fix(kyberforge): broaden audit self-triggers, plug factory gaps

skill-audit/agent-audit now proactively trigger after a skill/agent
file is hand-edited outside skill-author/agent-author, not just on
explicit request — closing a gap from this session where a fork's
direct edits to agent-author/agent-audit shipped without their own
inline audit until forge was invoked to check afterward.

Also: plugin-author gains a gotcha on claude plugin validate --strict
auto-discovering every .md under agents/ regardless of manifest
declarations (ADR-0010); agent-audit's dimension count and
validate-provenance.sh's --help now match actual behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugins/kyberforge/.claude-plugin/plugin.json

@@ -8,5 +8,5 @@
   "keywords": [],
   "license": "MIT",
   "name": "kyberforge",
-  "version": "1.2.1"
+  "version": "1.2.2"
 }

plugins/kyberforge/plugin.json

@@ -13,5 +13,5 @@
   "skills": [
     "skills/"
   ],
-  "version": "1.2.1"
+  "version": "1.2.2"
 }

plugins/kyberforge/skills/agent-audit/SKILL.md

@@ -4,9 +4,12 @@ description: >
   Use when the user wants to review an agent definition they wrote, says "audit this
   agent", "check if my agent follows best practices", "review my agent file", or wants
   to know if an agent pair is ready to ship — even if they don't use the word "audit".
-  Audits a Claude Code .md and Copilot .agent.md agent file pair across five dimensions:
-  structural validation, provider safety, description quality, body quality, and pair
-  consistency — plus provenance chain validation. Produces a compact findings report
+  Also invoke proactively after directly hand-editing an agent file pair outside
+  agent-author — an unaudited hand-edit is the same risk as unreviewed code.
+  Audits a Claude Code .md and Copilot .agent.md agent file pair across six dimensions:
+  structural validation, provider safety, description quality, body quality, comment
+  discipline, and pair consistency — plus provenance chain validation. Produces a
+  compact findings report
   (findings only, no PASS noise) with Why and Fix per finding. Do not use to fix agent
   files — use /agent-author instead. Do not use to audit SKILL.md files — use
   /skill-audit instead.

plugins/kyberforge/skills/agent-audit/scripts/validate-provenance.sh

@@ -14,6 +14,7 @@ Arguments:
 Exit codes:
   0  All checks passed (or nothing to validate, or not plugin scope)
   1  One or more checks failed
+  2  Script error (unrecognized file extension — expected .md or .agent.md)
 
 Checks performed:
   0  source_keys present in agent pair but sources.md absent

plugins/kyberforge/skills/plugin-author/SKILL.md

@@ -34,6 +34,7 @@ metadata:
 - `displayName` is a CC platform field — Copilot has no equivalent. Do not add it to the Copilot manifest.
 - `skills`, `agents`, `hooks`, `mcpServers` are declared in the Copilot manifest by convention — Copilot requires explicit path declarations while CC auto-discovers content from the plugin root. Both platforms support these fields; omit them from the CC manifest by convention.
 - Agent files in a plugin's `agents/` directory silently ignore `hooks`, `mcpServers`, and `permissionMode` frontmatter fields.
+- `claude plugin validate --strict` auto-discovers every `.md` file directly under `agents/` and treats it as an agent definition requiring frontmatter — this is independent of the manifest. An explicit `agents` array listing only the real agent files does not suppress the scan; unlisted `.md` files in the same directory still fail validation (tested empirically — see ADR-0010). Any non-agent file (notes, provenance records, READMEs) must live outside `agents/` — e.g. at the plugin root — regardless of what the manifest declares.
 
 ## Route
 

plugins/kyberforge/skills/skill-audit/SKILL.md

@@ -4,6 +4,8 @@ description: >
   Use when the user wants to review a skill they wrote, says "audit this skill",
   "check if my skill follows best practices", "review my SKILL.md", or wants to
   know if a skill is ready to ship — even if they don't use the word "audit".
+  Also invoke proactively after directly hand-editing a skill's files outside
+  skill-author — an unaudited hand-edit is the same risk as unreviewed code.
   Audits a skill directory against the agentskills.io specification — structural
   checks plus qualitative review of description quality, body discipline, patterns,
   formatting, file structure, scripts, and internal consistency, plus a provenance