docs: add contributing, security policy, and issue templates - #10
Merged
Conversation
The repo had a LICENSE and nothing else of a community profile, which the ClaudePluginHub owner console flagged as the single biggest lever on a community health score sitting at 42%. Written against how this project actually works rather than from a template. CONTRIBUTING explains the gate, the closed Agent Skills field set, and the three routing rules — each stated with the reason it exists, because all three broke at least once. SECURITY frames the real attack surface: this ships instructions an agent follows and MCP servers it launches, not a running service, so insecure guidance and prompt injection matter more than memory safety. Issue templates cover the three failure modes worth distinguishing — wrong GCP advice (the worst, because it looks like it worked), skills not loading or misrouting, and new-skill proposals that must justify their boundary against existing skills. make spec, validate, manifest, mermaid and test pass; lint was rate-limited locally (HTTP 429 from repeated runs against cloud.google.com), so CI arbitrates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repo had a
LICENSEand nothing else of a community profile. The ClaudePluginHub owner console flags this as the biggest lever on a community health score currently at 42%:Unlike the re-sync button, this part is in our control.
Added
CONTRIBUTING.md— the gate, the closed Agent Skills field set, and the three routing rules, each stated with why it exists. All three broke at least once during the v0.2.0 migration.SECURITY.md— private reporting, and an honest framing of the attack surface: this ships instructions an agent follows and MCP servers it launches, not a running service. So insecure guidance and prompt injection matter; memory safety does not. Also documents that the plugin never handles credentials — auth is delegated to ADC.Validation
make spec,validate,manifest,mermaid,testpass. All four issue-template YAML files parse.make lintreturned HTTP 429 locally — rate-limited by cloud.google.com after many runs today, not a broken link. CI runs from a different address.