Headline

v2.3.1 adds Blog Studio, an optional companion for Claude Code that shows your blog run as it happens. Everything else is v2.3.0: no change to the delivery gates, scripts or skills.

Blog Studio 0.2.0 (new, optional)

A Claude Code mod that sits next to the claude-blog plugin. It is a second plugin in the same marketplace and is never enabled by the core plugin or the standalone installers.

• Status band above the prompt with the current stage of the run.
• Live pipeline and five-gate panel: research, outline, draft, visuals, render, review and the five delivery gates, inferred from tool calls and overridden by the real preflight evidence.
• History of past blogs across projects, with date, status and gate count. It stores paths and results only, never article text.
• Run checks control that runs the strict five-gate preflight against the selected draft.

Install:

/plugin marketplace add AgriciDaniel/claude-blog
/plugin install blog-studio@agricidaniel-blog
/blog-studio configure /path/to/claude-blog/scripts

Needs a Claude Code release with mods support (checked on 2.1.294 to 2.1.296, Linux CLI). The Desktop app is fixture-tested only. Strict plugin validation passes and its 59 test-kit tests pass without a model, session or network. Read plugins/blog-studio/README.md for the commands and the honest list of what is still open (your own terminal theme and glyphs, very tall terminals, reload and resume under heavy agent work).

Also in this release

• Version 2.3.1 on every release surface and refreshed installer digests in the README.
• CI tolerates one more exact finding from the older 2.1.218 validator, which predates mods and reports Blog Studio's types manifest key as unknown.
• The secret scan now recognises a pinned git revision field and still flags a bare hex secret.

Upgrade notes

• Install from this release or v2.3.0, never from the v2.2.0 tag.
• Existing plugin users: claude plugin update claude-blog@agricidaniel-blog, then restart Claude Code.
• Blog Studio is opt-in. Skip it and nothing changes.

Everything else, including the stricter delivery gates, the safer installers and the verified CI, is described in v2.3.0.

Headline

The written pipeline and the five delivery gates now agree. In v2.2.0 the documented /blog write path could not pass Gate 4: nothing issued the review nonce and nobody saved review.md. v2.3.0 ships one canonical delivery sequence, gates that check what the contract says they check, installers that never overwrite your files, and CI that actually runs the browser tests.

Upgrade notes (read first)

• Install from the new release, not the v2.2.0 tag. The v2.2.0 installer predates the ownership protections; the README explains the safe path.
• Existing installs: the installer refuses to overwrite files it does not own and tells you what to do. --force-adopt (-ForceAdopt on Windows) adopts them after saving a timestamped backup under ~/.claude/claude-blog-backups/.
• Stricter gates. A draft that passed Gate 2 to 5 before can fail now. Each failure names the fix. New checks: stale review (the review must match the exact files delivered), leftover placeholders, hand-edited HTML, hidden text, active content, and basic HTML structure (language, title, one H1, heading order, og tags, image alt text).
• File names. Outputs are named from frontmatter slug, else the markdown file name. If slug differs from the file name you get a warning with the exact rename.
• Consent gates. Image, audio, NotebookLM, Google and taxonomy skills now ask before spending money or writing to a CMS.
• Audio. flash38 (Gemini 3.8 TTS) is the default, --max-chunks caps a run at 12 chunks, legacy aliases still work with a deprecation warning.
• Hero images. Default model is gemini-nano-banana-2.1; the fallback ladder now stops on key, billing or quota errors instead of retrying every model.
• Scoring. A draft with more than 20 of 100 points marked N/A is BLOCKING ("too little draft evidence").

What is new and fixed

Delivery pipeline

• One canonical sequence in skills/blog/references/blog-delivery-contract.md: draft, resolve markers and visuals, render, issue the nonce, review (saved verbatim), strict gates, and re-render plus re-review after any edit.
• The documented minimal frontmatter now works, with a required-keys table. lastUpdated renders as JSON-LD dateModified and a visible "Updated" line.
• The renderer embeds source and body hashes so hand-edited HTML is caught, ships responsive SVG and table CSS, and accepts a UTF-8 BOM.
• Gate 3 checks hidden text and blocks WebSockets and service workers; Gate 4 rejects stale reviews, plural "P0s" and inconsistent category scores; Gate 5 no longer fetches the renderer's own footer link, so a fully local article passes offline.

Security

• Google API keys no longer leak into URLs or error text (PSI and CrUX); keys travel in the x-goog-api-key header and are redacted everywhere.
• SSRF checks use is_global semantics and cover NAT64, 6to4 and site-local addresses; the NLP, YouTube and Search Console scripts got deadlines and quota stops.
• NotebookLM: both Google hosts accepted by exact hostname, state stored 0700/0600, downloads off, answers marked answer_trust: untrusted_notebook_content.
• install.sh validates CLAUDE_BLOG_REPO, CLAUDE_BLOG_REF and CLAUDE_BLOG_URL before git runs.
• Fixed the installer, renderer and hero script for systems where /home is a root-owned alias (Aurora, Silverblue); user-created symlinks are still refused.

Reliability

• Google scripts report an API that is not enabled (accessNotConfigured) instead of a misleading permission error (issue #65).
• Indexing batches stop on quota and need --confirm-eligible.
• quality_gate.py fails closed; the FLOW sync compares upstream bodies; the analyzer uses bounded regexes.

Content

• Stale Google and SEO facts refreshed, unsourced statistics removed, phantom command flags deleted, counts corrected.
• The bundled Brain was re-reviewed on 2026-10-12 against live sources: 83 records (73 confirmed, 7 qualified, 3 corrected). Audit 98/100.

CI and packaging

• CI installs Chromium and fails, not skips, the browser tests; installs all four hash locks on Linux, Windows and macOS; runs Python 3.11 to 3.14; checks uv lock.
• The plugin identifier stays claude-blog. Claude Code 2.1.292 and later flags the claude- prefix as reserved in claude plugin validate; CI tolerates exactly that finding.

Thanks

Contributors credited in docs/CONTRIBUTORS.md: andrewtpham (#83, recursive --batch), joachimBrindeau (#82, hero ladder and non-PNG hero rendering), imong8 (#73, Indonesian profile), Hi-2025-Be (#90, originality floor), and yupeni for reporting #65.

Known limits

• The review nonce stops accidents and casual forgery; a process running as the same user can read the verifier state.
• Redirect targets are validated but not followed, so a redirect to a dead page passes Gate 5.
• Not exercised: live model runs (reviewer agent, image generation), authenticated Google APIs, the NotebookLM browser flow, real Windows junctions.
• The optional image MCP package still exposes retired model names; use the direct API route (the default).
• Image filenames with capitals or underscores are rejected, which can hit existing posts in rewrites.
• A known, unpatched NLTK model-artifact advisory (PYSEC-2026-3740) affects the root dependency lock. The repository's code never imports NLTK; it arrives as a transitive dependency of textstat. No advisory-free claim is made.
• The Brain needs a repeat review by 2026-11-12, or its audit goes stale on 2026-11-13.

Verification

• 1531 tests pass locally (3 environment skips); 1527 on each of Python 3.11, 3.12, 3.13 and 3.14 from a clean export; 182 Brain tests.
• GitHub Actions on PR #91: all 33 checks passed on the public repository, including Python 3.11, 3.12, 3.13 and 3.14, macOS and Windows installers (Windows PowerShell 5.1 and 7), both plugin validators (2.1.218 and 2.1.292), Brain, hash-locked installs on three operating systems, uv lock --check and version coherence. Re-confirm on the merge commit before tagging.
• A golden article passes all five strict gates; a 59-scenario mutation sweep blocks 56 (the others are the control, a by-design warning and the documented same-user limit).

Claude Blog v2.2.0

This release adds verified Google-currentness controls, promotes the bundled
Claude Blog Brain after independent market-readiness audits, and closes the
remaining analyzer, installer, dependency, and security gaps found during the
full pull-request and issue review.

Highlights

• Added weekly live Google-currentness checks with deterministic offline
  validation and synchronized public and Brain ledgers.
• Reviewed all 125 Brain source records. URL availability alone cannot advance
  a review date.
• Promoted Claude Blog Brain v0.2.0 to market-ready after its executable audit
  and the independent Brainstein strict rubric both scored 100.
• Added a fail-closed Brain public projection with sanitization tests,
  publication boundaries, governance policies, and release evidence.
• Added Turkish Ateşman readability support and improved language-aware
  analyzer reporting.
• Corrected analyzer handling for JSON-LD @graph, HTML image alt text,
  international government and academic sources, PageSpeed audit details, and
  optional dotted-module discovery.
• Updated reviewed GitHub Actions to SHA-pinned current releases and moved the
  setup-node action runtime to Node 24.
• Removed active download-to-execution documentation and strengthened secret,
  installer, and public-release validation.
• Fixed the PowerShell installer so execution from a local clone uses the
  reviewed local files instead of cloning the repository again.

Google and dependency updates

• Refreshed Google guidance through August 26, 2026 using primary sources.
• Corrected PageSpeed Insights, Chrome soft-navigation, structured-data,
  Search update, AI Mode, spam-update, and Google Ads compatibility claims.
• Aligned Google Ads API v25 compatibility with the supported Python client
  range and regenerated the exact hash lock.
• Updated Patchright, Google authentication, requests, and related reviewed
  dependency constraints and locks.

Verification

• Root suite: 344 passed, 1 intentional skip.
• Brain suite: 26 passed.
• Brain executable audit: market-ready, score 100, no warnings.
• Brainstein strict audit: SSS+, score 100, no warnings.
• Source ledger: 125 of 125 verification records passed.
• Windows smoke: 32 skills and 5 agents installed, then removed cleanly while
  shared credentials remained intact.
• Public release, plugin, dependency lock, secret, prose, consistency,
  actionlint, Bash, PowerShell, and Google live and offline gates passed.
• Protected-branch CI passed on the tagged commit.

Evidence and boundaries

The complete pull-request, issue, and primary-source disposition is in the
August 2026 audit.
AI citation scores remain internal readiness heuristics, not calibrated
probabilities or inclusion guarantees. Antivirus vendor reclassification for
the remaining external heuristic report is outside this repository's control.

See the full changelog
and compare v2.1.1...v2.2.0.

Claude Blog v2.1.1 is the public distribution of the audited v2 guidance and correctness release. It combines the v2.1.0 Google-policy work with public-route normalization and release-gate fixes discovered during publication.

Highlights

Google guidance and editorial truthfulness

• Reframed the existing AI score as an AI citation readiness heuristic, not a calibrated probability or Google ranking factor.
• Reweighted internal 0–100 scoring toward originality, purpose fit, source fidelity, factual support, visible-content/schema consistency, crawlability, media relevance, and reader usefulness.
• Removed rewards and blocking requirements for fixed citation-block lengths, answer-capsule lengths, question-heading quotas, mandatory FAQ sections, raw word-count targets, and metadata-only freshness.
• Kept the quality threshold at 70 while preventing style statistics, punctuation patterns, phrase lists, or purported AI-authorship percentages from blocking delivery by themselves.
• Explicitly rejects unsupported first-hand testing claims, fan-out page factories, and scaled low-value query variations.
• Labels E-E-A-T and all internal scoring weights as editorial heuristics rather than direct ranking factors.

Search implementation guidance

• Updated guidance for canonical reevaluation windows, quota-limited Request Indexing, core-update analysis, Discover targeting, rendered JSON-LD, retired structured-data types, AMP, Preferred Sources, and Search Console generative-AI/platform-property capabilities.
• Added first-supported-2MB artifact checks for titles, metadata, canonicals, schema, and primary content, with bloat warnings for excessive inline assets.
• Added behavioral back-button-interference checks and clearer guidance for stable anchors, accessible key material, accordions, and deep links.
• Treats Search I/O and generative-search product announcements as product context, not invented ranking factors or agent-specific schema requirements.
• Added an auditable primary-source Google update ledger; unverified observations cannot alter scores.

Reliability, security, and maintenance

• Added path-aware consistency validation across skills, agents, scripts, references, documentation, templates, FLOW locks, and resources.
• Added a public-release validator for repository URLs, raw installer routes, marketplace identity, and private-only instructions.
• Corrected the public marketplace slug to agricidaniel-blog and normalized public support, security, documentation, and installer destinations.
• Synchronized README installer hashes and retained download-then-run PowerShell guidance without pipe-to-execution instructions.
• Hardened optional-module discovery and added PageSpeed regression coverage for responses without audit_details.
• Updated google-genai to the tested 2.14.0 release and Patchright to 1.61.2 with regenerated hash locks.
• Declared the complete rendering, image, PageSpeed, and Search Console dependency set exercised by CI.
• Made plugin validation deterministic by installing Node.js 22 and the exact Claude Code CLI version on pull requests and protected branches.

Compatibility

• No commands or CLI arguments were removed or renamed.
• Existing exit behavior, top-level score fields, 0–100 totals, and the quality-gate threshold of 70 are preserved.
• New methodology metadata is additive.

Community acknowledgements

Thanks to the public contributors and reporters whose findings informed the audited update:

• Marketplace slug correction: #20 by @baptleduc.
• Public installation-route report: #48 by @wey-gu.
• Reports behind the guarded fixes: #22 by @juliandickie, #29 by @ancestraljoe, #33 by @MuhmdRaouf, and #44 by @nathanschram.
• Dependency update intent reviewed from #46 and #47.

Not every public proposal was merged wholesale; applicable fixes were independently verified and adapted to preserve the private hardening and delivery contract.

Verification

• GitHub Actions passed on Python 3.11 and 3.12.
• 318 repository tests passed with one intentional private-only skip.
• Prose lint, marketplace/plugin validation, version coherence, consistency checks, and public-route validation passed.
• Hash-locked audio client, Patchright driver, and preflight initialization smoke tests passed without network API calls or browser launch.
• The signed v2.1.1 tag points to green public main commit aec971ac511370c6216cd93776c9cf2fec97b32a.

Install or upgrade

Marketplace:

/plugin marketplace add AgriciDaniel/claude-blog
/plugin install claude-blog@agricidaniel-blog

Pinned source checkout:

git clone https://github.com/AgriciDaniel/claude-blog.git
cd claude-blog
git checkout v2.1.1

See the complete changelog and installation guidance.

v1.9.1 — Security hardening + Blog Delivery Contract

9 releases in 48 hours. Two themes: a five-gate Blog Delivery Contract that turns the reviewer into infrastructure (v1.9.0), and a comprehensive 8-agent cybersecurity audit pass that closes every HIGH and MEDIUM finding (v1.9.1). Public mirror jumps from v1.7.1 straight to v1.9.1; release notes below cover every shipped commit.

🎬 Watch the 12:48 walkthrough on YouTube → https://youtu.be/7Q4GaSgUFHo

Includes a live 6m20s demo of the v1.9.1 gates generating the ChatGPT Codex vs Claude Code sample blog end-to-end on screen.

[1.9.1] - 2026-05-18

Security hardening pass (11 commits)

A comprehensive 8-agent cybersecurity audit (OWASP Top 10:2021, CWE Top 25:2024, MITRE ATT&CK) ran on 2026-05-18 against the v1.9.0 surface. Score: 90/100 (Exceptional band). This release closes every HIGH and MEDIUM finding from the audit.

Added

• scripts/generate_hero.py: SSRF guard with scheme allowlist (http, https), private/loopback/link-local/ULA refuse via ipaddress, 25 MB response cap, no-redirect opener. New module constants ALLOWED_SCHEMES, MAX_IMAGE_BYTES. Closes VULN-801 (HIGH) and the CHAIN-801 AWS-IMDS-via-og:image attack path.
• scripts/blog_preflight.py: code-enforced per-draft iteration counter at <draft>/.iteration-count with MAX_ITERATIONS = 3. Exit code 2 = cap exceeded. New CLI flag --reset-iterations. Closes VULN-802 (HIGH); was previously orchestrator-prose-only.
• scripts/blog_preflight.py: nonce-bound review.md provenance. _init_review_nonce(draft) writes a secrets.token_hex(16) value to <draft>/.review-nonce; Gate 4 verifies review.md contains a matching Nonce: line. Backwards-compat soft-pass with deprecation warning when nonce file absent (v1.10.0 will make mandatory). New CLI flag --init-review-nonce. Closes VULN-803 (MEDIUM, agent provenance) and CHAIN-802 (counterfeit reviewer pass).
• uv.lock: 142-package hash-pinned dependency lock generated by uv 0.10.2. Reproducible-install path documented in docs/INSTALLATION.md. Closes VULN-401 (HIGH) supply-chain non-determinism.
• scripts/blog_preflight.py: _PreflightNoRedirectHandler + _PREFLIGHT_NO_REDIRECT_OPENER for Gate 5 link checks. _http_head now refuses non-http(s) schemes inline and refuses to follow 30x redirects. Closes VULN-804 (MEDIUM) and VULN-002 (LOW).
• agents/blog-reviewer.md: new "Nonce-bound provenance (v1.9.1)" section and Nonce: <32-hex> line in the Output Format template.
• tests/: 27 new test cases across test_generate_hero_ssrf.py (9), test_iteration_counter.py (6), test_review_nonce.py (8), test_preflight_http_head_no_redirect.py (3), and 1 new case in test_load_untrusted_root.py. Total suite: 187 tests (up from 160).
• README "Verify installer integrity" section publishing SHA-256 hashes for install.sh and install.ps1. Closes VULN-IAC-001 (MEDIUM).

Changed

• pyproject.toml: tightened upper bounds for weasyprint (>=60.2,<65 was >=60,<70), google-genai (>=1.0.0 was >=0.5.0), sentence-transformers (>=4.0.0,<5.0.0 was >=2.5.0,<5.0.0). Bumped setuptools build-floor to >=70.0.0 to close CVE-2024-6345 (RCE in package_index). Closes VULN-404 / VULN-405 / VULN-406 / VULN-411.
• skills/blog-google/scripts/google_auth.py: OAuth client_secret no longer stored in oauth-token.json. _exchange_code and _refresh_oauth_token strip client_secret from the token blob on save. get_oauth_credentials re-reads client_secret from config["oauth_client_path"] on token construction. Backwards-compat fallback to legacy token-file client_secret if oauth_client_path is unset (will be removed in v1.10.0). Closes AUTH-001 (MEDIUM).
• skills/blog-image/scripts/setup_image_mcp.py: API-key echo in --project setup is masked via new _mask_api_key helper (AIza****WXYZ style). Closes VULN-S01 (LOW).
• install.sh: defense-in-depth skill_name regex validation (^[a-z0-9-]+$) before mkdir/cp so a tampered repo with ..-style directory names cannot escape the install target. Closes VULN-IAC-003 (LOW).
• Branding kit refreshed earlier in 2026-05-18: new animated banner (assets/banner.svg) and 5 SVG architecture diagrams under assets/diagrams/ replacing the purple-era artwork. Same visual system as claude-ads and claude-seo. Regenerator at branding/scripts/generate_diagrams.py.
• tests/test_load_untrusted_root.py: new test_cli_refuses_path_traversal_attempts locks in the basename-allowlist behavior for traversal-style inputs. Closes AUTH-003 (INFO).
• docs/INSTALLATION.md: new "Reproducible install via uv" subsection covering uv sync --frozen and lock-file regeneration.

Audit findings closed by this release

Not in scope (acceptable as-is): AUTH-002 (PKCE). Installed-app OAuth flow with explicit client_secret.json does not require PKCE; CSPRNG state + fixed loopback redirect cover the CSRF case.

Quality gates final state

• Tests: 160 → 187 (+27 new tests, all targeted at the fixes)
• Prose-hygiene violations: 0
• Plugin manifest: valid
• Version coherence: all 14 surfaces at 1.9.1 (4 canonical + 10 sub-skill SKILL.md)
• Dependency lock file: present (uv.lock, 142 packages, SHA-256 pinned)

Projected security score after this release: ~95/100 security composite, ~94/100 overall (security 30%, privacy 20%, data 15%, references 15%, files 20%). Up from 87 / 90 in the pre-fix audit.

[1.9.0] - 2026-05-18

Blog Delivery Contract (mandatory pre-presentation gate)

The rankenstein.pro audit-asymptote drafting cycle surfaced a structural gap: /blog write had a blog-reviewer step but it ran as advisory. Sloppy drafts (no real hero image, broken og:image, SVG overflows visible on first render, no .pdf, .md/.html divergence) reached the user before any gate fired. v1.9.0 converts the Category-3 "reviewer exists but does not block" defect into infrastructure. Same lesson as the v1.8.x cycle; one layer up.

Five-gate delivery contract (skills/blog/references/blog-delivery-contract.md):

1. Capability Discovery: enumerate MCP servers, env vars, optional deps, agents, helper scripts before writing. Output capabilities.json.
2. Format Completeness: every draft ships .md + .html + .pdf + a real hero.<ext>. The renderer (scripts/blog_render.py) produces all three from the same source.
3. Visual Verification: render the HTML via patchright at 3 viewport widths (375, 768, 1280), capture screenshots, assert no SVG child overflows its viewBox, validate JSON-LD, check dark-mode color swap, capture console errors.
4. Content Review (BLOCKING): blog-reviewer agent scores against the rendered HTML. Threshold: score 90/100 or higher AND zero P0 issues from editorial-heuristics.md. Reviewer emits BLOCKING: true|false (reason) line for machine-readable gating.
5. Asset + Link Integrity: every img src resolves, og:image points to a real file, external links return 200, JSON-LD wordCount matches body word count within 5%.

Hero image generation ladder (scripts/generate_hero.py):

1. Banana MCP (orchestrator-level; when nanobanana-mcp is loaded)
2. Direct Gemini API via google-genai (when GOOGLE_AI_API_KEY is set)
3. Premium stock APIs: Unsplash, Pexels, Pixabay (any key suffices)
4. Openverse public API (CC-licensed; no key required)
5. Block with setup instructions if none succeed

Iteration loop: on any gate failure the orchestrator iterates up to 3 times before escalating to the user with a diagnostic. The user is no longer the first reviewer; the gates are.

Added

• skills/blog/references/blog-delivery-contract.md (the contract spec)
• scripts/blog_preflight.py (runs Gates 1, 2, 3, 5; reads Gate 4 output)
• scripts/blog_render.py (md to html to pdf, deterministic)
• scripts/generate_hero.py (5-step image ladder)
• tests/test_blog_delivery_contract.py (locks the contract in place)
• pyproject.toml: new presentation optional-deps group (patchright, weasyprint, google-genai, requests, markdown)

Changed

• agents/blog-reviewer.md: scorecard now ends with BLOCKING: true|false (reason) line; blocking thresholds documented (score 90+, zero P0)
• skills/blog/SKILL.md: new Step 6.5 between Score and Deliver; reference count 20 to 21
• skills/blog-write/SKILL.md: new Phase 6.5 enforcement section
• skills/blog-rewrite/SKILL.md: new Phase 5.5 enforcement section
• install.sh, install.ps1, uninstall.sh, uninstall.ps1: ship the 3 new scripts (caught immediately by test_installer_sync.py from v1.8.6)

Why this matters

The v1.8.x cycle taught a lesson: audits ladder you up to your asymptote; infrastructure raises the asymptote. v1.9.0 applies that one level up, from the project's code to the project's own output. Sloppy drafts cannot reach the user because the gates use the project's tools automatically, without depending on the writer to remember.

claude-blog v1.7.1

Security-focused release. A 2026-04-27 cybersecurity audit identified
39 findings (1 CRITICAL, 5 HIGH, 14 MEDIUM, 11 LOW, 8 INFO).
All CRITICAL and HIGH findings are closed in this release. PowerShell 5.1
install compatibility, OAuth CSRF protection, hash-pinned dependency lock files,
and atomic credential writes are the headline changes.

Highlights

• CRITICAL VULN-001 closed — setup_image_mcp.py no longer defaults to writing literal API keys into a tracked .mcp.json. New default is --global (writes to user-private ~/.claude/settings.json, mode 0600).
• PowerShell 5.1 compatibility — Windows install on default PS 5.1 was broken (3-arg Join-Path is PS 6.0+). Now works out of the box on Windows 10/11.
• OAuth CSRF protection — secrets.token_urlsafe state token, validated server-side; listener bound to 127.0.0.1.
• Atomic credential writes — _save_oauth_token and NotebookLM _save_browser_state now write atomically with chmod 0o600 via the _harden_perms helper.
• Hash-pinned dep lock files — 4 requirements.lock files generated via pip-compile --generate-hashes --strip-extras --allow-unsafe (1915 LoC of supply-chain hardening).
• GitHub Actions SHA-pinned — actions/checkout and actions/setup-python pinned to commit SHA, not floating tags.
• CI hardening — Top-level permissions: contents: read, concurrency cancel-in-progress, Dependabot now covers all 3 nested manifests.

What's Changed

Security (Critical / High)

• .mcp.json removed from git tracking, added to .gitignore; new tracked .mcp.example.json template uses env-expansion only with pinned @ycse/nanobanana-mcp@1.1.1.
• sync_flow.py now BLOCKS on lockfile drift via sys.exit(2) unless --allow-drift is passed; drift fires before any filesystem mutation.
• README install section reframed: clone-and-checkout-tag is the recommended path; curl-pipe-bash is documented as a convenience with explicit trust caveat.

Security (Medium)

• OAuth scopes downgraded to per-command least-privilege (gsc_readonly + ga4 default; --scopes flag for explicit elevation).
• --no-sandbox removed from NotebookLM Chromium launch (env opt-in only).
• google_report.py --domain now whitelist regex + path containment check.
• pyproject.toml advanced extras bounded; new [ads] group declares previously-phantom google-ads dep.

Security (Low / INFO)

• traceback.print_exc() in NotebookLM error path replaced with a clean error; verbose trace gated behind BLOG_DEBUG=1.
• 6 bare except: blocks changed to except Exception: so signals propagate.
• __init__.py import-time side effects removed (no more silent venv.create + Chrome download on test discovery).
• API key masking changed from key[:8]+...+key[-4:] to length-only.
• uninstall.sh and uninstall.ps1 now glob blog-* (was static list missing v1.7.0 sub-skills) and purge ~/.config/claude-seo/ credentials.

Tests (4 new)

• test_google_auth_write_secret_atomic_sets_mode_0600 — behavioral test for atomic credential write.
• test_notebooklm_credential_files_contain_chmod_hardening — static guard requiring _harden_perms( count >= 2.
• test_mcp_json_is_gitignored — regression gate for .gitignore.
• test_user_invokable_skills_have_complete_frontmatter — closes the verifier blind spot that allowed 15 SKILL.md files to ship without description/argument-hint/license.

Test suite: 52/52 passing.

Docs

• New comprehensive SECURITY.md: vulnerability disclosure flow, in/out of scope, T1-T11 trust boundaries with STRIDE, dual-use technology notes (patchright stealth-fork rationale, WebFetch indirect prompt injection risk model, sync_flow defenses), audit history, hardening checklist.
• docs/MCP-INTEGRATION.md updated with the new --global default flow.
• docs/COMMANDS.md now documents 14 previously-missing commands.
• New DEMO.md runbook for asset reproduction.

Upgrade

Plugin marketplace (recommended)

/plugin uninstall claude-blog@agricidaniel-blog-tools
/plugin marketplace update agricidaniel-blog-tools
/plugin install claude-blog@agricidaniel-blog-tools

Standalone install (clone + tag pin)

git clone https://github.com/AgriciDaniel/claude-blog.git
cd claude-blog
git checkout v1.7.1
chmod +x install.sh && ./install.sh

Standalone install (curl convenience)

curl -sL https://raw.githubusercontent.com/AgriciDaniel/claude-blog/v1.7.1/install.sh | bash

Verification

After install, verify the security guardrails:

python -m pytest tests/test_security_guardrails.py -v

All 4 security regression tests should pass.

Compatibility

• Python: 3.11+
• Windows: PowerShell 5.1+ (default Windows 10/11) — fixed in this release.
• No breaking changes to skill APIs or command surfaces.

Open Follow-ups (not release-blocking)

• blog-write/SKILL.md Phase 5 extraction (currently 535 lines, target < 500).
• sentence-transformers upper bound <5.0.0 is one major behind current 5.4.1; re-evaluate next minor.
• E-E-A-T overlap consolidation across eeat-signals.md, geo-optimization.md, quality-scoring.md.

Full changelog: v1.6.9...v1.7.1
Full CHANGELOG entry: CHANGELOG.md#171---2026-04-27

What's Changed

Fixed

• Removed unsourced "+340% citations" claim from README, COMMANDS.md, and test fixtures
• Added sponsorship caveat to +28% FAQ schema claims in content-templates.md
• Backfilled missing CHANGELOG entries for v1.6.6, v1.6.7, v1.6.8
• Corrected reference count from 13 to 14 in CLAUDE.md, README, install.ps1
• Corrected template count from 13 to 12 in install.ps1
• Updated SKILL.md orchestrator: command count 20→21, added google and update to argument-hint
• Updated MCP-INTEGRATION.md roadmap: GSC and GA4 now marked as Available (shipped in v1.6.5)
• Fixed marketplace.json $schema key that caused plugin validation failure
• Updated stale version references (1.6.5→1.6.9) in plugin.json, pyproject.toml, SKILL.md, CLAUDE.md

Added

• .github/CODEOWNERS for security-critical path protection (skills, agents, templates, installers, MCP config)

Changed

• TODO.md: moved 5 completed Phase 3 items to new Completed section with version tags

Full Changelog: v1.6.8...v1.6.9

What's Changed

Bug Fix: Windows PowerShell Installer (#8)

Root cause: irm URL | iex fails on Windows PowerShell 5.1 because the pipeline passes the downloaded script content as multiple string objects. PowerShell attempts to bind each token (including skills from path expressions inside the script) as a positional parameter to Invoke-Expression, which doesn't accept positional arguments.

Fix: The one-liner is now iex (irm URL). The parenthesized form evaluates irm first and passes the entire script as a single string to iex, working reliably across all PowerShell versions.

# Updated install command for Windows
iex (irm https://raw.githubusercontent.com/AgriciDaniel/claude-blog/main/install.ps1)

Other Fixes in install.ps1

• Python version warning corrected: 3.12+ -> 3.11+
• Installer summary updated: sub-skill count 20 -> 22

CI Maintenance

• actions/checkout bumped v4 -> v6 (supersedes Dependabot PRs #5, #6)
• actions/setup-python bumped v5 -> v6

Community

• PR #7 (blog-humanize): closed with detailed feedback for resubmission
• PRs #5 and #6: closed as superseded by direct ci.yml update

Full Changelog: https://github.com/AgriciDaniel/claude-blog/blob/main/CHANGELOG.md

What's New

Areas 3-7 audit (34 corrections across 14 files)

A second independent audit covered 88 items across API endpoints, content best practices,
schema markup, AI crawler specs, and repo documentation. This release fixes the critical
and high-priority issues found, plus sweep-up corrections caught during verification.

Critical fixes

GA4 quota was wrong by 8x

The documented GA4 Data API quota of 25,000 tokens/day was the original 2022 figure.
Google increased it 8x in late 2023. Now corrected across rate-limits-quotas.md, api-reference.md, and blog-google/SKILL.md:

• 200,000 Core Tokens/day per standard property (2M for 360)
• 40,000/hour per property, 14,000/hour per project/property
• 10 concurrent requests (50 for 360)

"46% reading mode" was a complete misquotation

The stat cited as "46% of AI agent visits begin in reading mode" does not appear in Kevin
Indig's actual published work. The real Indig finding is "top 10 domains capture 46% of all
ChatGPT citations per topic" (Growth Memo, Mar 2026). The misquote has been removed from
both ai-crawler-guide.md and geo-optimization.md, and replaced with the correct stat.

API reference updates (api-reference.md)

AI crawler guide updates (ai-crawler-guide.md)

Three-bot frameworks

Each major AI provider now operates a training bot + search/indexing bot + retrieval bot:

• OpenAI: GPTBot + OAI-SearchBot + ChatGPT-User
• Anthropic: ClaudeBot + Claude-SearchBot + Claude-User
  • Deprecated: `Claude-Web`, `anthropic-ai`
• Perplexity: PerplexityBot + Perplexity-User (may not fully respect robots.txt)

5 new crawlers added

• Meta-ExternalAgent (Meta high-volume collection)
• Bytespider (ByteDance; documented robots.txt issues)
• Google-Agent (Project Mariner agentic, 2026)
• DuckAssistBot (DuckDuckGo AI answers)
• Plus ChatGPT Operator and Google-Agent flagged as JS-capable (unlike standard crawlers)

robots.txt strategy by bot type

Added guidance distinguishing training bots (optional block) from search/indexing bots
(always allow, or your content won't appear in AI answers) from retrieval bots (may not
respect robots.txt regardless).

llms.txt reality check

Added disclaimer: No major AI platform has confirmed reading llms.txt. Google's Gary Illyes
stated Google doesn't support it (Jul 2025). Semrush testing showed zero crawler visits to
llms.txt files. Implement it cheaply but don't rely on it as a visibility strategy.

Performance thresholds caveat

Clarified that TTFB < 200ms / < 600ms / 3-5s timeouts are industry best practices from SEO
tooling, not officially published specs from OpenAI, Anthropic, or Perplexity.

Schema fixes (schema-stack.md + google-landscape-2026.md)

• BlogPosting properties: Corrected "Required" labels to "Recommended" — Google states
  "there are no required properties" for BlogPosting
• FAQPage: Strengthened August 2023 restriction note (rich results only for gov/health
  sites); clarified AI citation value comes from visible text parsing, not JSON-LD
• ClaimReview: Added to deprecated list (June 2025 structured data simplification)
• AggregateRating: Noted eligibility restricted to Product/Recipe/SoftwareApplication/
  LocalBusiness/Movie/Book — NOT BlogPosting
• ProfilePage: Added new template for author pages (supported since December 2025)

Distribution playbook updates (distribution-playbook.md)

• Reddit: Noted paid API since June 2023 ($0.24/1K calls); all strategy must be
  organic participation only
• LinkedIn: Noted 360Brew algorithm replacement (late 2024-2025): views -50%,
  engagement -25%, external links penalized ~60%; native content strongly favored
• YouTube Shorts: Noted full decoupling from long-form recommendations (late 2025);
  Shorts treated as separate discovery surface
• Fixed BrightEdge -> NP Digital attribution for YouTube citation stats

Minor fixes

• content-rules.md: Added mobile caveat to 150-160 char meta description guideline
  (mobile shows only ~120 chars, ~680px); added source+date to "94% more views" stat
• SKILL.md: Softened unsourced "94% more views" claim

Sweep-up fixes (post-verification)

Additional places where old stats or attributions were caught during post-commit verification:

• blog-google/SKILL.md: GA4 quota was still 25K tokens/day in the skill root file
• blog-geo/SKILL.md: Digital Bloom "12% across 3 platforms" corrected to "11% across 2 platforms (domain-level)"
• distribution-playbook.md: Removed unverifiable Wikipedia "22% of AI training data" claim; added self-reported caveat to G2 review stats (22-23%, 33%) with Hall.com's competing 8.25% finding
• video-embeds.md: YouTube 414% citation growth correctly attributed to NP Digital (not BrightEdge)

Out of scope (will address separately)

• `gemini-models.md` is already up to date with current model names
• `blog-audio` TTS model names in Python scripts need separate audit
• CLAUDE.md exists at repo root (audit was incorrect)
• Lock file, CITATION.cff, expanded test coverage — deferred to separate PRs

Install

```bash
curl -sL https://raw.githubusercontent.com/AgriciDaniel/claude-blog/main/install.sh | bash
```

What's New

Reference data accuracy audit (29 corrections across 6 files)

A comprehensive primary-source verification audit of 61 SEO and GEO/AEO statistics
identified misattributions, unverifiable claims, and outdated figures. All identified
issues are now corrected across `google-landscape-2026.md`, `geo-optimization.md`,
`SKILL.md`, `content-rules.md`, `schema-stack.md`, and `distribution-playbook.md`.

Unverifiable claims removed

• +340% answer-first formatting (Seenos) removed from all 4 locations: SKILL.md, content-rules.md, schema-stack.md, distribution-playbook.md — no primary source locatable
• Strauss et al. June 2025 paper stats (24%/34%/92%) removed — paper not found in any academic index
• BrightEdge "44% schema markup citation lift" removed — not in any BrightEdge published content
• Wikipedia "22% of AI training data" removed — no reputable source confirms this
• Fabricated John Mueller November 2025 quote replaced with paraphrase of documented position

Misattributions corrected

Numbers corrected

• Hidden Gems stat: 77% → 70.85% (Jul 2024 re-analysis, Detailed.com)
• ChatGPT weekly users: 800M → 900M (Feb 2026)
• AI Mode countries: 120 → 200+
• Digital Bloom cross-platform overlap: 12% → 11% (domain-level; AI Overviews not in that study)

Caveats added

• FAQPage: Rich results only for gov/health sites since Aug 2023; still valuable for AI citation, not Google rich snippets
• Q&A and Sitelinks Search Box deprecation: Jan 2026 per secondary sources; not confirmed from Google primary docs
• G2 stats (22-23%, 33%): Self-reported via G2's own blog; Hall.com independent analysis found 8.25%
• Spotlight Flesch stat (31%): Self-reported commercial data, no independent verification
• 46% AI agent reading mode: One researcher's personal test of ~100 actions, not a large-scale study
• B2B SaaS 70-80% search decline: Primarily HubSpot case study, not sector-wide data
• Google 87.3% market share: US-specific (global was ~89%)
• ChatGPT shopping finding: Contested by University of Hamburg/Frankfurt School study (973 sites)
• Listicle/table/long-form citation stats: Note conflicting study results and real sources
• FAQ schema +28%: Sponsored content on SEL, not editorial research

No new features

This is a patch release. No skills, agents, templates, or scripts were added or modified.

Install

```bash
curl -sL https://raw.githubusercontent.com/AgriciDaniel/claude-blog/main/install.sh | bash
```