claude-memory: audit context/audit.md commands use ${CLAUDE_PLUGIN_ROOT}, which is unset when the model runs them

[kyle-sexton]

Problem

skills/audit/context/audit.md (claude-memory 0.13.3) gives its discovery and check commands as
bash "${CLAUDE_PLUGIN_ROOT}/skills/audit/scripts/<script>.sh" (7 occurrences). The harness
substitutes ${CLAUDE_PLUGIN_ROOT} in the SKILL.md body it renders, but context/audit.md is read
later with the Read tool, so the literal variable reaches the Bash tool. There it is unset:

$ echo "root=[${CLAUDE_PLUGIN_ROOT:-unset}]"
root=[unset]

Run as written, each command resolves to /skills/audit/scripts/... and fails. In the run that
found this, discovery only worked after the model set the variable by hand. A less careful run
would skip discovery, M2, RD1, or N1, or fall back to a bare find ., which the file itself warns
misses user-scope surfaces.

Where seen

/playbooks:repo-sweep next, claude-memory step, against melodic-software/.github
(sweep PR melodic-software/.github#153), Claude Code on WSL2.

Suggested fix

Have the spoke files avoid the variable: either give the script paths relative to the skill
directory and state in SKILL.md (where substitution runs) the absolute directory they resolve
against, or route every check through audit-spine.sh, whose path SKILL.md already renders
substituted. Worth checking the plugin's other spoke files for the same pattern.

🤖 Generated with Claude Code

[kyle-sexton]

Refs #4613. From the 2026-09-29 audit of the Cursor run. The original defect stays fixed (claude-memory 0.13.5); this issue stays closed.

PR #5270 (Refs #4613) adds plugins/claude-memory/scripts/spoke-script-paths.test.sh: a grep gate for the literal ${CLAUDE_PLUGIN_ROOT} token in claude-memory spokes, plus a check that every <skill-dir>/scripts reference resolves to a real script.

The same defect exists in other plugins (345 hits across 32 plugins on origin/main). It is tracked in #5273, which asks for per-hit triage and one repo-wide check script.

Routing every check through audit-spine.sh was not done: the fix already matches this issue first suggestion, and the sturdier alternative is a design change nobody asked for.