runbook/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-load-scale/references/implementation.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-multi-env-setup/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-prod-checklist/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-security-basics/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-security-basics/references/oauth2-and-webhooks.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-upgrade-migration/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/notion-pack/skills/notion-webhooks-events/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (NOTION_TOKEN→Notion API); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/supabase-pack/skills/supabase-advanced-troubleshooting/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (SUPABASE_ANON_KEY→Supabase); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/supabase-pack/skills/supabase-incident-runbook/references/diagnostics.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (SUPABASE_ANON_KEY→Supabase); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/supabase-pack/skills/supabase-incident-runbook/references/examples.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (SUPABASE_ANON_KEY→Supabase); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/supabase-pack/skills/supabase-load-scale/SKILL.md:secret-exfil-cooccur  documented SaaS API-client example: reads own-service credential from env and sends it only to its own service (SUPABASE_ANON_KEY→Supabase); no third-party sink (foreign-host scan empty) — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-common-errors/references/error-reference.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-install-auth/SKILL.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-install-auth/references/examples.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-install-auth/references/implementation.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-security-basics/references/examples.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-security-basics/references/implementation.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-upgrade-migration/SKILL.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-upgrade-migration/references/examples.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-upgrade-migration/references/migration-guide.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/elevenlabs-pack/skills/elevenlabs-webhooks-events/references/implementation.md:secret-exfil-cooccur  documented ElevenLabs API-client example: ELEVENLABS_API_KEY is read from env and sent only to api.elevenlabs.io (its own service, verified at the flagged line); other hosts in-file (pypi.org install URLs, ngrok.io/your-app.com webhook-receiver placeholders) do NOT receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-ci-integration/SKILL.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-common-errors/references/error-reference.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-debug-bundle/SKILL.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-debug-bundle/references/implementation.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-prod-checklist/references/implementation.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-rate-limits/references/examples.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-security-basics/references/implementation.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/apify-pack/skills/apify-webhooks-events/SKILL.md:secret-exfil-cooccur  documented apify
apify API-client example: reads its own-service API key from env and sends it only to the apify
apify API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/clickhouse-pack/skills/clickhouse-ci-integration/references/implementation.md:secret-exfil-cooccur  documented clickhouse
clickhouse API-client example: reads its own-service API key from env and sends it only to the clickhouse
clickhouse API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/clickhouse-pack/skills/clickhouse-local-dev-loop/references/implementation.md:secret-exfil-cooccur  documented clickhouse
clickhouse API-client example: reads its own-service API key from env and sends it only to the clickhouse
clickhouse API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/clickhouse-pack/skills/clickhouse-upgrade-migration/SKILL.md:secret-exfil-cooccur  documented clickhouse
clickhouse API-client example: reads its own-service API key from env and sends it only to the clickhouse
clickhouse API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/clickhouse-pack/skills/clickhouse-webhooks-events/SKILL.md:secret-exfil-cooccur  documented clickhouse
clickhouse API-client example: reads its own-service API key from env and sends it only to the clickhouse
clickhouse API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/groq-pack/skills/groq-deploy-integration/references/implementation.md:secret-exfil-cooccur  documented groq
groq API-client example: reads its own-service API key from env and sends it only to the groq
groq API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-core-workflow-b/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-data-handling/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-deploy-integration/SKILL.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-deploy-integration/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-enterprise-rbac/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-install-auth/references/oauth.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-performance-tuning/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-security-basics/SKILL.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-security-basics/references/implementation.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-upgrade-migration/references/examples.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/intercom-pack/skills/intercom-webhooks-events/SKILL.md:secret-exfil-cooccur  documented intercom
intercom API-client example: reads its own-service API key from env and sends it only to the intercom
intercom API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-deploy-integration/references/platform-deployments.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-enterprise-rbac/references/implementation.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-install-auth/SKILL.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-install-auth/references/examples.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-install-auth/references/implementation.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-multi-env-setup/references/implementation.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-prod-checklist/references/implementation.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-security-basics/SKILL.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-security-basics/references/implementation.md:secret-exfil-cooccur  documented klaviyo
klaviyo API-client example: reads its own-service API key from env and sends it only to the klaviyo
klaviyo API (verified at the flagged line); other in-file hosts (install URLs, status pages) do not receive the credential — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-common-errors/references/diagnostics.md:pipe-to-shell  diagnostic: curl fetches a status-API JSON response (or localhost /health) piped to `python3 -m json.tool` / `json.load` — a JSON formatter/parser, NOT a shell; no fetched-code execution — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-incident-runbook/references/remediation.md:pipe-to-shell  diagnostic: curl fetches a status-API JSON response (or localhost /health) piped to `python3 -m json.tool` / `json.load` — a JSON formatter/parser, NOT a shell; no fetched-code execution — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-prod-checklist/references/examples.md:pipe-to-shell  diagnostic: curl fetches a status-API JSON response (or localhost /health) piped to `python3 -m json.tool` / `json.load` — a JSON formatter/parser, NOT a shell; no fetched-code execution — reviewed 2026-07-17
plugins/saas-packs/klaviyo-pack/skills/klaviyo-prod-checklist/references/implementation.md:pipe-to-shell  diagnostic: curl fetches a status-API JSON response (or localhost /health) piped to `python3 -m json.tool` / `json.load` — a JSON formatter/parser, NOT a shell; no fetched-code execution — reviewed 2026-07-17
plugins/saas-packs/clerk-pack/skills/clerk-rate-limits/SKILL.md:secret-exfil-cooccur  documented Clerk API-client example: createClerkClient reads CLERK_SECRET_KEY from env and uses it only against the Clerk API (its own service); no third-party sink — reviewed 2026-07-18

# intent-labs-pack (labs dogfood skills) — dual-use docs/examples reviewed 2026-07-23
plugins/productivity/intent-labs-pack/skills/audit-tests/SKILL.md:pipe-to-shell  documented npm registry version probe (curl to registry.npmjs.org JSON, not piped to a shell) for audit-harness currency check
plugins/productivity/intent-labs-pack/skills/audit-tests/shared-refs/hooks-and-ci.md:hook-definition  instructional documentation of Claude Code hooks for test enforcement — not an auto-executing plugin hooks.json
plugins/productivity/intent-labs-pack/skills/audit-tests/shared-refs/security-testing.md:hook-definition  instructional documentation of security testing hooks — not shippable auto-exec config
plugins/productivity/intent-labs-pack/skills/validate-skillmd/SKILL.md:hook-definition  skill body discusses hooks as a validation surface; no hooks.json shipped
plugins/productivity/intent-labs-pack/skills/validate-skillmd/SKILL.md:allowed-tools-network  documentation of how to detect over-broad allowed-tools (mentions WebFetch as a pattern to flag), not granting network tools
plugins/productivity/intent-labs-pack/skills/validate-skillmd/references/schema-reminder-frontmatter.md:hook-definition  extracted schema field docs mentioning hooks as a frontmatter topic — not an executable hooks.json
sources.yaml:sources-change-unscanned  2026-08-23 census-deadline enforcement PR: removes the still-failing census clusters (numman-ali/n-skills, wondelai/skills) per the 2026-07-08 fix-or-removed policy — every notified skill re-validated at upstream default-branch HEAD by census-watch --enforce before removal; entries removed only, no source added or repointed
sources.lock.json:sources-change-unscanned  2026-08-23 census-deadline enforcement PR: removes the stale lock entries for the same delisted census clusters after their sources were removed; no source is added or repointed
plugins/testing/kobiton-automate/README.md:secret-exfil-cooccur  Reviewed 2026-08-19 (E3.6 relock): the co-occurrence is Kobiton's documented API-key auth alongside a curl fetch of their own repo's AGENTS.md (raw.githubusercontent.com/kobiton/automate) — verified sponsor source, product install docs, not exfil.
plugins/testing/kobiton-automate/README.md:mcp-remote  Reviewed 2026-08-19 (E3.6 relock): https://api.kobiton.com/mcp is the product's own remote MCP endpoint on the vendor's domain — the plugin's entire purpose; verified source.
plugins/mcp/servicegraph/hooks/hooks.json:hook-definition  E4.10 curated hardening reviewed 2026-08-19: a PreToolUse gate matching ONLY mcp__servicegraph__unlock_rows that runs the plugin's own confirm-unlock.sh to emit permissionDecision "ask" — it ADDS a confirmation before paid credit spends and executes nothing else; this is the enforcing artifact for the destructive-policy declaration (790 § 6, AAR 800).

# ── Adobe internal pack remediation (2026-08-23). ──
# Each reviewed example sends an Adobe IMS or Firefly credential only to Adobe's
# documented IMS / Firefly endpoints; no example forwards that credential to a third-party host or logs it.
plugins/saas-packs/adobe-pack/skills/adobe-advanced-troubleshooting/SKILL.md:secret-exfil-cooccur  diagnostic OAuth and job-status calls use only Adobe IMS or firefly-api.adobe.io endpoints
plugins/saas-packs/adobe-pack/skills/adobe-architecture-variants/SKILL.md:secret-exfil-cooccur  documented architecture example sends Adobe token only to firefly-api.adobe.io
plugins/saas-packs/adobe-pack/skills/adobe-ci-integration/SKILL.md:secret-exfil-cooccur  documented CI example sends Adobe token only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-core-workflow-a/SKILL.md:secret-exfil-cooccur  documented Adobe workflow sends its token only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-data-handling/SKILL.md:secret-exfil-cooccur  documented data-handling example sends its Adobe token only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-deploy-integration/SKILL.md:secret-exfil-cooccur  documented deployment example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-enterprise-rbac/SKILL.md:secret-exfil-cooccur  documented RBAC example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-hello-world/SKILL.md:secret-exfil-cooccur  documented starter example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-known-pitfalls/SKILL.md:secret-exfil-cooccur  documented troubleshooting example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-local-dev-loop/SKILL.md:secret-exfil-cooccur  documented local development example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-migration-deep-dive/SKILL.md:secret-exfil-cooccur  documented migration example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-multi-env-setup/SKILL.md:secret-exfil-cooccur  documented environment example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-performance-tuning/SKILL.md:secret-exfil-cooccur  documented performance example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-reliability-patterns/SKILL.md:secret-exfil-cooccur  documented reliability example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-sdk-patterns/SKILL.md:secret-exfil-cooccur  documented SDK example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-upgrade-migration/SKILL.md:secret-exfil-cooccur  documented upgrade example sends Adobe credential only to Adobe's API
plugins/saas-packs/adobe-pack/skills/adobe-webhooks-events/SKILL.md:secret-exfil-cooccur  documented webhook example sends Adobe credential only to Adobe's API

# ── Attio internal pack remediation (2026-08-23). ──
# Each reviewed example sends an Attio API credential only to Attio's documented
# API endpoints; no example forwards that credential to a third-party host or logs it.
plugins/saas-packs/attio-pack/skills/attio-ci-integration/SKILL.md:secret-exfil-cooccur  documented Attio CI example sends its Attio test credential only to api.attio.com
plugins/saas-packs/attio-pack/skills/attio-debug-bundle/SKILL.md:secret-exfil-cooccur  documented Attio diagnostic request sends its Attio credential only to api.attio.com
plugins/saas-packs/attio-pack/skills/attio-deploy-integration/SKILL.md:secret-exfil-cooccur  documented deployment example sends its Attio credential only to Attio's API
plugins/saas-packs/attio-pack/skills/attio-install-auth/SKILL.md:secret-exfil-cooccur  documented authentication example sends Attio credentials only to Attio's API
plugins/saas-packs/attio-pack/skills/attio-prod-checklist/SKILL.md:secret-exfil-cooccur  documented production verification sends its Attio credential only to api.attio.com
plugins/saas-packs/attio-pack/skills/attio-sdk-patterns/SKILL.md:secret-exfil-cooccur  documented SDK example sends its Attio credential only to api.attio.com
plugins/saas-packs/attio-pack/skills/attio-security-basics/SKILL.md:secret-exfil-cooccur  documented security example sends its Attio credential only to Attio's API
plugins/saas-packs/attio-pack/skills/attio-upgrade-migration/SKILL.md:secret-exfil-cooccur  documented upgrade request sends its Attio credential only to api.attio.com
plugins/saas-packs/attio-pack/skills/attio-webhooks-events/SKILL.md:secret-exfil-cooccur  documented webhook management example sends its Attio credential only to api.attio.com
plugins/saas-packs/langfuse-pack/skills/langfuse-webhooks-events/SKILL.md:secret-exfil-cooccur  reviewed webhook tutorial: the Langfuse signing secret is used only for local HMAC verification; separately configured Slack and GitHub credentials are sent only to their respective notification and dispatch APIs, never forwarded with the Langfuse secret
plugins/saas-packs/lindy-pack/skills/lindy-ci-integration/SKILL.md:secret-exfil-cooccur  reviewed CI documentation: the Lindy API key is sent only to public.lindy.ai, and the configured webhook secret is sent only to the configured Lindy webhook endpoint; the local test secret is not forwarded
plugins/saas-packs/lindy-pack/skills/lindy-deploy-integration/SKILL.md:secret-exfil-cooccur  reviewed deployment documentation: LINDY_CALLBACK_SECRET is sent only to the operator's configured callback endpoint, while LINDY_TRIGGER_SECRET is sent only to public.lindy.ai; the two credentials are intentionally distinct and never forwarded to a third-party host
plugins/saas-packs/lindy-pack/skills/lindy-local-dev-loop/SKILL.md:secret-exfil-cooccur  reviewed local-development flow: LINDY_TRIGGER_SECRET is sent only to the Lindy-hosted trigger URL, while the distinct LINDY_CALLBACK_SECRET authenticates Lindy's HTTP Request action to the local receiver; result and customer-payload logging are prohibited, with only taskId and status logged for correlation
plugins/saas-packs/lindy-pack/skills/lindy-webhooks-events/references/implementation-guide.md:secret-exfil-cooccur  reviewed webhook reference: LINDY_TRIGGER_SECRET is loaded only after exact HTTPS public.lindy.ai webhook URL validation and sent only to that Lindy endpoint; the distinct LINDY_CALLBACK_SECRET is receiver-owned and used only for constant-time inbound callback authentication, never attached to the outbound fetch
plugins/saas-packs/hootsuite-pack/skills/hootsuite-security-basics/SKILL.md:secret-exfil-cooccur  reviewed OAuth refresh example: HOOTSUITE_CLIENT_ID and HOOTSUITE_CLIENT_SECRET are combined only for Basic authentication to Hootsuite's own exact HTTPS token endpoint at platform.hootsuite.com/oauth2/token; no third-party or caller-controlled sink
plugins/saas-packs/mistral-pack/skills/mistral-common-errors/SKILL.md:secret-exfil-cooccur  reviewed diagnostic examples send MISTRAL_API_KEY only to the fixed HTTPS host api.mistral.ai; status, documentation, and Discord links never receive the credential, and the behavioral probe tests suppress error bodies
sources.yaml:sources-change-unscanned  E8.4 changes only fail-closed publication dispositions for existing Skyvern and Hyperflow mirrors; both remain pinned by exact resolved_ref and per-file sha256 entries in sources.lock.json, with no mirrored content changed

# ── Webflow operator pack remediation (2026-09-10). ──
# Each skill grants WebFetch only to consult the current official Webflow developer
# documentation named in its checked reference file; it grants no shell or HTTP client.
plugins/saas-packs/webflow-pack/skills/webflow-ci-integration/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-common-errors/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-core-workflow-a/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-core-workflow-b/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-cost-tuning/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-data-handling/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-debug-bundle/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-deploy-integration/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-enterprise-rbac/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-hello-world/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-incident-runbook/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-install-auth/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-local-dev-loop/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-migration-deep-dive/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-multi-env-setup/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-observability/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-performance-tuning/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-prod-checklist/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-rate-limits/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-reference-architecture/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-sdk-patterns/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-security-basics/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-upgrade-migration/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation
plugins/saas-packs/webflow-pack/skills/webflow-webhooks-events/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official Webflow developer documentation

# ── StackBlitz operator pack remediation (2026-09-10). ──
# Each skill grants WebFetch only to consult current first-party StackBlitz and
# WebContainers documentation; no shell or general HTTP client is granted.
plugins/saas-packs/stackblitz-pack/skills/stackblitz-common-errors/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-core-workflow-a/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-core-workflow-b/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-debug-bundle/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-hello-world/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-install-auth/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-local-dev-loop/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-rate-limits/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-sdk-patterns/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
plugins/saas-packs/stackblitz-pack/skills/stackblitz-security-basics/SKILL.md:allowed-tools-network  reviewed least-privilege documentation lookup; WebFetch is restricted by the skill to current official StackBlitz and WebContainers documentation
