[DOCS] plugins/README.md security-guidance entry has the wrong hook type and pattern count

Documentation Type

Incorrect/outdated documentation

Documentation Location

plugins/README.md

Section/Topic

security-guidance plugin entry (line 27, Contents column)

Current Documentation

Hook: PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls

What's Wrong or Missing?

plugins/README.md line 27 describes the security-guidance plugin's contents as:

Hook: PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls

Two specific claims here don't match the plugin's actual implementation:

• Hook type: plugins/security-guidance/hooks/hooks.json registers SessionStart, UserPromptSubmit, PostToolUse, and Stop. There is no PreToolUse hook anywhere in the file. The regex pattern check this line refers to actually runs on PostToolUse with matcher: "Edit|Write|MultiEdit|NotebookEdit" — i.e. after an edit is made, not before it.

• Pattern count: plugins/security-guidance/hooks/patterns.py defines SECURITY_PATTERNS as a list of 25 pattern dicts (each with a "ruleName" key, lines 32-255). Not 9. (Note: a plain grep -c '"ruleName"' returns 26, because of an unrelated assertion at line 330 that also references the key — the actual pattern count is 25, matching the plugin's own README, which says "~25 known-dangerous patterns.")

The line also only describes one part of what the plugin does. hooks.json's PostToolUse block additionally runs an LLM-based review on Bash(git commit:*) and Bash(git push:*), and the Stop hook runs a full-diff LLM review — matching what plugins/security-guidance/README.md describes as a 3-layer system (regex patterns, LLM diff review, agentic commit review). None of that is reflected in the top-level table.

Suggested Improvement

Update the Contents column for security-guidance in plugins/README.md (line 27) to match the table's existing style, e.g.:

Hooks: PostToolUse - Regex pattern warnings (~25 patterns) on Edit/Write, plus LLM-based review on git commit/push; Stop - Full-diff LLM review

Happy to open a PR making this change.

Impact

Low - Minor confusion or inconvenience

Additional Context

_No response_