Add adversarial-modeler agent to differential-review

[dguido]

Summary

• Adds adversarial-modeler agent (Read, Grep, Glob, Bash) for attacker modeling on HIGH RISK code changes
• 5-step methodology: attacker model definition, concrete attack vectors, exploitability rating, complete exploit scenario, baseline cross-reference
• Key principle: "Concrete impact only — never 'could cause issues'"
• Updates SKILL.md with agent section and decision tree reference
• Bumps plugin version to 1.1.0

New files

• plugins/differential-review/agents/adversarial-modeler.md (164 lines)

Test plan

• YAML frontmatter parses correctly
• {baseDir}/skills/differential-review/ paths resolve to existing files (adversarial.md, patterns.md, methodology.md)
• SKILL.md changes don't break existing skill trigger behavior
• marketplace.json version matches plugin.json (both 1.1.0)

🤖 Generated with Claude Code

[dguido]

Code Review Summary

Findings by severity

Severity	Count
P1 (blocks merge)	0
P2 (important)	1
P3 (nice to have)	2
P4 (informational)	2

Fixed (2)

• P2: Decision tree formatting (SKILL.md lines 83-87) — Two └─ connectors at the same tree level is invalid tree syntax (└─ means "last item"). Fixed by using ├─ for the first option and └─ for the second.
• P3: Missing "When NOT to Use" section (adversarial-modeler.md) — Per contributing guidelines, agent definitions should include a "When NOT to Use" section. Added one covering: LOW/MEDIUM risk changes, greenfield code, documentation-only changes, and quick triage requests.

Dismissed (1)

• P3: README.md not updated — The plugin README doesn't mention the new agent. Dismissed because the SKILL.md Agents section already serves as the authoritative reference, and duplicating this in the README creates a maintenance sync burden.

Noted (2 P4, no action)

• P4: Description length — 196 characters is on the longer side but justified by the specificity of the trigger conditions.
• P4: Commit message alignment — The {baseDir} path fix in the second commit correctly follows the convention used in the audit-context-building agent.

Quality pipeline

All checks pass:

• JSON validation (marketplace.json, plugin.json)
• Marketplace consistency (27 plugins validated)
• SKILL.md frontmatter validation (54 files validated)
• No hardcoded user paths
• No personal emails
• Version consistency (marketplace.json and plugin.json both at 1.1.0)
• Pre-commit hooks (ruff, shellcheck, shfmt, yaml, json, trailing whitespace, end-of-file)