fix(marketplace): correct marketplace.json schema so it registers - F…

[juandresrodca]

…ixes #23

.claude-plugin/marketplace.json failed Claude Code's marketplace validation, so /plugin marketplace add transilienceai/communitytools silently no-op'd and /plugin install <p>@communitytools reported "Marketplace not found".

Schema fixes:

• name: "Transilience Community Security Tools" -> "communitytools" (kebab-case slug; spaces are rejected and break the @ install ref).
• Add required owner object (name + email).
• Move top-level description under metadata (top-level key is rejected by the manifest validator).
• Each plugin entry: path -> source (the path key is not in the schema).

Source paths point at real directories instead of the non-existent plugins/ tree:

• pentest -> ./ (root plugin.json drives the full skills/ scan).
• the four single-skill plugins -> ./skills/<name> (loaded as single-skill plugins; no plugin.json there, so no manifest conflict).

Verified locally with Claude Code 2.1.100:

• claude plugin validate passes.
• claude plugin marketplace add . registers the marketplace.
• all five plugins install and load (status: enabled); hackerone's cache contains its SKILL.md, pentest's contains the full 39-skill tree.

Summary

Related Issue

Closes #

Changes Made

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New skill or agent
• Enhancement to existing skill/agent
• Documentation update
• CI/CD or infrastructure
• Refactoring (no functional change)
• Other:

Testing

• Tested skill/agent in Claude Code session
• Tested against vulnerable application (DVWA, WebGoat, Juice Shop, etc.)
• Verified no false positives
• Ran existing tests (python -m pytest tests/)
• Manual review only (documentation/config changes)

Test details:

Checklist

• My code follows the contribution guidelines
• Commits use conventional format: type(scope): description
• I've updated documentation where needed
• New skills include SKILL.md and reference/ directory
• No secrets, credentials, or unauthorized target information included
• This PR links to an issue with Closes #N

Skill / agent checklist (if PR touches skills/)

• python3 scripts/skill_linter.py runs clean (or rationale below).
• No new challenge-specific identifiers outside skills/hackthebox/ (no machine names, no XBEN/Vulnlab IDs, no preserved FLAG{...} literals, no lab IPs).
• SKILL.md ≤ 150 lines; reference/*.md ≤ 200 lines; reference/scenarios/*.md ≤ 400 lines.
• No new DO NOT / MUST NOT / NEVER outside ## Anti-Patterns (unless file is in linter's hard-contract allowlist).
• Cross-cutting rules (brute-force, output-discipline, env-reader, skill-update) live in exactly one canonical home; other files reference it.
• If removing content, ran /skill-prune to confirm negative ROI.

Screenshots / Evidence