GitHub issue reference in marketplace description

The description field in plugin.json ends with "Closes #61.", which is an issue reference that belongs in git commit messages or PR descriptions — not in a distributed manifest file. When this plugin is consumed via the marketplace, the description will include the raw issue reference text, which is confusing noise for an end user who has no context for that repo issue number.

SCF ID prefix inconsistency in example

/teach-me:control SCF-IAC-01 uses a SCF- prefix that doesn't match the format used everywhere else in the plugin. control.md, control-explainer/SKILL.md, and all other examples consistently use the bare SCF ID IAC-01 (no prefix). A user copying the README example would likely get a "couldn't resolve control ID" failure from the control-explainer skill.

⚠️ Potential issue | 🟡 Minor

Fix MD040 by tagging fenced command examples.

The usage and examples fences should include a language (text is sufficient) to satisfy markdownlint.

-```
+```text
 /teach-me:control <control-id> [--lens=<framework>]

Also applies to: 42-47

Verify each finding against the current code and only fix it if needed.

In `@plugins/teach-me/commands/control.md` around lines 11 - 13, Add a language
tag to the fenced code blocks to fix MD040: update the usage fence and the
examples fence in plugins/teach-me/commands/control.md so they start with
```text instead of ```; target the blocks containing the command usages for
/teach-me:control and the example lines (/teach-me:control IAC-01,
/teach-me:control CC6.1 --lens=SOC2, /teach-me:control "MFA on root accounts",
/teach-me:control IA-2 --lens="NIST 800-53") to ensure markdownlint passes.

⚠️ Potential issue | 🟡 Minor

Specify languages on fenced command blocks.

Both fenced blocks trigger MD040 (Line 11 and Line 50). Add a language tag like text for consistency with lint rules.

-```
+```text
 /teach-me:framework <framework-name> [--background=<level>]

Also applies to: 50-55

Verify each finding against the current code and only fix it if needed.

In `@plugins/teach-me/commands/framework.md` around lines 11 - 13, The fenced code
blocks containing the command examples (e.g., the usage string
"/teach-me:framework <framework-name> [--background=<level>]" and the example
lines like "/teach-me:framework SOC2" and "/teach-me:framework FedRAMP
--background=adjacent") are missing a language tag and trigger MD040; update
both fenced blocks to use a language tag such as `text` (i.e., change ``` to
```text) so the markdown linter accepts them and the blocks remain consistent.

⚠️ Potential issue | 🟡 Minor

Add language identifiers to fenced code blocks (MD040).

Line 11 and Line 51 code fences should specify a language to satisfy markdownlint.

-```
+```bash
 /teach-me:quiz <framework> [--focus=<area>] [--difficulty=<level>]

Also applies to: 51-55

Verify each finding against the current code and only fix it if needed.

In `@plugins/teach-me/commands/quiz.md` around lines 11 - 13, The markdown code
fences in plugins/teach-me/commands/quiz.md are missing language identifiers
(MD040); update the fenced blocks that contain the command examples (the blocks
showing "/teach-me:quiz <framework> ..." and the later examples like
"/teach-me:quiz SOC2", "/teach-me:quiz FedRAMP ...", "/teach-me:quiz \"ISO
27001\" ...") to include a language tag (e.g., bash) after the opening ``` so
the fences become ```bash to satisfy markdownlint.

⚠️ Potential issue | 🟡 Minor

Add language identifiers to fenced code blocks (MD040).

Line 11 and Line 38 fences should include a language tag (e.g., bash).

-```
+```bash
 /teach-me:role <persona> [--background=<level>]

Also applies to: 38-42

Verify each finding against the current code and only fix it if needed.

In `@plugins/teach-me/commands/role.md` around lines 11 - 13, Add language
identifiers to the fenced code blocks that show the command usage so they pass
MD040: update the triple-backtick fences around the examples of "/teach-me:role
<persona> [--background=<level>]" and the multi-line examples (including
"/teach-me:role grc-engineer", "/teach-me:role auditor --background=adjacent",
"/teach-me:role grc-tprm --background=practitioner") to use a language tag such
as bash (i.e., change ``` to ```bash) so the code blocks include the language
identifier.

⚠️ Potential issue | 🟠 Major

#!/bin/bash
# Verify whether map-controls-unified docs define --framework/--lens flags.
set -euo pipefail

fd -i "map-controls-unified.md" plugins | while read -r f; do
  echo "== $f =="
  rg -n -- '--framework|--lens|Usage|/grc-engineer:map-controls-unified' "$f" -C2
done

# Find the actual command implementation for map-controls-unified
fd -i "map-controls-unified" plugins/grc-engineer/commands --type f | grep -v ".md$" | head -5

# Also check if there's a scripts directory with the implementation
fd -i "map-controls-unified" plugins/grc-engineer/scripts --type f | head -5

# Search for any references to --framework or --lens flags in grc-engineer plugin
rg -i '\-\-framework|\-\-lens' plugins/grc-engineer/ -A2 -B2

# Read the actual SKILL.md file to see full context
cat plugins/teach-me/skills/control-explainer/SKILL.md

Line 22 references unsupported flags for /grc-engineer:map-controls-unified.

The skill instructs calling /grc-engineer:map-controls-unified --framework=<best-guess> with --lens=<framework>, but the actual command documentation only accepts a positional argument: /grc-engineer:map-controls-unified <control-name-or-id>. These flags do not exist in the grc-engineer plugin. This will cause the skill to fail when resolving framework-specific IDs.

Correct line 22 to pass the control ID as a positional argument instead:

-   - If the input matches a framework-specific ID (e.g. `CC6.1`, `IA-2`, `8.3`, `Req 7.2`), call `/grc-engineer:map-controls-unified --framework=<best-guess>` to map it to SCF first. If `--lens=<framework>` is provided, use that as the lens.
+   - If the input matches a framework-specific ID (e.g. `CC6.1`, `IA-2`, `8.3`, `Req 7.2`), call `/grc-engineer:map-controls-unified <control-id>` to map it to SCF first.

Verify each finding against the current code and only fix it if needed.

In `@plugins/teach-me/skills/control-explainer/SKILL.md` at line 22, Update the
instruction that calls /grc-engineer:map-controls-unified so it uses the control
identifier as the required positional argument instead of non-existent flags;
specifically replace the current invocation `/grc-engineer:map-controls-unified
--framework=<best-guess>` (and any use of `--lens=<framework>`) with
`/grc-engineer:map-controls-unified <control-name-or-id>` and, if needed,
compute/select the correct control-name-or-id beforehand (e.g., best-guess
framework mapping logic) and pass that value as the single positional argument
to map-controls-unified.

⚠️ Potential issue | 🟡 Minor

Add a language tag to the fenced example block.

Markdownlint MD040 is triggered here; please annotate the fence (e.g., text or md) to keep docs lint-clean.

-```
+```text
 Coverage so far:
   Covered (n): <list of control families touched>
   Uncovered (n): <list of control families not yet touched>
   Weak spots (n): <list of families where answers were partial or wrong>
 
 Suggested next focus: <family the skill recommends>

</details>

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.22.1)</summary>

[warning] 51-51: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

</details>

<!-- fingerprinting:phantom:triton:hawk:7c36d95c-6a83-4b8b-9a68-bb7994f417ca -->

<!-- d98c2f50 -->

<!-- This is an auto-generated comment by CodeRabbit -->

Path-derivation issue: this rule (skills/<framework>-expert/SKILL.md) doesn't hold for several shipped plugins. iso27001 exposes iso-expert, nist-800-53 exposes nist-expert, csa-ccm exposes ccm-expert. If the explainer mechanically derives the path from the plugin slug it will silently miss those framework-specific notes. Suggest either (a) globbing plugins/frameworks/<slug>/skills/*-expert/SKILL.md and reading whichever exists, or (b) calling out in the skill that the lookup is fuzzy and not a strict slug match. Not a blocker, but worth a one-line clarification so future readers don't trust the convention as written.

Same naming-convention issue here as in control-explainer: skills/<name>-expert/SKILL.md won't resolve for iso27001 (iso-expert), nist-800-53 (nist-expert), or csa-ccm (ccm-expert). For a tutor that is supposed to not invent anything, the silent miss on real framework-author notes is the worst failure mode. A glob over plugins/frameworks/<slug>/skills/*-expert/ is one line in the skill prompt and would be robust to future renames too.

/<framework>:scope doesn't exist as a convention in this toolkit. Today only singapore-pdpa and cyber-essentials-plus ship a scope.md command — SOC 2 starts at /soc2:assess, FedRAMP Rev 5 at /fedramp-rev5:baseline-select or /fedramp-rev5:assess. Recommending it as the universal next step will mis-direct learners on the most common frameworks. Suggest the tutor read plugins/frameworks/<slug>/commands/ and pick the actual entry-point command per framework rather than naming a convention that isn't there.

Honest-evaluation rule is the right call but worth strengthening: in practice models drift toward sandbagging when a user pushes back. Consider an explicit clause: "if the user disagrees with an evaluation, do not concede unless they cite a specific control requirement or threat model that contradicts your reasoning. Drill quality collapses if every wrong answer becomes 'partially correct' on protest." Cheap addition, big effect on whether this is actually a useful study aid versus a flatterer.

Minor consistency nit: this command delegates to framework-tutor, but the role-onboarding logic is meaningfully different from the framework-primer logic (persona plugin command surface, MAINTAINERS lookup, first-90-days narrative, no SCF crosswalk). Folding both into one skill works for v0.1 but the skill prompt is going to grow in two directions. If you split later, role-onboarder is the natural name. Not blocking — just noting before the prompt accretes.