fix(engine): auto-detect skills dir for plugin installs; refresh plugin metadata (#47)

engine/skill_map.py: resolve SKILLS_DIR across all install methods —
  1) $CBH_SKILLS_DIR override, 2) skills/ shipped next to the engine (repo checkout
  AND Claude Code plugin cache, where engine/ and skills/ stay siblings),
  3) ~/.claude/skills (install.sh copy target). Fixes the plugin-cache 'skills not
  found' case with zero manual setup, while keeping the $CBH_SKILLS_DIR escape hatch
  proposed in #44.

.claude-plugin/{marketplace,plugin}.json: refresh stale '71-skill / 48 hunt-*' ->
  '82-skill / 57 hunt-*' (+ APK/iOS); no schema changes (lastUpdated is not a
  Claude Code marketplace field, so it is intentionally not added).

Co-authored-by: Sachin Sharma <sachin.lucideus@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
     {
       "name": "claude-bughunter",
       "source": "./",
-      "description": "71-skill bug-hunting & external red-team bundle — 48 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK), recon/OSINT, reporting & validation gates, Burp MCP integration. Skills auto-load by topic; 15 slash commands.",
+      "description": "82-skill bug-hunting & external red-team bundle — 57 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, Burp MCP integration. Skills auto-load by topic; 15 slash commands.",
       "version": "2.1.0",
       "author": {
         "name": "Sachin Sharma",

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bughunter",
-  "description": "71-skill bug-hunting & external red-team bundle for Claude Code — 48 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands included.",
+  "description": "82-skill bug-hunting & external red-team bundle for Claude Code — 57 hunt-* web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands included.",
   "version": "2.1.0",
   "author": {
     "name": "Sachin Sharma",

engine/skill_map.py

@@ -8,13 +8,37 @@
 
     surface (endpoint / parameter)  ->  attack class  ->  which hunt-* skill  ->  first curl
 
-Mappings are grounded in the skills actually installed (~/.claude/skills); anything not
-present is filtered out so we never point at a skill that isn't there.
+Mappings are grounded in the skills actually installed (auto-detected: the bundle's own
+skills/ for repo/plugin installs, or ~/.claude/skills for the copy installer, overridable
+via $CBH_SKILLS_DIR); anything not present is filtered out so we never point at a skill
+that isn't there.
 Active testing is curl-first; Burp MCP is optional (only where noted — OOB/blind/fuzzing).
 """
 import os
 
-SKILLS_DIR = os.path.expanduser("~/.claude/skills")
+
+def _resolve_skills_dir():
+    """Locate the installed skills/ directory across every install method.
+
+    Resolution order:
+      1. $CBH_SKILLS_DIR — explicit override (e.g. a non-standard plugin cache path).
+      2. skills/ shipped next to the engine — works for both a repo checkout and a
+         Claude Code plugin install (the whole bundle lives in the plugin cache, so
+         engine/ and skills/ stay siblings there too).
+      3. ~/.claude/skills — the target of the scripts/install.sh copy method.
+    """
+    env = os.environ.get("CBH_SKILLS_DIR")
+    if env:
+        return os.path.expanduser(env)
+    bundled = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "skills"
+    )
+    if os.path.isdir(bundled):
+        return bundled
+    return os.path.expanduser("~/.claude/skills")
+
+
+SKILLS_DIR = _resolve_skills_dir()
 
 # attack class -> hunt skill(s) in the bundle
 CLASS_SKILL = {