fix(hooks): resolve security eval and session-start output schema

README.md

@@ -1,5 +1,7 @@
 # Agent Skills
 
+> **Fork note:** This is [@googlarz](https://github.com/googlarz)'s fork of [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills) with work-in-progress enhancements: [observability-and-monitoring skill](https://github.com/addyosmani/agent-skills/pull/61), [CI skill validator](https://github.com/addyosmani/agent-skills/pull/60), and [agent persona integration](https://github.com/addyosmani/agent-skills/pull/62).
+
 **Production-grade engineering skills for AI coding agents.**
 
 Skills encode the workflows, quality gates, and best practices that senior engineers use when building software. These ones are packaged so AI agents follow them consistently across every phase of development.
@@ -124,9 +126,9 @@ Skills are plain Markdown - they work with any agent that accepts system prompts
 
 ---
 
-## All 20 Skills
+## All 21 Skills
 
-The commands above are the entry points. Under the hood, they activate these 20 skills — each one a structured workflow with steps, verification gates, and anti-rationalization tables. You can also reference any skill directly.
+The commands above are the entry points. Under the hood, they activate 20 core lifecycle skills — each one a structured workflow with steps, verification gates, and anti-rationalization tables. Plus one standalone productivity skill. You can also reference any skill directly.
 
 ### Define - Clarify what to build
 
@@ -178,6 +180,12 @@ The commands above are the entry points. Under the hood, they activate these 20
 | [documentation-and-adrs](skills/documentation-and-adrs/SKILL.md) | Architecture Decision Records, API docs, inline documentation standards - document the *why* | Making architectural decisions, changing APIs, or shipping features |
 | [shipping-and-launch](skills/shipping-and-launch/SKILL.md) | Pre-launch checklists, feature flag lifecycle, staged rollouts, rollback procedures, monitoring setup | Preparing to deploy to production |
 
+### Productivity & Utilities - Standalone skills
+
+| Skill | What It Does | Invoke With |
+|-------|-------------|-------------|
+| [assistant](skills/assistant/README.md) | Calendar and task management. Creates rich context-aware Google Calendar entries with conversation links, detects conflicts, respects work preferences, manages local task lists | `/assistant` (automatic or explicit invocation) |
+
 ---
 
 ## Agent Personas
@@ -240,7 +248,7 @@ Every skill follows a consistent anatomy:
 
 ```
 agent-skills/
-├── skills/                            # 20 core skills (SKILL.md per directory)
+├── skills/                            # 21 skills (SKILL.md per directory)
 │   ├── idea-refine/                   #   Define
 │   ├── spec-driven-development/       #   Define
 │   ├── planning-and-task-breakdown/   #   Plan
@@ -261,6 +269,7 @@ agent-skills/
 │   ├── deprecation-and-migration/     #   Ship
 │   ├── documentation-and-adrs/        #   Ship
 │   ├── shipping-and-launch/           #   Ship
+│   ├── assistant/                     #   Productivity: Calendar & tasks
 │   └── using-agent-skills/            #   Meta: how to use this pack
 ├── agents/                            # 3 specialist personas
 ├── references/                        # 4 supplementary checklists

hooks/session-start.sh

@@ -1,24 +1,24 @@
 #!/bin/bash
 # agent-skills session start hook
 # Injects the using-agent-skills meta-skill into every new session
+#
+# Output format: plain text stdout.
+#
+# Claude Code docs define two valid SessionStart output shapes:
+#   1. Plain text stdout  → injected directly as additional context
+#   2. {"hookSpecificOutput": {"additionalContext": "..."}}
+#
+# Shape 2 is broken for plugin-registered hooks (CC bug #16538: plugin
+# SessionStart additionalContext is silently dropped). Plain text (shape 1)
+# works reliably for both native and plugin hooks.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SKILLS_DIR="$(dirname "$SCRIPT_DIR")/skills"
 META_SKILL="$SKILLS_DIR/using-agent-skills/SKILL.md"
 
-if ! command -v jq >/dev/null 2>&1; then
-  echo '{"priority": "INFO", "message": "agent-skills: jq is required for the session-start hook but was not found on PATH. Install jq (e.g. `brew install jq` or `apt-get install jq`) to enable meta-skill injection. Skills remain available individually."}'
-  exit 0
-fi
-
 if [ -f "$META_SKILL" ]; then
-  CONTENT=$(cat "$META_SKILL")
-  # Use jq to properly escape and construct valid JSON
-  jq -cn \
-    --arg message "agent-skills loaded. Use the skill discovery flowchart to find the right skill for your task.
-
-$CONTENT" \
-    '{priority: "IMPORTANT", message: $message}'
+  printf 'agent-skills loaded. Use the skill discovery flowchart to find the right skill for your task.\n\n'
+  cat "$META_SKILL"
 else
-  echo '{"priority": "INFO", "message": "agent-skills: using-agent-skills meta-skill not found. Skills may still be available individually."}'
+  printf 'agent-skills: using-agent-skills meta-skill not found. Skills may still be available individually.\n'
 fi

hooks/simplify-ignore-test.sh

@@ -30,8 +30,9 @@ escape_glob() {
   printf '%s' "$s"
 }
 
-# Extract filter_file from the hook script (line 59 "filter_file()" to line 142 closing brace)
-eval "$(sed -n '/^filter_file()/,/^}/p' hooks/simplify-ignore.sh)"
+# Source the hook script to load filter_file and its helpers
+# shellcheck source=hooks/simplify-ignore.sh
+. hooks/simplify-ignore.sh
 
 assert_eq() {
   local label="$1" expected="$2" actual="$3"

hooks/simplify-ignore.sh

@@ -10,30 +10,14 @@
 # The real content (with model's changes applied) lives in the backup.
 #
 # Dependencies: jq, shasum or sha1sum (auto-detected)
+#
+# This file is safe to source: sourcing loads only the helper functions and
+# filter_file. Callers may export CACHE before sourcing to override the default.
 
 set -euo pipefail
 
-if ! command -v jq >/dev/null 2>&1; then
-  printf '%s\n' "error: missing jq" >&2; exit 1
-fi
-
-CACHE="${CLAUDE_PROJECT_DIR:-.}/.claude/.simplify-ignore-cache"
-if [ -t 0 ]; then INPUT="{}"; else INPUT=$(cat); fi
-
-# Parse hook input — trap errors explicitly so set -e doesn't cause
-# a silent exit on malformed JSON, and surface a useful diagnostic.
-parse_error=""
-TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null) || {
-  parse_error="failed to parse .tool_name from hook input"
-  TOOL_NAME=""
-}
-FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null) || {
-  parse_error="failed to parse .tool_input.file_path from hook input"
-  FILE_PATH=""
-}
-if [ -n "$parse_error" ]; then
-  printf 'Warning: %s (input: %.120s)\n' "$parse_error" "$INPUT" >&2
-fi
+# CACHE may be overridden by callers (e.g. tests) via an exported variable
+CACHE="${CACHE:-${CLAUDE_PROJECT_DIR:-.}/.claude/.simplify-ignore-cache}"
 
 hash_cmd() {
   if command -v shasum >/dev/null 2>&1; then shasum
@@ -141,6 +125,32 @@ ${line}"
   [ $count -gt 0 ] && return 0 || return 1
 }
 
+# ── Guard: sourcing this file loads only the functions above ──────────────────
+# jq dependency check and stdin reading are skipped when sourced.
+[ "${BASH_SOURCE[0]}" = "$0" ] || return 0
+
+# ── Hook execution (only when run directly) ───────────────────────────────────
+if ! command -v jq >/dev/null 2>&1; then
+  printf '%s\n' "error: missing jq" >&2; exit 1
+fi
+
+if [ -t 0 ]; then INPUT="{}"; else INPUT=$(cat); fi
+
+# Parse hook input — trap errors explicitly so set -e doesn't cause
+# a silent exit on malformed JSON, and surface a useful diagnostic.
+parse_error=""
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null) || {
+  parse_error="failed to parse .tool_name from hook input"
+  TOOL_NAME=""
+}
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null) || {
+  parse_error="failed to parse .tool_input.file_path from hook input"
+  FILE_PATH=""
+}
+if [ -n "$parse_error" ]; then
+  printf 'Warning: %s (input: %.120s)\n' "$parse_error" "$INPUT" >&2
+fi
+
 # ── Stop: restore all files from backup ───────────────────────────────────────
 if [ -z "$TOOL_NAME" ]; then
   [ -d "$CACHE" ] || exit 0

skills/assistant/.gitignore

@@ -0,0 +1,13 @@
+# Google OAuth — never commit these
+token.json
+credentials.json
+
+# Runtime data
+config.json
+tasks.json
+
+# Python
+__pycache__/
+*.pyc
+*.pyo
+.DS_Store