fix: address plugin security review

[TerminallyLazy]

Summary

• point security, privacy, and support guidance at the canonical repository
• use the now-enabled private vulnerability reporting endpoint for sensitive reports
• remove token-bearing export examples from plugin, core, DOX, protocol, and generated agent guidance
• require history-safe, no-echo or secret-manager injection and validate against regressions

Validation

• python3 scripts/validate-plugin-packages.py
• python3 /Users/lazy/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py plugins/tree-ring-memory
• claude plugin validate .
• claude plugin validate plugins/tree-ring-memory
• cargo fmt --all -- --check
• cargo test -p tree-ring-memory-cli agent_awareness --locked (14 passed)
• git diff --check

Addresses the actionable CodeRabbit review comments on #47.

High-level PR Summary

This PR addresses security review findings by removing unsafe token-bearing export examples from all documentation and replacing them with guidance to use history-safe, no-echo prompts or secret-manager injection for the TREE_RING_COORDINATOR_TOKEN. It also updates security, privacy, and support links to point to the canonical repository, enables private vulnerability reporting, and adds validation checks to prevent regressions of these security practices.

⏱️ Estimated Review Time: 30-90 minutes

💡 Review Order Suggestion

Order	File Path
1	scripts/validate-plugin-packages.py
2	plugins/tree-ring-memory/SECURITY.md
3	plugins/tree-ring-memory/PRIVACY.md
4	plugins/tree-ring-memory/TERMS.md
5	README.md
6	skills/tree-ring-memory/SKILL.md
7	plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md
8	docs/integrations/agent-skill.md
9	templates/dox/AGENTS.md
10	docs/protocol/memory-event.md
11	crates/tree-ring-memory-cli/src/agent_awareness.rs

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Warning

Review limit reached

Next included review available in 47 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f99425e8-f983-42d2-8f1b-d694f359091e

📥 Commits

Reviewing files that changed from the base of the PR and between 053e866 and 67b6b50.

📒 Files selected for processing (11)

• README.md
• crates/tree-ring-memory-cli/src/agent_awareness.rs
• docs/integrations/agent-skill.md
• docs/protocol/memory-event.md
• plugins/tree-ring-memory/PRIVACY.md
• plugins/tree-ring-memory/SECURITY.md
• plugins/tree-ring-memory/TERMS.md
• plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md
• scripts/validate-plugin-packages.py
• skills/tree-ring-memory/SKILL.md
• templates/dox/AGENTS.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}