llm(claude-config-validator): package validate-ai and validate-ai-local as skills

.claude-plugin/marketplace.json

@@ -18,7 +18,7 @@
     {
       "name": "claude-config-validator",
       "source": "./plugins/claude-config-validator",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "description": "Validates Claude Code configuration files for security, structure, and quality. Routes CLAUDE.md, agents, commands, hooks, and settings to targeted review skills, reporting only what a changeset introduced."
     },
     {

README.md

@@ -27,7 +27,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable
 | [bitwarden-stripe-tools](plugins/bitwarden-stripe-tools/)               | 1.0.0   | Read-only Stripe test-mode queries, invoice previews, and test-clock advancement through a guarded CLI wrapper                                                          |
 | [bitwarden-testing-tools](plugins/bitwarden-testing-tools/)             | 1.4.0   | Testing tools for analyzing and improving test quality across Bitwarden's repositories, and setting up the QA manual regression runs for a release.                     |
 | [bitwarden-testmo-tools](plugins/bitwarden-testmo-tools/)               | 1.0.0   | Testmo API access: create test runs from reviewable filter specs, one or many per pass, with dry-run, milestone linkage, and duplicate checks                           |
-| [claude-config-validator](plugins/claude-config-validator/)             | 2.3.0   | Validates Claude Code configuration files for security, structure, and quality                                                                                          |
+| [claude-config-validator](plugins/claude-config-validator/)             | 2.3.1   | Validates Claude Code configuration files for security, structure, and quality                                                                                          |
 | [claude-retrospective](plugins/claude-retrospective/)                   | 1.1.1   | Analyze Claude Code sessions to identify successful patterns and improvement opportunities                                                                              |
 
 ## Usage

plugins/claude-config-validator/.claude-plugin/plugin.json

@@ -1,17 +1,13 @@
 {
   "name": "claude-config-validator",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Validates Claude Code configuration files for security, structure, and quality. Routes CLAUDE.md, agents, commands, hooks, and settings to targeted review skills, reporting only what a changeset introduced.",
   "author": {
     "name": "Bitwarden",
     "url": "https://github.com/bitwarden"
   },
   "homepage": "https://github.com/bitwarden/ai-plugins/tree/main/plugins/claude-config-validator",
   "repository": "https://github.com/bitwarden/ai-plugins",
-  "commands": [
-    "./commands/validate-ai/validate-ai.md",
-    "./commands/validate-ai-local/validate-ai-local.md"
-  ],
   "keywords": [
     "validation",
     "configuration",

plugins/claude-config-validator/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to the Claude Config Validator Plugin will be documented in
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.1] - 2026-10-23
+
+### Changed
+
+- `/validate-ai` and `/validate-ai-local` live under `skills/` as skills rather than under `commands/`, consistent with how the rest of the marketplace packages user-invocable workflows. The slash names are unchanged.
+
 ## [2.3.0] - 2026-10-13
 
 ### Changed

plugins/claude-config-validator/README.md

@@ -12,15 +12,15 @@ The Claude Config Validator plugin provides expert-level validation for Claude C
 
 Validates these configuration file types, each routed to its own targeted skill except where noted:
 
-| Configuration Type                                                                    | What Gets Validated                                                                                                                                   |
-| ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Agents** (`.claude/agents/*.md`)                                                    | YAML frontmatter, tool access security, model selection, system prompt quality, description clarity                                                   |
-| **Skills** (`SKILL.md`)                                                               | Not validated here. The commands delegate this to `plugin-dev:skill-reviewer`; support files under a skill are read by `reviewing-claude-config`      |
-| **CLAUDE.md** (project instructions)                                                  | Clarity, specificity, security patterns, proper emphasis, structured organization                                                                     |
-| **Prompts/Commands** (`.claude/prompts/`, `.claude/commands/`, `plugins/*/commands/`) | Purpose clarity, session context handling, skill references, parameter validation                                                                     |
-| **Hooks** (`hooks.json`, or a `hooks` block in settings)                              | Schema, event names, `${CLAUDE_PLUGIN_ROOT}` script paths, command and prompt-hook safety                                                             |
-| **Settings** (`.claude/settings.json`)                                                | Security (no committed credentials), permission scoping, valid JSON structure                                                                         |
-| **Plugin Configurations** (`plugins/*/`)                                              | Manifest validation, directory structure, marketplace standards. No checklist of its own: the commands delegate this to `plugin-dev:plugin-validator` |
+| Configuration Type                                                                    | What Gets Validated                                                                                                                                               |
+| ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Agents** (`.claude/agents/*.md`)                                                    | YAML frontmatter, tool access security, model selection, system prompt quality, description clarity                                                               |
+| **Skills** (`SKILL.md`)                                                               | Not validated here. The `validate-ai` skills delegate this to `plugin-dev:skill-reviewer`; support files under a skill are read by `reviewing-claude-config`      |
+| **CLAUDE.md** (project instructions)                                                  | Clarity, specificity, security patterns, proper emphasis, structured organization                                                                                 |
+| **Prompts/Commands** (`.claude/prompts/`, `.claude/commands/`, `plugins/*/commands/`) | Purpose clarity, session context handling, skill references, parameter validation                                                                                 |
+| **Hooks** (`hooks.json`, or a `hooks` block in settings)                              | Schema, event names, `${CLAUDE_PLUGIN_ROOT}` script paths, command and prompt-hook safety                                                                         |
+| **Settings** (`.claude/settings.json`)                                                | Security (no committed credentials), permission scoping, valid JSON structure                                                                                     |
+| **Plugin Configurations** (`plugins/*/`)                                              | Manifest validation, directory structure, marketplace standards. No checklist of its own: the `validate-ai` skills delegate this to `plugin-dev:plugin-validator` |
 
 ### Security-First Validation
 
@@ -64,7 +64,7 @@ Provides specific, file:line referenced feedback with:
 
 ## Installation
 
-Requires Claude Code 2.1.210 or later. Both commands scope their report write with an
+Requires Claude Code 2.1.210 or later. Both skills scope their report write with an
 `Edit(<path>)` rule, and consulting that rule for the `Write` tool is behavior that release
 introduced. On an older CLI the report write falls back to a permission prompt, which in a
 headless workflow run means no report and a failed check.
@@ -83,22 +83,22 @@ headless workflow run means no report and a failed check.
 
 ## Usage
 
-### Commands
+### Skills
 
-| Command                                                      | Purpose                                                                                                                                              |
-| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [`/validate-ai-local`](commands/validate-ai-local/README.md) | Validate the Claude material you changed locally (branch commits plus uncommitted work) and write a report to `${CLAUDE_PLUGIN_DATA}/ai-validation/` |
-| [`/validate-ai`](commands/validate-ai/README.md)             | Validate the Claude material changed in a pull request and report its findings inline on the diff, with a sticky summary comment                     |
+| Skill                                             | Purpose                                                                                                                                              |
+| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`/validate-ai-local`](docs/local-validation.md)  | Validate the Claude material you changed locally (branch commits plus uncommitted work) and write a report to `${CLAUDE_PLUGIN_DATA}/ai-validation/` |
+| [`/validate-ai`](docs/pull-request-validation.md) | Validate the Claude material changed in a pull request and report its findings inline on the diff, with a sticky summary comment                     |
 
-Both commands run the same review the
+Both skills run the same review the
 [validate-ai](https://github.com/bitwarden/gh-actions/tree/main/validate-ai) GitHub
 Action runs org-wide: this plugin's `reviewing-claude-config` skill for configuration and
 security, plus the `plugin-dev` plugin's `plugin-validator` and `skill-reviewer` agents
 for plugin structure and skill quality. `/validate-ai-local` additionally runs the
 action's structure, marketplace, and version-bump shell checks against your checkout.
 They share their scope rules and report contract in
 [`reference/validate-ai-scope.md`](skills/reviewing-claude-config/reference/validate-ai-scope.md),
-so the two commands and the action cannot drift apart.
+so the two skills and the action cannot drift apart.
 
 ### Basic Invocation
 
@@ -186,7 +186,7 @@ Security audit all Claude configuration files in this project
 | Settings and hooks   | `reviewing-runtime-configuration` |
 | CLAUDE.md files      | `reviewing-project-guidance`      |
 
-`SKILL.md` files are reviewed by `plugin-dev:skill-reviewer`, not here — it already covers frontmatter, trigger quality, word count, progressive disclosure, and broken references, and both `validate-ai` commands route every changed skill to it.
+`SKILL.md` files are reviewed by `plugin-dev:skill-reviewer`, not here — it already covers frontmatter, trigger quality, word count, progressive disclosure, and broken references, and both `validate-ai` skills route every changed skill to it.
 
 **Capabilities**:
 
@@ -221,7 +221,7 @@ Five passes, ordered so the security question comes first.
 
 ### Skill Validation
 
-Not performed by this plugin. `plugin-dev:skill-reviewer` owns `SKILL.md` review — frontmatter, description and trigger quality, word count and writing style, progressive disclosure, and referenced files that do not exist — and both `validate-ai` commands route every changed skill to it. Reviewing the same file against a second rule set produces duplicate findings a reader cannot tell from independent confirmation.
+Not performed by this plugin. `plugin-dev:skill-reviewer` owns `SKILL.md` review — frontmatter, description and trigger quality, word count and writing style, progressive disclosure, and referenced files that do not exist — and both `validate-ai` skills route every changed skill to it. Reviewing the same file against a second rule set produces duplicate findings a reader cannot tell from independent confirmation.
 
 Skill support files (`reference/`, `examples/`, `scripts/`) have no targeted reviewer, so `reviewing-claude-config` reads them directly for instruction content.
 
@@ -375,10 +375,12 @@ plugins/claude-config-validator/
 ├── .claude-plugin/
 │   └── plugin.json          # Plugin manifest
 ├── CHANGELOG.md             # Version history
-├── commands/
-│   ├── validate-ai/         # /validate-ai - pull request validation (command + README)
-│   └── validate-ai-local/   # /validate-ai-local - local checkout validation (command + README)
+├── docs/
+│   ├── pull-request-validation.md      # /validate-ai usage, permissions, and output
+│   └── local-validation.md             # /validate-ai-local usage, permissions, output, and troubleshooting
 ├── skills/
+│   ├── validate-ai/                    # /validate-ai - pull request validation
+│   ├── validate-ai-local/              # /validate-ai-local - local checkout validation
 │   ├── reviewing-claude-config/        # Entry point: scope, security scan, routing, filtering
 │   │   ├── SKILL.md
 │   │   ├── reference/                  # Priority framework, security patterns, requirements, changeset scope

plugins/claude-config-validator/commands/validate-ai-local/README.md → plugins/claude-config-validator/docs/local-validation.md

@@ -45,7 +45,7 @@ shows up on your machine rather than as a red check.
 | Configuration and security | `reviewing-claude-config` skill             | Any agent, skill, command, hook, `CLAUDE.md`, or `.claude/` file changed       |
 
 Scope rules, gating, and the report format are defined once in
-[`reference/validate-ai-scope.md`](../../skills/reviewing-claude-config/reference/validate-ai-scope.md),
+[`reference/validate-ai-scope.md`](../skills/reviewing-claude-config/reference/validate-ai-scope.md),
 shared with `/validate-ai` and kept in step with the action.
 
 ## Change detection
@@ -64,7 +64,7 @@ the union of:
   `/plugin install plugin-dev@claude-plugins-official`, from the `claude-plugins-official`
   marketplace at `anthropics/claude-plugins-official`. Without it those sections are reported as
   skipped, not silently dropped.
-- **A `bitwarden/gh-actions` checkout** for the three shell checks. The command looks at
+- **A `bitwarden/gh-actions` checkout** for the three shell checks. The skill looks at
   `$BW_GH_ACTIONS_PATH/validate-ai/scripts`, then a sibling `../gh-actions` checkout, and
   otherwise offers to shallow-clone the repository to a temporary directory. Decline and
   the report names those checks on its `**Not covered:**` line.
@@ -77,7 +77,7 @@ in `bitwarden/gh-actions` is their sole source of truth, and they are invoked wi
 
 ## Permissions
 
-The command pre-approves read-only inspection only — `git diff`, `git fetch origin`,
+The skill pre-approves read-only inspection only — `git diff`, `git fetch origin`,
 `git rev-parse`, `git symbolic-ref`, `git ls-files`, `date`, `ls` — plus an `Edit` rule
 scoped to `~/.claude/plugins/data/claude-config-validator*/ai-validation/*`, the only
 directory it writes to. `WebFetch` is scoped to `code.claude.com`, the one host it needs to
@@ -88,7 +88,7 @@ step executes shell code from outside this repository, and a blanket `Bash(bash:
 would pre-approve arbitrary commands on the one path that fetches code from the network.
 If you run this often, allowlist the exact script invocations yourself.
 
-Three details in the `Edit` rule are deliberate. It is an `Edit` rule even though the command uses
+Three details in the `Edit` rule are deliberate. It is an `Edit` rule even though the skill uses
 `Write`, because Claude Code checks file permissions against `Edit(path)` and `Read(path)`
 rules only: a path rule written for `Write` is accepted, never consulted, and warned about
 at startup, while an `Edit` rule applies to every built-in tool that edits files. That
@@ -114,7 +114,7 @@ goes through is a separate path.
 `validate-version-bump.sh` reads the current plugin version from your working tree, so an
 uncommitted version bump counts. It detects the changelog entry with
 `git diff <base-ref>...HEAD`, so an **uncommitted** `CHANGELOG.md` edit is not visible to
-it and gets reported as missing until you commit. The command states this in the report
+it and gets reported as missing until you commit. The skill states this in the report
 whenever that check runs.
 
 ## Output
@@ -130,7 +130,7 @@ whenever that check runs.
 `~/.claude/plugins/data/`. Reports land there rather than in the checkout you validated,
 which can be any repository — so no repository needs a `.gitignore` entry for them, and
 reports from different checkouts do not overwrite each other. The trade-off is that they
-accumulate somewhere you have to go looking for; the command prints the path it wrote each
+accumulate somewhere you have to go looking for; the skill prints the path it wrote each
 time. `claude plugin uninstall <plugin>` deletes that directory unless you pass
 `--keep-data`; `claude plugin uninstall --help` documents both the flag and the
 `~/.claude/plugins/data/{id}/` layout the `Edit` rule is written against.
@@ -150,8 +150,8 @@ skipped, and it ends with `<!-- validation-complete -->` so a local report match
 
 ## Related documentation
 
-- [Claude Config Validator plugin README](../../README.md)
-- [`reviewing-claude-config` skill](../../skills/reviewing-claude-config/SKILL.md)
+- [Claude Config Validator plugin README](../README.md)
+- [`reviewing-claude-config` skill](../skills/reviewing-claude-config/SKILL.md)
 - [validate-ai action](https://github.com/bitwarden/gh-actions/tree/main/validate-ai)
 
 ## Troubleshooting