- Add .claude-plugin, .codex, .gemini to hidden file allowlist (FS-HIDDEN)
These are required plugin infrastructure directories, not secrets.
- Remove 'tokens?' from PROMPT-EXFIL regex — 'access token' is a standard
technical term in auth reference docs, causing false positives on every
skill that documents JWT/OAuth flows (e.g. saas-scaffolder auth-billing-guide)
- Remaining PROMPT-EXFIL patterns (credentials, secrets, api_keys, .env, .ssh,
.aws, ~/home, /etc) are specific enough to catch real threats
Fixes: CI security audit failure on PR #370 (7 CRITICAL false positives)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
6453a29ecf