[BUG] Root marketplace.json skill source paths missing skills/ prefix — all 7 plugins load 0 skills

[remten341]

Title: [BUG] Root marketplace.json skill source paths missing skills/` prefix — all 7 plugins load 0 skills

Body:

Summary

The repo-root marketplace manifest .claude-plugin/marketplace.json declares every skill source path relative to the repo root (e.g. ./appsec/sast-semgrep), but the skills actually live under skills/ (e.g. skills/appsec/sast-semgrep). As a result Claude Code resolves all 31 source paths to non-existent directories, every one of the 7 plugins loads 0 skills, and /doctor reports setup errors (14 in my install).

Environment

• Claude Code 2.1.165
• Marketplace commit 6e25a4b (feat(tooling): add validate_skill.py, pre-commit hook, fix offsec docs)
• Repo: AgentSecOps/SecOpsAgentKit

Evidence

.claude-plugin/marketplace.json (repo root) declares:

{
  "name": "appsec-skills",
  "skills": [
    "./appsec/sast-semgrep",
    "./appsec/sast-bandit",
    "./appsec/dast-zap"
  ]
}

But the actual directory layout is:

SecOpsAgentKit/
├── .claude-plugin/marketplace.json   <-- broken paths (./appsec/...)
├── skills/
│   ├── .claude-plugin/marketplace.json   <-- correct paths (resolve OK)
│   └── appsec/
│       ├── sast-semgrep/   <-- skills really here
│       ├── sast-bandit/
│       └── ...

Programmatic check across the root manifest:

paths missing skills/ prefix (broken): 31
paths OK: 0
plugins total: 7

Notably, the second manifest at skills/.claude-plugin/marketplace.json has paths that DO resolve (relative to skills/). The root copy appears to be a stale/incorrect duplicate.

Impact

All 5 enabled plugins (devsecops, secsdlc, compliance, incident-response, threatmodel) plus appsec and offsec load no skills and surface errors in /doctor. Users must disable the plugins as a workaround.

Suggested fix

Either:

1. Prefix every source/skills path in .claude-plugin/marketplace.json with skills/ (e.g. ./skills/appsec/sast-semgrep), or
2. Remove the duplicate root .claude-plugin/marketplace.json and make skills/.claude-plugin/marketplace.json the canonical manifest.

The existing validate_skill.py / pre-commit hook (added in 6e25a4b) could be extended to assert that every declared source path resolves to an existing directory, which would have caught this.

Workaround

Disable the affected plugins in ~/.claude/settings.json enabledPlugins until fixed.