Add lusha plugin

2026-07-24 18:13:28 +00:00 · 2026-06-03 08:46:28 -05:00
10 changed files with 103 additions and 438 deletions
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -19,7 +19,7 @@
        "url": "https://github.com/42Crunch-AI/claude-plugins.git",
        "path": "plugins/api-security-testing",
        "ref": "v1.5.5",
-        "sha": "db2fb7e53e3d93a863930b6f6b7895be5ee01f21"
+        "sha": "1db609845441d4fa8862019191e4138e61f77e67"
      },
      "homepage": "https://42crunch.com"
    },
@@ -57,7 +57,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/SalesforceAIResearch/agentforce-adlc.git",
-        "sha": "fad761fce6cba119d23792b3a96a3bf33e23c566"
+        "sha": "55220ca32965a7543261a2ed00a0e33da59f7c80"
      },
      "homepage": "https://github.com/SalesforceAIResearch/agentforce-adlc"
    },
@@ -97,22 +97,6 @@
      },
      "homepage": "https://www.airtable.com"
    },
-    {
-      "name": "airwallex",
-      "description": "Airwallex CLI plugin for Claude — skills for payments, billing, invoicing, beneficiary creation, card provisioning, and cashflow management.",
-      "author": {
-        "name": "Airwallex"
-      },
-      "category": "productivity",
-      "source": {
-        "source": "git-subdir",
-        "url": "https://github.com/airwallex/airwallex-marketplace.git",
-        "path": "plugins/airwallex",
-        "ref": "master",
-        "sha": "a903ab7693a5f6d46f2fab6f895a2f96a879ee0f"
-      },
-      "homepage": "https://www.airwallex.com/docs"
-    },
    {
      "name": "alloydb",
      "description": "Create, connect, and interact with an AlloyDB for PostgreSQL database and data.",
@@ -127,20 +111,6 @@
      },
      "homepage": "https://cloud.google.com/alloydb"
    },
-    {
-      "name": "alloydb-omni",
-      "description": "Create, connect, and interact with an AlloyDB Omni database and data.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/alloydb-omni.git",
-        "sha": "fbf2476630629f32ce0029bbd62d225950fdfd6d"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/alloydb-omni"
-    },
    {
      "name": "amazon-location-service",
      "description": "Guide developers through adding maps, places search, geocoding, routing, and other geospatial features with Amazon Location Service, including authentication setup, SDK integration, and best practices.",
@@ -150,7 +120,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/amazon-location-service",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -191,7 +161,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/apollographql/skills.git",
-        "sha": "605089108a198e412f7f0c1926c91eb94a6d1727"
+        "sha": "e1d07720e9bcfbf867fa2907192c94ec2ed421e1"
      },
      "homepage": "https://www.apollographql.com"
    },
@@ -233,7 +203,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/atlanhq/agent-toolkit.git",
-        "sha": "789507c02d2495235240d10d67aaac8b2051023a"
+        "sha": "cda594f40503cd2ae144052237fa2890e024828c"
      },
      "homepage": "https://docs.atlan.com/"
    },
@@ -275,7 +245,7 @@
        "url": "https://github.com/auth0/agent-skills.git",
        "path": "plugins/auth0",
        "ref": "main",
-        "sha": "bdf0dc23f8b17446b2c94bc9f2e5a58d3f1bc114"
+        "sha": "c38453f6a99bbfeaf73b5be81db987ec6af982da"
      },
      "homepage": "https://auth0.com/docs/quickstart/agent-skills"
    },
@@ -291,7 +261,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-agents",
        "ref": "main",
-        "sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
+        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -304,7 +274,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/aws-amplify",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -320,7 +290,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-core",
        "ref": "main",
-        "sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
+        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -336,7 +306,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-data-analytics",
        "ref": "main",
-        "sha": "55b9acfefdcf0866b6bc6cc56c16e6e18e65bd2b"
+        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -365,13 +335,13 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/aws-serverless",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
    {
      "name": "aws-startup-advisor",
-      "description": "Personalized architecture, cost, security, and migration guidance for startups. From day-one account setup and security baselines to production-ready infrastructure, cost optimization, and beyond. Includes AWS Activate Credits eligibility, 60+ exclusive startup offers, and multi-account multi-region support. Built on expertise from AWS Startup Solutions Architects and patterns from 350,000+ startups.",
+      "description": "Skills for startups building on AWS: an Activate knowledge base (FAQ, credits, programs, partner offers, sample architectures, 277+ learn articles), a prompt library of 29+ copy-paste prompts plus installable agents, and an interactive discovery workflow that scaffolds an AWS architecture.",
      "author": {
        "name": "Amazon Web Services"
      },
@@ -381,7 +351,7 @@
        "url": "https://github.com/awslabs/startups.git",
        "path": "advisor/plugins/aws-startup-advisor",
        "ref": "main",
-        "sha": "1dd909352dc228f978c2685724cb38e64efe6be4"
+        "sha": "440c6a2681b89518622d4a9c65f72efdcde398c3"
      },
      "homepage": "https://github.com/awslabs/startups"
    },
@@ -392,7 +362,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/microsoft/azure-skills.git",
-        "sha": "02a614f6ee1f052826f834d65c61e430ad152c8e"
+        "sha": "b2b5d8b16346b5c965545208aff885d0c156c299"
      },
      "homepage": "https://github.com/microsoft/azure-skills"
    },
@@ -434,20 +404,6 @@
      },
      "homepage": "https://docs.bigdata.com"
    },
-    {
-      "name": "bigquery-data-analytics",
-      "description": "Connect, query, and generate data insights for BigQuery datasets and data.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/bigquery-data-analytics.git",
-        "sha": "9cee2a03105d74648231ed3a5c4a63c4f194790d"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/bigquery-data-analytics"
-    },
    {
      "name": "box",
      "description": "Work with your Box content directly from Claude Code — search files, organize folders, collaborate with your team, and use Box AI to answer questions, summarize documents, and extract data without leaving your workflow.",
@@ -472,7 +428,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/brightdata/skills.git",
-        "sha": "bd5bd76bc889f54b744bab3db3cbd42751a1e5b0"
+        "sha": "68651246ad1819b98a1fc15ce10239e55406ff37"
      },
      "homepage": "https://docs.brightdata.com"
    },
@@ -502,7 +458,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-cap-table",
        "ref": "main",
-        "sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
+        "sha": "eb00237daa211b0dc8dd815e013310c6ea9fc827"
      },
      "homepage": "https://carta.com"
    },
@@ -518,7 +474,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-crm",
        "ref": "main",
-        "sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
+        "sha": "49cfc652620672f3e4d4ca31c4ba4c6ebcc568de"
      },
      "homepage": "https://carta.com"
    },
@@ -534,7 +490,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-investors",
        "ref": "main",
-        "sha": "9eb312908f4a2e2d15e4e935320981433a549f77"
+        "sha": "e66d331cd8e669ee121c96ee35b0c91acd828970"
      },
      "homepage": "https://carta.com"
    },
@@ -561,7 +517,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp.git",
-        "sha": "702d3734f276a18efd67561ae00b88ce954cc515"
+        "sha": "30d59a78727c31ec9d70d2bd6d9310e78f1888b3"
      },
      "homepage": "https://github.com/ChromeDevTools/chrome-devtools-mcp"
    },
@@ -655,7 +611,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/ClickHouse/clickhouse-claude-code-plugin.git",
-        "sha": "ecbd47627d7e7b3de15b297b91e0abf3e6ebc746"
+        "sha": "1f30864b720960a797e5c7f6138d328bec3984cb"
      },
      "homepage": "https://github.com/ClickHouse/clickhouse-claude-code-plugin"
    },
@@ -669,24 +625,10 @@
      "source": {
        "source": "url",
        "url": "https://github.com/ClickHouse/agent-skills.git",
-        "sha": "544384f4fab1d6ed59f16a354d1c68296dfa6007"
+        "sha": "46ef08ccf32fa28587b64e0c79106ff437dc8fcb"
      },
      "homepage": "https://clickhouse.com"
    },
-    {
-      "name": "cloud-sql-mysql",
-      "description": "Connect and interact with a Cloud SQL for MySQL database and data.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/cloud-sql-mysql.git",
-        "sha": "983c804fe7dc58b3e58021960e7e1831a10e08b9"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/cloud-sql-mysql"
-    },
    {
      "name": "cloud-sql-postgresql",
      "description": "Create, connect, and interact with a Cloud SQL for PostgreSQL database and data.",
@@ -701,26 +643,12 @@
      },
      "homepage": "https://cloud.google.com/sql"
    },
-    {
-      "name": "cloud-sql-sqlserver",
-      "description": "Connect to Cloud SQL for SQL Server",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/cloud-sql-sqlserver.git",
-        "sha": "8e1490ec8f659a5711655d2fa4241597a63d4883"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/cloud-sql-sqlserver"
-    },
    {
      "name": "cloudflare",
      "source": {
        "source": "url",
        "url": "https://github.com/cloudflare/skills.git",
-        "sha": "c5b7b06b073fa0b4abbd63964630f97d81da69c4"
+        "sha": "60147cbb773649eadca89cee92b4e0caf02234b4"
      },
      "description": "Skills for the Cloudflare developer platform: Workers, Durable Objects, Agents SDK, MCP servers, Wrangler CLI, and web performance.",
      "category": "deployment",
@@ -804,7 +732,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/CodSpeedHQ/codspeed.git",
-        "sha": "c6112f168b405df8e7310b12a9b80484cd01ac14"
+        "sha": "f79d57d207f039e44a31a976564715f7731e71b6"
      },
      "homepage": "https://codspeed.io"
    },
@@ -872,7 +800,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/CrowdStrike/foundry-skills.git",
-        "sha": "c542c932956fd19177a62b94577f288c832d4680"
+        "sha": "5b661388dd24840b45766740eeb729fafae8da40"
      },
      "homepage": "https://github.com/CrowdStrike/foundry-skills"
    },
@@ -918,7 +846,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/dash0hq/dash0-agent-plugin.git",
-        "sha": "5ff7aa5b8e52e10d10e45ea8e2f7cbebc86758bf"
+        "sha": "0300130371547c86630970138e302025c4b0a621"
      },
      "homepage": "https://dash0.com/"
    },
@@ -943,7 +871,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/gemini-cli-extensions/data-agent-kit-starter-pack.git",
-        "sha": "fb9086456d5fbc780edf86f0ac413345ba628173"
+        "sha": "7b17cb5147718013933d4b08011e6fea7d170d89"
      },
      "homepage": "https://github.com/gemini-cli-extensions/data-agent-kit-starter-pack"
    },
@@ -966,7 +894,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/databases-on-aws",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -980,7 +908,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/datadog-labs/claude-code-plugin.git",
-        "sha": "96c28a8ce6f258ed54c9a17f16ee206deb8e3f28"
+        "sha": "eeb2f746a857f8d97f69cd0968fb63874541c112"
      },
      "homepage": "https://www.datadoghq.com/"
    },
@@ -998,20 +926,6 @@
      },
      "homepage": "https://datahub.com"
    },
-    {
-      "name": "dataproc",
-      "description": "Manage Dataproc clusters and jobs.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/dataproc.git",
-        "sha": "20eec06eee7683311689f4a1437cbb14ac8cd33e"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/dataproc"
-    },
    {
      "name": "datarobot-agent-skills",
      "description": "DataRobot skills for AI/ML workflows — model training, deployment, predictions, feature engineering, monitoring, explainability, data preparation, App Framework CI/CD, and external agent monitoring.",
@@ -1022,7 +936,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/datarobot-oss/datarobot-agent-skills.git",
-        "sha": "b5a8f7a4bc4d31a1f139a232efbba6127af0474a"
+        "sha": "bf57624a502f8ebb664ce402154fe407f6d5912f"
      },
      "homepage": "https://datarobot.com"
    },
@@ -1035,7 +949,7 @@
        "url": "https://github.com/microsoft/Dataverse-skills.git",
        "path": ".github/plugins/dataverse",
        "ref": "main",
-        "sha": "2d50cf65f80efc17ac50632222d61fb374115a70"
+        "sha": "ab906c960db0f2da83c2cb92a3fd162ccaba9cb9"
      },
      "homepage": "https://github.com/microsoft/Dataverse-skills"
    },
@@ -1048,7 +962,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/deploy-on-aws",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -1064,7 +978,7 @@
        "url": "https://github.com/wonderwhy-er/DesktopCommanderMCP.git",
        "path": "plugins/claude",
        "ref": "main",
-        "sha": "7a9b2ff0339a7fdc29c06a9957b323ef478a1dde"
+        "sha": "ce4669cca7a07bd5d493cedb01df400790ec9e23"
      },
      "homepage": "https://desktopcommander.app"
    },
@@ -1126,7 +1040,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/exa-labs/exa-mcp-server.git",
-        "sha": "f08388256c5806f457fae777b5528eb02a48e703"
+        "sha": "ad888a188cdefbe832c9feed2c3a97d1cb93cb35"
      },
      "homepage": "https://exa.ai/docs/reference/exa-mcp"
    },
@@ -1150,7 +1064,7 @@
        "url": "https://github.com/expo/skills.git",
        "path": "plugins/expo",
        "ref": "main",
-        "sha": "c38860242118df93d4ec4381a34f4144fff61928"
+        "sha": "fdd3df12151a208853fe540ffea9a67773446377"
      },
      "homepage": "https://github.com/expo/skills/blob/main/plugins/expo/README.md"
    },
@@ -1187,7 +1101,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/voxel51/fiftyone-skills.git",
-        "sha": "d34365bd643b889d67dafcc120a8c525699fb54c"
+        "sha": "6c002d680529e35a2e04adc34c03b564a3991728"
      },
      "homepage": "https://docs.voxel51.com/"
    },
@@ -1220,20 +1134,6 @@
      },
      "homepage": "https://github.com/firecrawl/firecrawl-claude-plugin.git"
    },
-    {
-      "name": "firestore-native",
-      "description": "Connect and interact with Firestore databases, collections, and documents.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/firestore-native.git",
-        "sha": "f88103bd0ccfe9e1e7a3a7d849de26d197978c9a"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/firestore-native"
-    },
    {
      "name": "forge-skills",
      "description": "Forge-focused skills and MCP configuration for Atlassian Forge: scaffold and deploy apps (forge create, templates, dev spaces), build Teamwork Graph connectors for Rovo Search/Rovo Chat, pre-deploy review, systematic debugging, plus Forge docs and Atlassian Design System lookups via MCP.",
@@ -1244,7 +1144,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/atlassian/forge-skills.git",
-        "sha": "02103cca4addb4c42d64d4e18a9d1a7f186edf6c"
+        "sha": "2014fae5b1529a22629129b1564ae522593eb46d"
      },
      "homepage": "https://developer.atlassian.com/platform/forge/"
    },
@@ -1270,7 +1170,7 @@
        "source": "github",
        "repo": "fullstorydev/fullstory-skills",
        "commit": "1ec5865e7ab1449f9a0859d164c4b6a8c53b6e2f",
-        "sha": "b20614e2d08d7a7c70775bb62b5af640f60b024b"
+        "sha": "384555c3919a0631a096de1172998c8d855a0f26"
      },
      "homepage": "https://www.fullstory.com"
    },
@@ -1333,7 +1233,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/huggingface/skills.git",
-        "sha": "d7223848c3895fbd447faf2aec73e0a6cdd7fdcd"
+        "sha": "49abf82b2ef2ff2bcc6ca072aac0fe8627390a1d"
      },
      "homepage": "https://github.com/huggingface/skills.git"
    },
@@ -1347,7 +1247,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/hunter-io/claude-plugin.git",
-        "sha": "494b0bd6ac252c7c8d78402cb51c7f635b1469ad"
+        "sha": "69c4e59ee573f4ccd8aa38bbc89e356bc8e7f876"
      },
      "homepage": "https://hunter.io"
    },
@@ -1361,7 +1261,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/heygen-com/hyperframes.git",
-        "sha": "25420bf4cfc37b179b4efeace9db25a7178b61bf"
+        "sha": "f5d81cb5a7b1d15cdc08c15bafbc7e3c91123a74"
      },
      "homepage": "https://hyperframes.heygen.com"
    },
@@ -1415,24 +1315,10 @@
        "source": "github",
        "repo": "jfrog/claude-plugin",
        "commit": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d",
-        "sha": "117febaa29cbe9449cfb42d1c39b83b858d801a1"
+        "sha": "8324c7fc9a5561398fe57b8a56db53bdbf1e2cda"
      },
      "homepage": "https://jfrog.com"
    },
-    {
-      "name": "knowledge-catalog",
-      "description": "Connect to Knowledge Catalog to discover, manage, monitor, and govern data and AI artifacts across your data platform",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/knowledge-catalog.git",
-        "sha": "317e96fdd12aa61778b950192aff627efdc21099"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/knowledge-catalog"
-    },
    {
      "name": "kotlin-lsp",
      "description": "Kotlin language server for code intelligence",
@@ -1544,20 +1430,6 @@
      },
      "homepage": "https://github.com/pydantic/skills/tree/main/plugins/logfire"
    },
-    {
-      "name": "looker",
-      "description": "Connect to Looker and interact with your data using LookML.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/looker.git",
-        "sha": "e912c0342f1bfd436e9236aaef7cc732239c80f7"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/looker"
-    },
    {
      "name": "lua-lsp",
      "description": "Lua language server for code intelligence",
@@ -1616,7 +1488,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/mapbox/mapbox-agent-skills.git",
-        "sha": "75ac667cae24c7ad7bdbbac55ac0a64d2df1543e"
+        "sha": "fc705cd9a4f823e10d5d4ee5adad4c6cd16de0a9"
      },
      "homepage": "https://www.mapbox.com"
    },
@@ -1643,7 +1515,7 @@
        "url": "https://github.com/modelcontextprotocol/ext-apps.git",
        "path": "plugins/mcp-apps",
        "ref": "main",
-        "sha": "ca1d29894fabbd1558885a9ec8620dcb01d7457e"
+        "sha": "a9907802937f1da067cbc4aa48b283cd4cfa7dc8"
      },
      "homepage": "https://modelcontextprotocol.io"
    },
@@ -1708,7 +1580,7 @@
        "url": "https://github.com/awslabs/startups.git",
        "path": "migrate/plugins/migration-to-aws",
        "ref": "main",
-        "sha": "1dd909352dc228f978c2685724cb38e64efe6be4"
+        "sha": "440c6a2681b89518622d4a9c65f72efdcde398c3"
      },
      "homepage": "https://github.com/awslabs/startups"
    },
@@ -1746,7 +1618,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/mongodb/agent-skills.git",
-        "sha": "9ea7387c7a1638604542c6efd52e5efc6a7fc393"
+        "sha": "bcd651808429ac1ca1e9f294cee61e42028d27de"
      },
      "homepage": "https://www.mongodb.com/docs/mcp-server/overview/"
    },
@@ -1770,7 +1642,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/netlify/context-and-tools.git",
-        "sha": "5f777ba63df12f4eb189be4c58bd35d0c8316505"
+        "sha": "cffaf74f79128620b8200956222aeb819f5f8fd5"
      },
      "homepage": "https://github.com/netlify/context-and-tools"
    },
@@ -1839,7 +1711,7 @@
        "url": "https://github.com/NVIDIA/skills.git",
        "path": "plugins/nvidia-skills",
        "ref": "main",
-        "sha": "0482ebce81bd8f2d39990317bb3cfb07637e39fd"
+        "sha": "e695a8397463bbb64d787b3cd88d3c58889be633"
      },
      "homepage": "https://github.com/NVIDIA/skills"
    },
@@ -1855,24 +1727,10 @@
        "url": "https://github.com/oracle-samples/oracle-aidp-samples.git",
        "path": "ai/claude-code-plugins/oracle-ai-data-platform-workbench-spark-connectors",
        "ref": "main",
-        "sha": "00cedef34c99d642d969f87965736768de01cbd6"
+        "sha": "dcd5a5a19537bf9aaa9dd4f48514bc4402bfbc40"
      },
      "homepage": "https://docs.oracle.com/en/cloud/paas/ai-data-platform/index.html"
    },
-    {
-      "name": "oracledb",
-      "description": "Connect, query, and interact with Oracle Databases and their data.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/oracledb.git",
-        "sha": "56239109760fd8ea838a56c946400347467bfa6d"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/oracledb"
-    },
    {
      "name": "outputai",
      "description": "Output.ai workflow development toolkit for Claude Code. Adds 5 specialist agents (planner, builder, debugger, prompt writer, quality reviewer), 40+ slash-command skills covering scaffolding, debugging, evaluation, and credential management, plus a SessionStart hook that auto-loads Output SDK conventions so Claude understands the framework before the first prompt.",
@@ -1885,7 +1743,7 @@
        "url": "https://github.com/growthxai/output.git",
        "path": "coding_assistants/claude/plugins/outputai",
        "ref": "main",
-        "sha": "2cc4685ebadfba9586f01890df48e1b25bd1049a"
+        "sha": "34badf9feb80a9f8ab83c5945de7342ab8d32d0a"
      },
      "homepage": "https://output.ai"
    },
@@ -1933,7 +1791,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/gopigment/ai-plugins.git",
-        "sha": "f7bb2190a3f072bd9be5175bde6a0aa9596fcaaa"
+        "sha": "abf36e64750d1323a4cc5fe79161597668231224"
      },
      "homepage": "https://www.pigment.com"
    },
@@ -1995,7 +1853,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/PostHog/ai-plugin.git",
-        "sha": "db4a86632293ca66eec9a6d278786ddb22c1787e"
+        "sha": "3ab2bf762552526a5db4183451a6b01b02b9205d"
      },
      "homepage": "https://posthog.com/docs/model-context-protocol"
    },
@@ -2088,7 +1946,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/qdrant/skills.git",
-        "sha": "82337ccd4be601e52871f101844d57b2adbac52b"
+        "sha": "cace39df5cc46f7f0c192ced7391d767749142a0"
      },
      "homepage": "https://skills.qdrant.tech"
    },
@@ -2127,7 +1985,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/quarkusio/quarkus-agent-mcp.git",
-        "sha": "e711107a1171507212dd0edd17b5a922212c3a97"
+        "sha": "629622a4b7aa9dfc8724cc758ca389c3e24c0e77"
      },
      "homepage": "https://quarkus.io"
    },
@@ -2140,7 +1998,7 @@
        "url": "https://github.com/railwayapp/railway-skills.git",
        "path": "plugins/railway",
        "ref": "main",
-        "sha": "1df604ebd18f528ff16b84975125ecff944cc036"
+        "sha": "7718b39037adb6fb33948ff751be7f7086f2da83"
      },
      "homepage": "https://docs.railway.com/ai/claude-code-plugin"
    },
@@ -2163,7 +2021,7 @@
        "source": "url",
        "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
        "path": "revenuecat",
-        "sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
+        "sha": "81262a339601c4b64b909c370225cbd7917ade1f"
      },
      "homepage": "https://www.revenuecat.com"
    },
@@ -2189,7 +2047,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/Digital-Process-Tools/claude-remember.git",
-        "sha": "a4ff96f38622f7c4920dc349d59cc980663336f4"
+        "sha": "c2c82ab5fd2f4f5c0cddc9c7d8a749655dec4cb9"
      },
      "homepage": "https://github.com/Digital-Process-Tools/claude-remember"
    },
@@ -2203,7 +2061,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/resend/resend-skills.git",
-        "sha": "0888546d6a69149c8d2402d46f395f5dddb1c720"
+        "sha": "376d1c3fb37cc7d22ab21cce836f4d6f323922de"
      },
      "homepage": "https://resend.com"
    },
@@ -2215,7 +2073,7 @@
        "source": "url",
        "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
        "path": "revenuecat",
-        "sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
+        "sha": "81262a339601c4b64b909c370225cbd7917ade1f"
      },
      "homepage": "https://www.revenuecat.com"
    },
@@ -2300,7 +2158,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/sagemaker-ai",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "187edde6e122116b43211049195627a5069bda80"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -2314,7 +2172,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/sanity-io/agent-toolkit.git",
-        "sha": "66f0ec5d9167b3ccb8b3450e5ec34f3b523d4139"
+        "sha": "d7545f5cc6f8fb39554083b52ad074a6d912db9f"
      },
      "homepage": "https://www.sanity.io"
    },
@@ -2330,7 +2188,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/cap-js/mcp-server.git",
-        "sha": "b78913198fe1021f0d8b36b0e4ba0ca27003452f"
+        "sha": "92dc99f5ba0c56957ed5d390484693a69ebd1206"
      },
      "homepage": "https://cap.cloud.sap/"
    },
@@ -2348,7 +2206,7 @@
        "url": "https://github.com/SAP/open-ux-tools.git",
        "path": "packages/fiori-mcp-server",
        "ref": "main",
-        "sha": "fbfe8c32fb9fc64583aa72ac03ab64f553c407ee"
+        "sha": "7432d23a7b5c3bd1c0a01cf76696bf0c417ecd1f"
      },
      "homepage": "https://github.com/SAP/open-ux-tools/tree/main/packages/fiori-mcp-server"
    },
@@ -2380,7 +2238,7 @@
        "url": "https://github.com/spotify/save-to-spotify.git",
        "path": "plugin",
        "ref": "main",
-        "sha": "cd4ea68111d96769b09c0b0d2199e692cf00a73c"
+        "sha": "35527660378c769bcbcfba89d8086d8b9fc4fccb"
      },
      "homepage": "https://github.com/spotify/save-to-spotify"
    },
@@ -2415,7 +2273,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/getsentry/sentry-for-claude.git",
-        "sha": "030b01fb76b21f5d7ef6af5a3c3dfa658a9b5024"
+        "sha": "849303a8411c242d250885ffe714235a3bc2f5fe"
      },
      "homepage": "https://github.com/getsentry/sentry-for-claude/tree/main"
    },
@@ -2431,7 +2289,7 @@
        "url": "https://github.com/getsentry/cli.git",
        "path": "plugins/sentry-cli",
        "ref": "main",
-        "sha": "9e9fe0fb6444f18ed109058b2749cced3c21f87e"
+        "sha": "5abcacdf8f0b613bceee7aa7aebb9db1d75ed5e2"
      },
      "homepage": "https://sentry.io"
    },
@@ -2457,7 +2315,7 @@
        "url": "https://github.com/ServiceNow/sdk.git",
        "path": "providers/claude/plugin",
        "ref": "master",
-        "sha": "35ef6130d8a49e67b531bde2f987808426273d15"
+        "sha": "06adf37ca78c270a57f93e7b9dfbb7bf16e24611"
      },
      "homepage": "https://servicenow.github.io/sdk/"
    },
@@ -2496,7 +2354,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/Shopify/Shopify-AI-Toolkit.git",
-        "sha": "a8e87a7cff153479eb77230d9c232484a1f3062f"
+        "sha": "859be93bfc858f183ff5eb40183e35a4d91d2950"
      },
      "homepage": "https://shopify.dev"
    },
@@ -2518,7 +2376,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/slackapi/slack-mcp-plugin.git",
-        "sha": "38fb959299386a6d2c202511ef7e76909a072663"
+        "sha": "7b9458950d38bb01ddb48b669f9fa89bcdfd98b8"
      },
      "homepage": "https://github.com/slackapi/slack-mcp-plugin/tree/main"
    },
@@ -2534,7 +2392,7 @@
        "url": "https://github.com/Snowflake-Labs/snowflake-ai-kit.git",
        "path": "plugins/cortex-code",
        "ref": "main",
-        "sha": "6a22eb1ff3b451c35e40468a118bbee54610c9bd"
+        "sha": "c3f720020a3b6c8927f97362c2e5884e959acd53"
      },
      "homepage": "https://docs.snowflake.com/en/user-guide/cortex-code"
    },
@@ -2548,7 +2406,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/SonarSource/sonarqube-agent-plugins.git",
-        "sha": "712b93281f4e67c16ed9b81dde090e1f73f8bfc8"
+        "sha": "c64e09af314406a8d8806d57cd11cda81578ce20"
      },
      "homepage": "https://www.sonarsource.com"
    },
@@ -2574,20 +2432,6 @@
      },
      "homepage": "https://sourcegraph.com"
    },
-    {
-      "name": "spanner",
-      "description": "Connect and interact with Spanner data using natural language.",
-      "author": {
-        "name": "Google LLC"
-      },
-      "category": "database",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/gemini-cli-extensions/spanner.git",
-        "sha": "d4678e2bc04f60f3dfcdb6b916df28e63a0d615f"
-      },
-      "homepage": "https://github.com/gemini-cli-extensions/spanner"
-    },
    {
      "name": "spotify-ads-api",
      "description": "Manage Spotify ad campaigns with natural language. Create campaigns, ad sets, ads, pull reports, and handle OAuth — all through conversation.",
@@ -2608,7 +2452,7 @@
        "url": "https://github.com/stripe/ai.git",
        "path": "providers/claude/plugin",
        "ref": "main",
-        "sha": "b8f6adcb5d05f6ff01334411561ee8cb1ec014c6"
+        "sha": "38cc559cab7eab62f11bc3809b93af45f28063f6"
      },
      "homepage": "https://github.com/stripe/ai/tree/main/providers/claude/plugin"
    },
@@ -2631,7 +2475,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/supabase-community/supabase-plugin.git",
-        "sha": "2ed49769b1ec2f6703a14290af484df651336150"
+        "sha": "3217ac038647f6901a166f3264a32f01833f73ba"
      },
      "homepage": "https://github.com/supabase-community/supabase-plugin"
    },
@@ -2676,7 +2520,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/JetBrains/teamcity-cli.git",
-        "sha": "67e21f0be908daa7ca1e04c8016d1bc81750baee"
+        "sha": "533c8cb20928be912188fd8ae40fcba24cc720ca"
      },
      "homepage": "https://www.jetbrains.com/teamcity/"
    },
@@ -2707,7 +2551,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/togethercomputer/skills.git",
-        "sha": "fb94cc1402900eb608c31e7102fc23566f8b0363"
+        "sha": "f957e2929edebde0c364e804f8b38a3714db92b4"
      },
      "homepage": "https://www.together.ai"
    },
@@ -2769,7 +2613,7 @@
        "url": "https://github.com/UI5/plugins-coding-agents.git",
        "path": "plugins/ui5",
        "ref": "main",
-        "sha": "9b3d7d80356f687725f9584988e4038dbead0d53"
+        "sha": "7acd8328399a221e161ae5bb04a5675696f92920"
      },
      "homepage": "https://github.com/UI5/plugins-coding-agents"
    },
@@ -2787,40 +2631,10 @@
        "url": "https://github.com/UI5/plugins-coding-agents.git",
        "path": "plugins/ui5-typescript-conversion",
        "ref": "main",
-        "sha": "9b3d7d80356f687725f9584988e4038dbead0d53"
+        "sha": "7acd8328399a221e161ae5bb04a5675696f92920"
      },
      "homepage": "https://github.com/UI5/plugins-coding-agents"
    },
-    {
-      "name": "valtown",
-      "description": "Build and deploy on Val Town. Bundles the Val Town MCP server and platform skills (HTTP vals, cron/intervals, SQLite, email, OAuth, React UI, third-party integrations, templates).",
-      "author": {
-        "name": "Val Town"
-      },
-      "category": "deployment",
-      "source": {
-        "source": "git-subdir",
-        "url": "https://github.com/val-town/plugins.git",
-        "path": "plugin",
-        "ref": "main",
-        "sha": "02631f998eda9b88d73d699703b062db059d506b"
-      },
-      "homepage": "https://val.town"
-    },
-    {
-      "name": "vanta",
-      "description": "The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with your local repository context to help you fix compliance failures faster.",
-      "author": {
-        "name": "Vanta"
-      },
-      "category": "security",
-      "source": {
-        "source": "url",
-        "url": "https://github.com/VantaInc/vanta-mcp-plugin.git",
-        "sha": "345d86b55faa649e955b7ea5569cf52d8425c2d5"
-      },
-      "homepage": "https://help.vanta.com/en/articles/14094979-connecting-to-vanta-mcp#h_887ce3f337"
-    },
    {
      "name": "vanta-mcp-plugin",
      "description": "The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with your local repository context to help you fix compliance failures faster.",
@@ -2856,7 +2670,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/explorium-ai/vibeprospecting-plugin.git",
-        "sha": "aa5903f52d79e7f2a5f9c324c6fff7d5a5d92631"
+        "sha": "7ed0c4e2965ee315132c3c714609b46b23b5edc0"
      },
      "homepage": "https://www.vibeprospecting.ai/product/claude-plugin"
    },
@@ -2881,7 +2695,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/wix/skills.git",
-        "sha": "188ed338f39d70e5aef7f9a2582bbf338f223b78"
+        "sha": "2da8231fcdc49a48af64b050ba5e1a85c3968670"
      },
      "homepage": "https://dev.wix.com/docs/wix-cli/guides/development/about-wix-skills"
    },
@@ -2934,7 +2748,7 @@
        "url": "https://github.com/zapier/zapier-mcp.git",
        "path": "plugins/zapier",
        "ref": "main",
-        "sha": "770167c572deaf74c588b45d88003ddf2145d608"
+        "sha": "f34a7854febed415c9ef766eec1c66529ef0668e"
      },
      "homepage": "https://github.com/zapier/zapier-mcp/tree/main/plugins/zapier"
    },
@@ -2974,7 +2788,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/Zoominfo/zoominfo-mcp-plugin.git",
-        "sha": "cfdebda5f3ce24d0d964cc0b3e9e5dd9ea9d507d"
+        "sha": "678c0d1b584b77fb8e0cdc14138fc1afc5a21cf2"
      },
      "homepage": "https://www.zoominfo.com"
    },
@@ -2988,7 +2802,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/zscaler/zscaler-mcp-server.git",
-        "sha": "f84ce4f0ed48047614a4202ac311cbdf00ea9a10"
+        "sha": "be37fb604a07dc9c5a4c3e009312c4f11acaa6d3"
      },
      "homepage": "https://github.com/zscaler/zscaler-mcp-server"
    }
--- a/plugins/code-modernization/README.md
+++ b/plugins/code-modernization/README.md
@@ -24,10 +24,6 @@ mkdir -p legacy && ln -s /path/to/your/legacy/codebase legacy/billing

 `/modernize-assess` works best with [`scc`](https://github.com/boyter/scc) (LOC + complexity + COCOMO) or [`cloc`](https://github.com/AlDanial/cloc), and falls back to `find`/`wc` if neither is installed. Portfolio mode also benefits from [`lizard`](https://github.com/terryyin/lizard) (cyclomatic complexity). The commands degrade gracefully without them, but the metrics will be coarser.

-## Secret handling
-
-Legacy systems routinely contain live credentials, and assessment artifacts get committed and shared. **Every agent in this plugin masks credential values** — findings, rule-card parameters, architecture notes, and test fixtures cite `file:line` with a masked preview (`AKIA****`), never the value. When credentials are found, a per-credential inventory (type, location, blast radius, rotation recommendation) is written to `analysis/<system>/SECRETS.local.md`, which the commands gitignore before writing; on non-git projects the quarantine file goes to `~/.modernize/<system>/` instead. `/modernize-harden` splits its remediation diff so credential-removal hunks (which necessarily contain the raw value) land in a gitignored `security_remediation.local.patch`, never the shareable patch. Pass `--show-secrets` to include raw values in the quarantine file (and only there). If you ran an earlier version of this plugin on a real system, check whether `analysis/` artifacts containing credentials were committed or shared, and rotate anything that was.
-
 ## Commands

 The commands are designed to be run in order, but each produces a standalone artifact so you can stop, review, and resume.
--- a/plugins/code-modernization/agents/architecture-critic.md
+++ b/plugins/code-modernization/agents/architecture-critic.md
@@ -29,12 +29,6 @@ For **transformed code**:
 - Does the test suite actually pin behavior, or just exercise code paths?
 - What would the on-call engineer need at 3am that isn't here?

-## Secret handling (mandatory)
-
-When a finding quotes code containing a credential, key, token, or
-connection string, mask the value (`'Pr0d****'`) and cite `file:line` —
-findings get appended verbatim to committed notes files.
-
 ## Output

 Findings ranked **Blocker / High / Medium / Nit**. Each with: what, where,
--- a/plugins/code-modernization/agents/business-rules-extractor.md
+++ b/plugins/code-modernization/agents/business-rules-extractor.md
@@ -40,15 +40,6 @@ of the technology, skip it.
   from structure/names), **Low** (ambiguous; needs SME).
 6. If confidence < High, write the exact question an SME must answer.

-## Secret handling (mandatory)
-
-Rule parameters sometimes *are* credentials — hardcoded passwords in auth
-checks, API keys in partner-service calls, connection strings in batch
-routines. Record the **rule**, never the **value**: write the parameter as
-`<credential — masked, see file:line>` with at most a 2–4 character
-preview. Rule cards flow into briefs and steering decks; a raw credential
-in a parameter list is a leak.
-
 ## Output format

 One "Rule Card" per rule (see the format in the `/modernize-extract-rules`
--- a/plugins/code-modernization/agents/legacy-analyst.md
+++ b/plugins/code-modernization/agents/legacy-analyst.md
@@ -32,15 +32,6 @@ and explain it in terms a modern engineer can act on.
 - **Note what's missing.** Unhandled error paths, TODO comments, commented-out
  blocks, magic numbers — these are signals about history and risk.

-## Secret handling (mandatory)
-
-Legacy code is full of live credentials, and your findings get copied into
-shareable reports. When the evidence for a finding — hardcoded config,
-dead code, debt, an interface payload — includes a credential, API key,
-token, connection string, or private key, **never reproduce the value**.
-Cite `file:line` with a masked preview (`VALUE 'Pr0d****'`,
-`password=****`). The finding is the practice, not the value.
-
 ## Output format

 Default to structured markdown: tables for inventories, Mermaid for graphs,
--- a/plugins/code-modernization/agents/security-auditor.md
+++ b/plugins/code-modernization/agents/security-auditor.md
@@ -39,30 +39,7 @@ terminal/screen items don't apply to a SPA. Work through what's relevant:

 Use available SAST where it helps (npm audit, pip-audit, grep for known-bad
 patterns) but **read the code** — tools miss logic flaws. Show tool output
-verbatim — except secret values, which you redact (see below) — then add
-your manual findings.
-
-## Secret handling (mandatory)
-
-Legacy codebases routinely contain live production credentials, and your
-findings get pasted into decks, tickets, and committed markdown. Copying a
-secret into a report multiplies the exposure you were hired to find.
-
-When you discover a hardcoded credential, API key, token, connection
-string, or private key:
-
- **Never write the secret's value into any output** — no finding table,
-  no report, no quoted code excerpt, no echoed tool output. Mask it to the
-  first 2–4 identifying characters plus `****` (`AKIA****`,
-  `postgres://app_user:****@db-prod…`). If a scanner prints a secret,
-  redact it before including the excerpt.
- Cite `file:line`. The source file is the canonical location — anyone who
-  legitimately needs the value can open it there.
- State what the credential appears to grant access to (database, queue,
-  cloud account, third-party API) and whether it looks like a production
-  or test credential.
- Recommend rotation for anything that looks live — exposure in source
-  means it is already compromised, independent of any modernization plan.
+verbatim, then add your manual findings.

 ## Reporting standard

--- a/plugins/code-modernization/agents/test-engineer.md
+++ b/plugins/code-modernization/agents/test-engineer.md
@@ -28,15 +28,6 @@ someone thinks it should do) so that a rewrite can be proven equivalent.
  `@Disabled("pending RULE-NNN")` / `@pytest.mark.skip` / `it.todo()` — never
  deleted.

-## Secret handling (mandatory)
-
-Never copy credential-like literals — passwords, API keys, tokens,
-connection strings — from legacy code into test fixtures. Tests live in
-the deliverable codebase and get committed. Substitute clearly-fake values
-of the same shape and length and note the substitution in a comment.
-Anything a test genuinely needs live (e.g. a real database connection for
-a dual-run harness) is read from an environment variable, never inlined.
-
 ## Output

 Idiomatic tests for the requested target stack (JUnit 5 / pytest / Vitest /
--- a/plugins/code-modernization/commands/modernize-assess.md
+++ b/plugins/code-modernization/commands/modernize-assess.md
@@ -1,13 +1,11 @@
 ---
 description: Full discovery & portfolio analysis of a legacy system — inventory, complexity, debt, effort estimation
-argument-hint: <system-dir> [--show-secrets] | --portfolio <parent-dir>
+argument-hint: <system-dir> | --portfolio <parent-dir>
 ---

 **Mode select.** If `$ARGUMENTS` starts with `--portfolio`, run **Portfolio
 mode** against the directory that follows. Otherwise run **Single-system
-mode** against the system dir. Parse flags positionally-independently:
-`--show-secrets` may appear before or after the system dir — the system
-dir is the first non-flag token.
+mode** against `legacy/$1`.

 ---

@@ -110,16 +108,12 @@ Spawn three subagents **in parallel**:
 2. **legacy-analyst** — "Identify technical debt in legacy/$1: dead code,
   deprecated APIs, copy-paste duplication, god objects/programs, missing
   error handling, hardcoded config. Return the top 10 findings ranked by
-   remediation value, each with file:line evidence. If evidence contains a
-   credential value, mask it per your secret-handling rules — never quote
-   it."
+   remediation value, each with file:line evidence."

 3. **security-auditor** — "Scan legacy/$1 for security vulnerabilities:
   injection, auth weaknesses, hardcoded secrets, vulnerable dependencies,
   missing input validation. Return findings in CWE-tagged table form with
-   file:line evidence and severity. Mask every discovered credential value
-   per your secret-handling rules — file:line plus a 2–4 character masked
-   preview, never the value itself."
+   file:line evidence and severity."

 Wait for all three. Synthesize their findings.

@@ -147,31 +141,6 @@ need explained.

 ## Step 6 — Write the assessment

-**Secrets quarantine first.** The assessment gets shared and committed —
-discovered credential values must never appear in it. If the
-security-auditor found any hardcoded credentials:
-
-1. Ensure `analysis/.gitignore` exists and contains the lines
-   `SECRETS.local.md` and `*.local.patch` (create or append as needed —
-   the patch pattern is used by `/modernize-harden`; writing both now
-   means the ignore set is complete from first contact). If the project is a
-   git repo, verify with `git check-ignore -q analysis/$1/SECRETS.local.md`
-   — do not write any findings until the check passes. If there is **no
-   git repo** (check for `.svn`/`.hg`/`CVS` too — a `.gitignore` protects
-   nothing under another VCS): refuse `--show-secrets` and write
-   `SECRETS.local.md` to `~/.modernize/$1/` instead of the project tree,
-   telling the user where it went and why.
-2. Write `SECRETS.local.md`: one row per credential — masked preview,
-   `file:line`, credential type, what it grants access to,
-   production/test guess, rotation recommendation. Only if the user passed
-   `--show-secrets`, add the raw value column here — this file only, never
-   ASSESSMENT.md.
-3. Masking applies to **every section of ASSESSMENT.md**, whichever agent
-   produced the finding — the Technical Debt section quotes hardcoded
-   config; those quotes follow the same masking rule as Security Findings.
-   The Security Findings section adds a one-line pointer:
-   "Credential inventory in SECRETS.local.md (gitignored; not for sharing)."
-
 Create `analysis/$1/ASSESSMENT.md` with these sections:
 - **Executive Summary** (3-4 sentences: what it is, how big, how risky, headline recommendation)
 - **System Inventory** (the scc table + tech fingerprint)
--- a/plugins/code-modernization/commands/modernize-extract-rules.md
+++ b/plugins/code-modernization/commands/modernize-extract-rules.md
@@ -46,7 +46,7 @@ Merge the three result sets. Deduplicate. For each distinct rule, write a
  When  <trigger>
  Then  <outcome>
  [And  <additional outcome>]
-**Parameters:** <constants, rates, thresholds with their current values — credentials masked: `<credential — masked, see file:line>`>
+**Parameters:** <constants, rates, thresholds with their current values>
 **Edge cases handled:** <list>
 **Suspected defect:** <optional — legacy behavior that looks wrong; decide preserve-vs-fix during transform>
 **Confidence:** High | Medium | Low — <why; if < High, state the exact SME question>
--- a/plugins/code-modernization/commands/modernize-harden.md
+++ b/plugins/code-modernization/commands/modernize-harden.md
@@ -1,42 +1,14 @@
 ---
 description: Security vulnerability scan with a reviewable remediation patch — OWASP, CWE, CVE, secrets, injection
-argument-hint: <system-dir> [--show-secrets]
+argument-hint: <system-dir>
 ---

-Run a **security hardening pass** on the legacy system: find
-vulnerabilities, rank them, and produce a reviewable patch for the
-critical ones. Parse arguments flag-independently: the system dir
-(referred to as `$1` below) is the first non-flag token in `$ARGUMENTS`;
-`--show-secrets` may appear anywhere.
+Run a **security hardening pass** on `legacy/$1`: find vulnerabilities, rank
+them, and produce a reviewable patch for the critical ones.

 This command never edits `legacy/` — it writes findings and a proposed patch
 to `analysis/$1/`. The user reviews and applies (or not).

-## Step 0 — Secrets quarantine setup
-
-Findings files get shared, committed, and pasted into decks — discovered
-credential values must never land in them. Before any scanning:
-
-1. Ensure `analysis/.gitignore` exists and contains the lines
-   `SECRETS.local.md` and `*.local.patch`. Create the file or append the
-   missing lines.
-2. If the project is a git repo, verify with
-   `git check-ignore -q analysis/$1/SECRETS.local.md` — if that exits
-   non-zero, fix the ignore rule before proceeding. Do not write any
-   findings until this check passes.
-3. **If there is no git repo** (check for `.svn`/`.hg`/`CVS` too — a
-   `.gitignore` protects nothing under another VCS): refuse
-   `--show-secrets`, and write `SECRETS.local.md` and any `.local.patch`
-   file to `~/.modernize/$1/` instead of the project tree, telling the
-   user where they went and why.
-
-All secret values in every shareable artifact this command produces are
-**masked** (`AKIA****`, `password=****`) and cited by `file:line`. Raw
-values may appear in exactly two places, both gitignored: the
-`*.local.patch` remediation hunks (unavoidably — see Remediate) and, only
-with `--show-secrets`, `SECRETS.local.md`. Never in SECURITY_FINDINGS.md
-or patch commentary.
-
 ## Scan

 Spawn the **security-auditor** subagent:
@@ -48,9 +20,7 @@ hardcoded secrets, vulnerable dependency versions, missing input validation,
 path traversal. For each finding return: CWE ID, severity
 (Critical/High/Med/Low), file:line, one-sentence exploit scenario, and
 recommended fix. Run any available SAST tooling (npm audit, pip-audit,
-OWASP dependency-check) and include its raw output. Mask every discovered
-credential value per your secret-handling rules — file:line plus a 2–4
-character masked preview, never the value itself."
+OWASP dependency-check) and include its raw output."

 ## Triage

@@ -59,50 +29,26 @@ Write `analysis/$1/SECURITY_FINDINGS.md`:
 - Findings table sorted by severity
 - Dependency CVE table (package, installed version, CVE, fixed version)

-If any hardcoded credentials were found, also write
-`analysis/$1/SECRETS.local.md` (the gitignored quarantine file from Step 0):
-one row per credential — masked preview, `file:line`, credential type, what
-it appears to grant access to, production/test guess, and a rotation
-recommendation. With `--show-secrets`, append the raw value column here —
-this file only. SECURITY_FINDINGS.md gets a one-line pointer:
-"N hardcoded credentials found — inventory in SECRETS.local.md (gitignored;
-not for sharing)."
-
 ## Remediate

 For each **Critical** and **High** finding, draft a minimal, targeted fix.
-Do **not** edit `legacy/` — write fixes as unified diffs with **paths
-relative to the project root** (`legacy/$1/...`), applied from the project
-root, with a comment line above each hunk citing the finding ID it
-addresses (`# SEC-001: parameterize the query`).
-
-**Credential findings split into two files.** A diff that removes a
-hardcoded secret necessarily contains the raw value on its `-` and
-context lines — that cannot go in the shareable patch:
-
- `analysis/$1/security_remediation.patch` (shareable) — every
-  non-credential hunk, plus for each credential finding a comment-only
-  placeholder: `# SEC-NNN: credential remediation — hunk in
-  security_remediation.local.patch (gitignored; not for sharing)`.
- `analysis/$1/security_remediation.local.patch` (gitignored in Step 0) —
-  the real, applyable hunks for credential findings only.
+Do **not** edit `legacy/` — write all fixes as a single unified diff to
+`analysis/$1/security_remediation.patch`, with a comment line above each
+hunk citing the finding ID it addresses (`# SEC-001: parameterize the query`).

 Add a **Remediation Log** section to SECURITY_FINDINGS.md mapping each
-finding ID → one-line summary of the proposed fix and which patch file
-carries the hunk.
+finding ID → one-line summary of the proposed fix and the patch hunk that
+implements it.

 ## Verify

-Spawn the **security-auditor** again to **review both patches** against
-the original code:
+Spawn the **security-auditor** again to **review the patch** against the
+original code:

-"Review analysis/$1/security_remediation.patch and
-analysis/$1/security_remediation.local.patch against legacy/$1. For each
+"Review analysis/$1/security_remediation.patch against legacy/$1. For each
 hunk: does it fully remediate the cited finding? Does it introduce new
-vulnerabilities or change behavior beyond the fix? Confirm no raw
-credential values appear anywhere in the shareable patch. Return one
-verdict per hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line
-reason."
+vulnerabilities or change behavior beyond the fix? Return one verdict per
+hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line reason."

 Add a **Patch Review** section to SECURITY_FINDINGS.md with the verdicts.
 If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.
@@ -111,12 +57,8 @@ If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.

 Tell the user the artifacts are ready:
 - `analysis/$1/SECURITY_FINDINGS.md` — findings, remediation log, patch review
- `analysis/$1/security_remediation.patch` — review, then apply **from the
-  project root**: `git apply analysis/$1/security_remediation.patch`
-  (if `legacy/$1` is a symlink, use `git apply --unsafe-paths` or apply
-  with `patch -p0` from the project root)
- `analysis/$1/security_remediation.local.patch` — the credential fixes;
-  apply the same way, and rotate the affected credentials regardless
+- `analysis/$1/security_remediation.patch` — review, then apply if appropriate
+  with `git -C legacy/$1 apply ../../analysis/$1/security_remediation.patch`
 - Re-run `/modernize-harden $1` after applying to confirm resolution

 Suggest: `glow -p analysis/$1/SECURITY_FINDINGS.md`