[tristanroth1]

What

Release pull request for v2026.10.27, following AGENTS.md "Release (maintainers)":

1. Security review re-run on 690016c (step 1), delta-focused against the first run at acbe47e. reviews/security/library-security-review.md now names 690016c as the reviewed commit, covers 64 skills (66 files), cites validator line numbers at 690016c, and has a "Re-run 2026-10-27 for v2026.10.27" section.
2. Pins (step 2): every install pin moves from v2026.10.20.3 to v2026.10.27 in AGENTS.md, README.md (badge included) and .claude-plugin/marketplace.json, the same files release commit 7f748a3 touched. README already shows 64 skills. CHANGELOG history and the record's references to the first run keep v2026.10.20.3.
3. CHANGELOG: "## Unreleased" becomes "## v2026.10.27" (no empty Unreleased kept, as in prior releases), with a re-run bullet and "Every install pin moves to v2026.10.27."

Content shipping in this release: #18 (security review record), #20 (Not checked, Review record, data line, hidden-text rule, ai-draft-challenge-review), #19 (NIST SP 800-53 and RMF, three skills, retags).

Security review re-run

• Scan of new and changed skills: 66 files, 0 non-ASCII, invisible or control characters, 0 HTML, 0 code fences, 0 base64-like runs; no new host, no network or shell command, no new external reference; all 64 skills name their output folder and carry the data line; 64 Copilot challenge records.
• Validator probe at 690016c: 7 of 7 rejected (at acbe47e: 1 of 7).

Probe	Rule
ignore previous instructions	security-injection
ignore the above instructions	security-injection
forget your instructions	security-injection
HTML comment with an agent directive	security-hidden-text
zero-width character inside "ignore previous instructions"	security-hidden-text
Unicode tag characters	security-hidden-text
bidi override	security-hidden-text

• Rows: evidence updated in 1.2, 3.1, 3.3, 3.4, 3.8, 4.1, 4.2, 8.1, 8.2, 8.6, B1-3, B2-2; no result flipped. 4.2 stays partial (encoded payloads and lookalike characters are still manual only); B1-3 stays partial (the data line is an instruction, not sanitisation); 3.8 stays partial (14 of 64 skills carry a credential NEVER line; ssp-control-implementation-statements reads configuration exports without one). R1 and R4 marked done.
• Counts (81 checks): unchanged, 22 pass, 34 partial, 4 gap, 21 not applicable.

Checks run locally

• node tools/validate.mjs and --release: ok, 64 skills
• node --test tools/*.test.mjs: 182 pass
• site: npm ci && npm run build ok (100 pages); npm test 51 pass; SEO gate L0P pass; built FAQ shows v2026.10.27

CODEX_REVIEW: unavailable (quota until 2026-11-02) -> Vibe 2026-10-27: FIX-FIRST (3 text errors, fixed as specified in 118ffed; not blockers per the reviewer) -> SHIP
Owner: founder
Next: independent review, merge, tag v2026.10.27, deploy from tag

🤖 Generated with Claude Code