Security hygiene for the awesome-ai-plugins listing; fix the 7.2.1 version drift

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Workflow actions are pinned to commit SHAs; Dependabot keeps those pins current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/checks.yml

@@ -9,8 +9,8 @@ jobs:
   repo-integrity:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
 
@@ -109,7 +109,7 @@ jobs:
 
       # The OpenCode shim is JavaScript and CI has no other reason to load Node — so load it:
       # syntax, module resolution from package.json, and the injection itself with a canary.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
       - name: OpenCode shim loads and injects

SECURITY.md

@@ -0,0 +1,26 @@
+# Security
+
+## Reporting a vulnerability
+
+Please report privately through GitHub: **Security → Report a vulnerability** on this repository.
+Do not open a public issue for a security problem. Expect a first reply within a week.
+
+Only the latest release is supported; fixes ship as a new version.
+
+## What the plugin runs on your machine
+
+Memory Kit has no server, no telemetry and makes no network calls. Its hooks are local Python and
+shell scripts in [`plugins/memory-kit/hooks/`](plugins/memory-kit/hooks/), wired in
+[`hooks.json`](plugins/memory-kit/hooks/hooks.json):
+
+- **SessionStart** reads `.claude/memory/MEMORY.md`, the newest handoff and the knowledge index from
+  your repository and prints them into the session context.
+- **PreCompact** blocks compaction while `MEMORY.md` is stale or over its size caps.
+- **PreToolUse** guards: asks before an edit removes or weakens a test assertion; blocks reads
+  and writes of secret files (`.env`, `*.pem`, `id_rsa*`, …) and destructive git commands
+  (`push --force`, `reset --hard`, `clean -f`, …). Each guard documents its opt-out variable.
+- **SessionEnd** appends one timestamp line to `.claude/state/session-end.log`.
+
+No hook writes your memory files. Scaffolding (`/memory-kit:setup`) runs only after you say yes;
+during a session the agent writes memory entries itself and asks before adding a rule or a
+knowledge article.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "memory-kit",
-  "version": "7.2.0",
+  "version": "7.2.1",
   "description": "Memory Kit's OpenCode plugin entry — built-in memory decides what to remember, this one asks. The plugin itself lives in plugins/memory-kit; this package exists so OpenCode can install the shim via \"plugin\": [\"memory-kit@git+https://github.com/awrshift/agent-memory-kit.git\"].",
   "type": "module",
   "main": ".opencode/plugins/memory-kit.js",

plugins/memory-kit/templates/workspace/AGENTS-MEMORY-PROTOCOL.md

@@ -1,4 +1,4 @@
-<!-- memory-kit protocol v7.2.0 — managed block; a newer kit version REPLACES everything down to the end marker -->
+<!-- memory-kit protocol v7.2.1 — managed block; a newer kit version REPLACES everything down to the end marker -->
 # Memory protocol (for any agent working in this repository)
 
 This repository keeps agent memory in plain files. Follow this protocol every session.