security: the one word a scanner reads as an instruction, and a hook said out loud

SKILL.md told the model that starting Docker on Linux "needs sudo systemctl"
and therefore stays on the list the model never runs. The logic was right and
unchanged; the literal was what a static scanner matches, and it cost the
skill a grade in every catalogue that scans it. The passage now says the same
thing — administrator rights through the service manager, so it stays below —
and points at check-prereqs.sh, which already prints the exact command for the
user and never runs it. That script is untouched: there is no way to tell a
Linux user to install a system package without that word, and it only echoes.

hooks.json registers a PostToolUse hook on every Bash call. The manifest
disclosed it structurally; the README did not mention it at all. One paragraph
under the Claude Code install now says what it does and what it does not do,
because a reviewer doing safety screening reads prose, and a hook that fires
on every command is the first thing they look for.

Nothing in the scripts changed. The seven security tests that ship with the
plugin pass unchanged: SSRF guard 34 cases, safe-path 30, secret payload,
cleanup guard, payload allowlist.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193x9K42x622Pcf8kAsj1dn

Author: iOSDevSK

README.md

@@ -127,6 +127,13 @@ with `codex plugin remove html2wp@<that-name>` so it cannot shadow this one.
 /plugin install html2wp@html2wp
 ```
 
+Installing the plugin also registers one hook, `hooks/stage-progress.sh`, which
+runs after every Bash call. It reads the command line the tool just ran, and if
+that line invoked one of the conversion's stage scripts it reminds the model to
+report the stage boundary. It runs nothing, writes nothing, and sends nothing;
+on every other call it prints `{}` and exits. The source is short and is the
+whole of what it does.
+
 ### Keeping Claude Code current
 
 **To update:**

skills/html2wp/SKILL.md

@@ -290,8 +290,9 @@ rest of the conversion.
 on macOS, where it needs no root: `open -a Docker`, then wait for it to answer.
 It is the commonest of the three Docker failures and it changes nothing
 durable, so stopping the conversion to ask someone to click an icon was
-friction with no safety behind it. On Linux it needs `sudo systemctl`, so it
-stays below.
+friction with no safety behind it. On Linux the daemon is started through the
+system service manager and needs administrator rights, so it stays below;
+check-prereqs.sh prints the exact command for the user to run.
 
 **The machine list — say what is needed and stop.** Two things, and the reason
 matters more than the rule, because "it changes the machine" is squeamishness