Both sides added real content and this merge keeps both rather than picking one.
The branch predates the v2.1.0 release, so merging it straight would have REVERTED that
release: every plugin.json back from 2.1.0 to 2.0.0, and tests/test_consistency.py and
tests/test_validator.py deleted. Merged instead of pushed.
Conflicts, all resolved by combining:
- pm-ai-shipping/.claude-plugin/plugin.json - v2.1.0's version, the branch's description.
- security-audit-static - both checks survive as two steps: verify citations (2.1.0), then
report with the OWASP Top 10 coverage backstop (branch).
- ship-check - the new correctness review becomes Step 3, and 2.1.0's parallel security +
performance pair renumbers to Steps 4 + 5 behind it, keeping the branch's model-mix
carry-through on the security bullet.
- Notes - 2.1.0's untrusted-input rule and both of the branch's bullets.
The v2.1.0 test suite then caught what the branch had missed: a third skill in pm-ai-shipping
without the counts to match. Root README headline 68 -> 69 skills, its pm-ai-shipping summary
2 -> 3, and marketplace.json's total and description synced to plugin.json. 15/15 tests and the
validator pass.
No version bump. The CHANGELOG entry sits under `## Unreleased`, which the tag-on-merge workflow
ignores by design, so this lands the skill without cutting a release - that call is Pawel's.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
Pawel HurynandClaude Opus 5
8607e3b077