fix(plugin): privacy policy links, and keep the install command out of the hook

[eddietejeda]

Follow-up from the plugin directory submission's Compliance step.

• Privacy policy and terms. Adds privacyPolicyUrl (https://www.hotdata.dev/privacy-policy) and termsOfServiceUrl (https://www.hotdata.dev/terms-of-service) to plugin.json. The directory shows both on the listing. The form asks you to confirm "the plugin's privacy policy accurately describes the data it handles", and until now no policy was linked.
• "Scripts the validator couldn't follow" hold. The hook no longer prints the curl … | sh install command. It tells Claude to follow the install section in the skill, which already has the command, and to set HOTDATA_NO_SKILLS=1. Nothing changes for users: Claude still asks before installing anything. This is a guess at the cause, since the portal didn't name the file.

Not addressed: the "Image or font file that the plugin's code could run" hold. The only image is the listing icon, and the only reference to it is the icon field the portal asked for. Removing it would bring back the "No icon" warning, so it stays until the hold's details show what the validator wants.

Verified

• claude plugin validate --strict passes.
• shellcheck is clean.
• Ran the hook with no CLI installed: it prints the new message, and the hook no longer contains any curl/sh.
• check-skills.sh --require-version passes.

Privacy policy gap for the policy owner: the current policy covers account and website data. It doesn't mention customer data loaded into Hotdata, and it lists "analytics and telemetry partners" while the README says the CLI collects no telemetry. Those can both be true, but a reviewer may ask.

[claude]

nit: Restore the instruction to call the binary as ~/.hotdata/cli/hotdata after an install (not blocking).

The hook adds ~/.hotdata/cli to PATH only at session start. A prebuilt install during the session leaves hotdata off PATH until the next session. The removed text covered this case. The "Upgrade" section of skills/hotdata/SKILL.md (lines 492-498) does not cover it. Without the instruction, Claude runs hotdata and gets "command not found" right after a successful install.

Suggested replacement for the message body:

HOTDATA_NO_SKILLS=1 because this plugin already provides the skill. If the
binary lands in ~/.hotdata/cli, call it as ~/.hotdata/cli/hotdata for the rest
of this session.

This text has no curl or sh, so the validator change still holds.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!