Repository navigation
fix: clear the trade skill's credential hold and release 0.3.1 - #10
Merged
Merged
Conversation
The validator read "never ask the user to paste an API key, access token, or password" in the trade skill as the skill reading a credential. Say that sign-in happens in the browser and the skill never asks for sign-in details. Apply the same wording to container tracking and update the repo validator's rule to match. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
dodeja
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR lines the plugin up with Claude's plugin publishing guidance and the plugin pre-submission checklist.
Credential hold. After #9, the Claude Directory still held the plugin under
MCP_FORWARDS_CREDENTIAL_ENV, citing the trade-intelligence skill body. That skill no longer has a$anywhere, so the likely remaining trigger is the warning "Never ask the user to paste an API key, access token, or password into chat". The validator reads that as the skill reading a credential.since" is now "setsince".Release and CI.
claude plugin validate --stricton the plugin and on the marketplace, pinned to the stable CLI (2.1.292).Checked against the checklist with no change needed. The README has 562 words and describes the data sent. The license is set in
plugin.json(Apache-2.0). The plugin has 173 files, none over 256 KiB, no binaries other than images, and no OS junk files. The single MCP server uses https overhttptransport. Skill front matter is valid.claude plugin detailsshows 3 skills and 1 MCP server, not duplicated, with about 591 always-on tokens.npm run validatepasses, and so doesclaude plugin validate --stricton the plugin and the marketplace.🤖 Generated with Claude Code