@probo/skills 0.3.1 → 0.4.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "probo",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Open-source compliance workflows powered by Probo MCP (Claude Code, Codex, OpenCode)",
   "author": {
     "name": "Probo Inc",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "probo",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Open-source compliance workflows powered by Probo MCP (Codex, OpenCode, Claude Code)",
   "author": {
     "name": "Probo Inc",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@probo/skills",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Multi-agent compliance skills for open-source GRC (Claude Code, Codex, OpenCode) powered by Probo MCP",
   "private": false,
   "scripts": {
@@ -38,7 +38,7 @@
   ],
   "license": "MIT",
   "devDependencies": {
-    "js-yaml": "^4.3.1"
+    "js-yaml": "^5.4.1"
   },
   "repository": {
     "type": "git",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "probo",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Open-source compliance workflows powered by the Probo MCP API",
   "author": {
     "name": "Probo Inc",

package/skills/access-review/references/decision-rubric.md

@@ -11,7 +11,7 @@ for non-`APPROVED` decisions.
 | --- | --- | --- |
 | `TERMINATED_USER` flag | `REVOKE` | Terminated user — access no longer required |
 | `CONTRACTOR_EXPIRED` flag | `REVOKE` | Contractor engagement ended |
-| `active === false` and no `NEW` tag | `REVOKE` | Account inactive at source |
+| `active === false` | `REVOKE` | Account inactive at the source |
 | `ORPHANED` flag and `active === false` | `REVOKE` | Orphaned inactive account |
 | `ORPHANED` flag only, `active !== false` | `ESCALATE` | Orphaned account still active — needs owner |
 | `SHARED_ACCOUNT` flag | `ESCALATE` | Shared account — assign individual owner |
@@ -19,7 +19,7 @@ for non-`APPROVED` decisions.
 | `PRIVILEGED_ACCESS` or `ROLE_CREEP` flag | `ESCALATE` | Privileged access requires explicit approval |
 | `is_admin === true` and (`DORMANT` flag or last_login very stale) | `ESCALATE` | Admin access dormant — confirm business need |
 | `account_type === SERVICE_ACCOUNT`, active, no danger flags | `APPROVED` | Service account with expected access |
-| Active user, no flags (or only `NONE`), not admin, `incremental_tag !== NEW` | `APPROVED` | Routine access reaffirmed |
+| Active user, no flags (or only `NONE`), not admin | `APPROVED` | Routine access reaffirmed |
 
 "Very stale" last_login: no login in 90+ days when `last_login` is present.
 
@@ -27,7 +27,6 @@ for non-`APPROVED` decisions.
 
 | Condition | Suggested default | Why ambiguous |
 | --- | --- | --- |
-| `incremental_tag === NEW` | `ESCALATE` | New access since last campaign |
 | `NO_BUSINESS_JUSTIFICATION` flag | `ESCALATE` or `REVOKE` | Needs human judgment |
 | `OUT_OF_DEPARTMENT` flag | `ESCALATE` | Role/department mismatch |
 | `EXCESSIVE` or `ROLE_MISMATCH` flag | `ESCALATE` | Role change needs context |

package/skills/access-review/references/mcp-tools.md

@@ -22,6 +22,10 @@ required input, so it serves two distinct purposes:
 Either way the organization must be resolved before `listAccessReviewCampaigns`,
 which requires `organization_id`.
 
+Each organization includes `name` (operating name) and `legal_name` (registered
+legal name, null when unset). Match the organization the user named against
+`name`. Use `legal_name` when a note or report must name the legal entity.
+
 ## Read
 
 ### `listAccessReviewCampaigns`
@@ -40,7 +44,6 @@ List entries for a campaign. Primary data source for this command.
 | `campaign_id` | Campaign GID |
 | `filter.decision` | Use `PENDING` for review batches |
 | `filter.flag` | Optional — focus on a flag (e.g. `TERMINATED_USER`) |
-| `filter.incremental_tag` | Optional — `NEW`, `REMOVED`, `UNCHANGED` |
 | `filter.is_admin` | Optional boolean |
 | `filter.active` | Optional boolean |
 | `size` | Page size; use `50` per batch |
@@ -54,8 +57,8 @@ infer the tool from account IDs, roles, email patterns, or other entry data.
 
 Required: `campaign_id`
 
-Returns `statistics` with `total_count`, `decision_counts`, `flag_counts`,
-`incremental_tag_counts`. Call at the start of each run and after large batches.
+Returns `statistics` with `total_count`, `decision_counts`, `flag_counts`.
+Call at the start of each run and after large batches.
 
 ## Write (semi-auto command)
 
@@ -102,7 +105,6 @@ Do not call unless the user explicitly asks for campaign setup:
 | `auth_method` | `SSO`, `PASSWORD`, `API_KEY`, `OAUTH2`, `SSH`, `SERVICE_ACCOUNT` context |
 | `account_type` | `SERVICE_ACCOUNT` vs `USER` |
 | `last_login` | Dormancy signal |
-| `incremental_tag` | `NEW` needs extra scrutiny |
 | `flags`, `flag_reasons` | Primary risk signals |
 | `decision` | Target `PENDING` entries only |
 

package/skills/compliance-portal-commitments/SKILL.md

@@ -50,7 +50,9 @@ Commitments must trace to controls the company genuinely has. The source of trut
 1. **Find the Probo MCP and the organization.** This environment may expose more than one Probo MCP
    server (the plugin ships hosted `probo-us` and `probo-eu`, and self-hosted instances add their own).
    Call `listOrganizations` on each until you find the one that returns the target company, and use that
-   server for every later call. Match the organization the user named and capture its `id`.
+   server for every later call. Match the organization the user named on `name` (the operating name) and
+   capture its `id`. `legal_name` is the registered legal name when set. The public group title still uses
+   the operating name. Use `legal_name` only when a commitment must name the legal entity.
 2. **List the published policies.** Call `listDocuments` with `document_types: ["POLICY"]`. Policies with
    a `current_published_major` are published.
 3. **Read the actual content.** `getDocument` returns metadata only. To get the text, call

package/skills/missing-signatures/references/mcp-tools.md

@@ -8,7 +8,9 @@ server configured in the agent). Read each tool schema before calling.
 ### `listOrganizations`
 
 List organizations the caller can access. Use to resolve `$ARGUMENTS` when the
-user provides a name instead of a GID.
+user provides a name instead of a GID. Match on `name` (operating name).
+`legal_name` is the registered legal name when set; use it in the report title
+when the document should name the legal entity, and `name` otherwise.
 
 ### `listUsers`
 

package/skills/open-source-compliance/SKILL.md

@@ -17,7 +17,10 @@ first.
    `claude mcp login probo-us` to complete the OAuth 2.0 sign-in.
 2. Identify the target organization. List organizations if the user did not
    provide one, and when several servers are connected use the one that returns
-   the target organization.
+   the target organization. `listOrganizations` returns `name` (the operating
+   name) and `legal_name` (the registered legal name, null when unset). Match
+   the organization on `name`. When a policy, contract, or other legal document
+   must name the company, use `legal_name` when it is set and `name` otherwise.
 3. Prefer MCP tools over manual API calls. The Probo MCP API mirrors the
    platform's GraphQL surface.