github plugin sends a malformed Authorization header when GITHUB_PERSONAL_ACCESS_TOKEN is unset
#6874
security-guidance: #5425's in-flight markers are a no-op on native Windows (fcntl only), so a push right after a commit still re-reviews the same commit
#6863
Plugin directory listings don’t show publisher or source repo (e.g. 1Password)
#6862
Clarify directory code-execution declaration for skills with local validators
1
#6860
security-guidance: commit review in a sandbox renews and breaks the user's stored claude.ai login (macOS)
#6859
github plugin: enable the Actions toolset so Claude can check CI with fine-grained tokens
#6857
session-report: token shares misstate spend, and cache breaks don't say why they happened
#6854
security-guidance: UserPromptSubmit blocks every prompt ~4s (up to 30s timeout) on WSL /mnt/c repos — git stash create over 9P
#6848
telegram plugin: orphaned getUpdates pollers pile up and spin, consuming many CPU cores
#6831
Plugin "rubicon" (stevepowell99/causalmap-plugins, plugins/rubicon) held for review on four findings, each with an explanation below