v1.4.0

Added

• Plugin marketplace — .claude-plugin/marketplace.json makes this repo an installable marketplace. claude plugin marketplace add wrsmith108/skill-builder-claude-skill + claude plugin install skill-builder@wrsmith108-skills now works, resolving the "not found in any configured marketplace" error (#1).
• skill-reviewer skill — the former top-level SKILL.md (review / validate / generalize / publish existing skills) is recovered as a proper nested skill at skills/skill-reviewer/, with its scripts/ (validate-skill.ts, generate-subagent.ts) and references/ relocated alongside it. The plugin now ships two skills: skill-builder (create) and skill-reviewer (review).
• Scaffolder marketplace support — create-repo.mjs now prints the working two-step install (derived from the repo's marketplace.json) and pre-flight-checks for the .claude-plugin/ manifests, warning (with a pointer to templates/) when they are missing. New plugin-template.json and marketplace-template.json provide them; the author copies them in alongside the other templates.

Fixed

• Install command — create-repo.mjs and README-template.md no longer emit the non-resolving claude plugin install github:<repo> form (#1).
• Plugin name with space — package-template.json set the plugin name from {{SKILL_TITLE}} (a spaced human title), re-introducing the invocation bug from #2 in every scaffolded skill; it now uses kebab-case {{SKILL_NAME}} (#2).
• Manifest drift — .claude-plugin/plugin.json is now the single source of truth; the duplicate claude-plugin block was removed from package.json. Versions reconciled to 1.4.0 across plugin.json, package.json, and both skill frontmatters.
• Dangling references — removed references to the non-existent scripts/check-generalization.ts (its checks live inside validate-skill.ts) and references/linear-retro.md; resolved the missing setup.mjs template reference.
• Shell-injection hardening — create-repo.mjs now runs every command via execFileSync with argument arrays instead of interpolating user input (name, description, topics) into shell strings; the $(…) sub-shell was removed.
• Validator multi-skill support — validate-skill.ts now walks up to find a repo-root .claude-plugin/plugin.json, so version-sync works for a single plugin that ships multiple skills under skills/ (not just a per-skill manifest).

Lesson Learned

A repo can be a valid Claude Code plugin yet still be uninstallable: claude plugin install resolves plugins from a marketplace, so without a .claude-plugin/marketplace.json the install fails regardless of how correct plugin.json is. And "delete the conflicting file" is not the same as "remove the conflict" — the top-level SKILL.md was a whole second skill; preserving it as a nested skill fixes discovery without dropping a feature.