Documentation Type
Incorrect/outdated documentation
Documentation Location
plugins/README.md
Section/Topic
security-guidance plugin entry (line 27, Contents column)
Current Documentation
Hook: PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls
What's Wrong or Missing?
plugins/README.md line 27 describes the security-guidance plugin's contents as:
Hook: PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls
Two specific claims here don't match the plugin's actual implementation:
-
Hook type: plugins/security-guidance/hooks/hooks.json registers SessionStart, UserPromptSubmit, PostToolUse, and Stop. There is no PreToolUse hook anywhere in the file. The regex pattern check this line refers to actually runs on PostToolUse with matcher: "Edit|Write|MultiEdit|NotebookEdit" — i.e. after an edit is made, not before it.
-
Pattern count: plugins/security-guidance/hooks/patterns.py defines SECURITY_PATTERNS as a list of 25 pattern dicts (each with a "ruleName" key, lines 32-255). Not 9. (Note: a plain grep -c '"ruleName"' returns 26, because of an unrelated assertion at line 330 that also references the key — the actual pattern count is 25, matching the plugin's own README, which says "~25 known-dangerous patterns.")
The line also only describes one part of what the plugin does. hooks.json's PostToolUse block additionally runs an LLM-based review on Bash(git commit:*) and Bash(git push:*), and the Stop hook runs a full-diff LLM review — matching what plugins/security-guidance/README.md describes as a 3-layer system (regex patterns, LLM diff review, agentic commit review). None of that is reflected in the top-level table.
Suggested Improvement
Update the Contents column for security-guidance in plugins/README.md (line 27) to match the table's existing style, e.g.:
Hooks: PostToolUse - Regex pattern warnings (~25 patterns) on Edit/Write, plus LLM-based review on git commit/push; Stop - Full-diff LLM review
Happy to open a PR making this change.
Impact
Low - Minor confusion or inconvenience
Additional Context
No response
Documentation Type
Incorrect/outdated documentation
Documentation Location
plugins/README.md
Section/Topic
security-guidance plugin entry (line 27, Contents column)
Current Documentation
Hook: PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls
What's Wrong or Missing?
plugins/README.mdline 27 describes the security-guidance plugin's contents as:Two specific claims here don't match the plugin's actual implementation:
Hook type:
plugins/security-guidance/hooks/hooks.jsonregistersSessionStart,UserPromptSubmit,PostToolUse, andStop. There is noPreToolUsehook anywhere in the file. The regex pattern check this line refers to actually runs onPostToolUsewithmatcher: "Edit|Write|MultiEdit|NotebookEdit"— i.e. after an edit is made, not before it.Pattern count:
plugins/security-guidance/hooks/patterns.pydefinesSECURITY_PATTERNSas a list of 25 pattern dicts (each with a"ruleName"key, lines 32-255). Not 9. (Note: a plaingrep -c '"ruleName"'returns 26, because of an unrelated assertion at line 330 that also references the key — the actual pattern count is 25, matching the plugin's own README, which says "~25 known-dangerous patterns.")The line also only describes one part of what the plugin does.
hooks.json'sPostToolUseblock additionally runs an LLM-based review onBash(git commit:*)andBash(git push:*), and theStophook runs a full-diff LLM review — matching whatplugins/security-guidance/README.mddescribes as a 3-layer system (regex patterns, LLM diff review, agentic commit review). None of that is reflected in the top-level table.Suggested Improvement
Update the Contents column for security-guidance in
plugins/README.md(line 27) to match the table's existing style, e.g.:Happy to open a PR making this change.
Impact
Low - Minor confusion or inconvenience
Additional Context
No response