fix: correct four argument-hint outliers

[kyle-sexton]

No linked issue

Summary

Four concrete argument-hint outliers from the 2026-08-31 fleet skills audit. Official docs treat the field as an optional autocomplete hint ([issue-number], [filename] [format]); an empty string is not a documented spelling, and the repo's instruction-surface style rejects em dashes.

Fix

• wizard:generate: add argument-hint: "<procedure to wizardize>".
• review:code-review and review:security-review: drop argument-hint: "" so they match the other no-arg skills.
• bugs:setup: spell check | apply like sibling setups.
• computer-use:diagnose: drop the em dash; hint is the closed enum [screenshots|failures|quirks]. Omit-for-guide stays in the Arguments body.

Left for later slices of #3542: machine-health:audit (version overlap with #3672), the proposed house-style convention doc (blocked on the #3620 post-pilot gate), and the check-skill.sh criterion that would point at that doc.

Verification

• Official argument-hint row: optional autocomplete hint; examples are terse placeholders.
• scripts/affected-tests.sh --run --explain → every changed file is a recorded no-suite class (SKILL.md / CHANGELOG / plugin.json). Exit 0.

Related

Refs #3542
Refs #3672
Official: https://code.claude.com/docs/en/skills#frontmatter-reference

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T16:07:56.731400Z	4a23a97	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md, skill instructions)
• Understand the request (invoke /review:code-review lane)
• Run skip gate checks
• Review changed files for correctness/maintainability
• Post findings (inline + summary)

No findings. This is a mechanical argument-hint frontmatter cleanup across four skills (wizard:generate, review:code-review, review:security-review, bugs:setup, computer-use:diagnose), each paired with a plugin.json version bump and CHANGELOG entry. No code logic changes.

Verified independently (not just author-claimed):

• check | apply for bugs:setup matches the exact spelling used by every sibling setup skill (powershell-format, bash-format, rate-limit-guard, playwright, toolchain) — confirmed via repo-wide grep.
• No argument-hint: "" remains anywhere in the tree after this change.
• computer-use:diagnose's dropped "— omit for guide" clause isn't lost information — it's already covered in the ## Arguments table (plugins/computer-use/skills/diagnose/SKILL.md#L28: "(none) → Nothing. Answer from the symptom guide below...").
• The setup-skill contract regex in scripts/validate-plugin-contracts.mjs:195,211 (^argument-hint:\s*"check(?:\s*\||\s*\[|"), \bapply\b check) still matches "check | apply" for bugs:setup — no regression there, checked by reading the regex against the new string rather than executing it.
• CHANGELOG entries follow the existing Keep a Changelog format and versioning pattern used elsewhere in each plugin's changelog.

Not independently verified: I was not able to execute scripts/affected-tests.sh or scripts/validate-plugin-contracts.mjs in this sandbox — this lane's allowed-tools only grants gh pr diff/view/comment/review, Read, Glob, Grep (no generic Bash/node), so the PR author's "ran scripts/affected-tests.sh --run" claim is author-claimed and unverified by me. My check above is a manual read of the regex logic, not a script run.

[claude]

Claude finished @kyle-sexton's task in 27s —— View job

---

Security review complete

• Gather context (PR diff, custom instructions)
• Run /review:security-review per custom instructions
• Post findings

Skip gate triggered: this PR touches only argument-hint frontmatter strings, plugin.json version bumps, and CHANGELOG.md entries across four skills (wizard:generate, review:code-review, review:security-review, bugs:setup, computer-use:diagnose). There is no code execution path, no input handling, no permission/config change, and no secrets/credential handling in the diff — no security-relevant surface per the skill's skip gate.

No security findings.

[github-actions]

Last security-reviewed head: 4a23a972b44cb9ad8108e7612c8fbf06f920d4a5. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.