docs: replace deprecated TodoWrite with Task tools

Update all references from the deprecated TodoWrite tool to the new
Task tools (TaskCreate, TaskUpdate, TaskList) introduced in Claude Code.

Changes:
- Update allowed-tools in start.md, create-plugin.md, create-marketplace.md
- Update conceptual references from "todo list" to "task list"
- Update workflow-security.md to reflect new tool names
- Fix PR template reference to non-existent "Quick Reference section"
- Update SECURITY.md last updated date

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: sjnims

.github/pull_request_template.md

@@ -97,7 +97,7 @@ Fixes #
 
 - [ ] I have updated `plugins/plugin-dev/.claude-plugin/plugin.json` (source of truth)
 - [ ] I have updated `.claude-plugin/marketplace.json` (metadata.version AND plugins[0].version)
-- [ ] I have updated `CLAUDE.md` (Quick Reference section)
+- [ ] I have updated `CLAUDE.md` (version line)
 - [ ] I have updated CHANGELOG.md with relevant changes
 
 ## Component-Specific Checks

SECURITY.md

@@ -157,4 +157,4 @@ _No security issues have been reported yet._
 
 ---
 
-**Note:** _This security policy was last updated: December 13, 2025_
+**Note:** _This security policy was last updated: January 24 2026_

docs/workflow-security.md

@@ -26,7 +26,7 @@ allowed-tools: Read, Write, Edit, Grep, Glob, Bash(mkdir:*), Bash(git init:*), .
 
 ## Design Contrast with `/plugin-dev:start`
 
-The entry point command uses `disable-model-invocation: true` and restricts tools to `AskUserQuestion, Skill, TodoWrite` since it only routes to other commands. The workflow commands need broader access because they perform the actual file creation work.
+The entry point command uses `disable-model-invocation: true` and restricts tools to `AskUserQuestion, Skill, TaskCreate, TaskUpdate, TaskList` since it only routes to other commands. The workflow commands need broader access because they perform the actual file creation work.
 
 ## For Security-Sensitive Environments
 

plugins/plugin-dev/commands/create-marketplace.md

@@ -1,7 +1,7 @@
 ---
 description: Create plugin marketplaces with guided workflow
 argument-hint: [marketplace-description]
-allowed-tools: Read, Write, Edit, Grep, Glob, Bash(mkdir:*), Bash(git init:*), TodoWrite, AskUserQuestion, Skill, Task
+allowed-tools: Read, Write, Edit, Grep, Glob, Bash(mkdir:*), Bash(git init:*), TaskCreate, TaskUpdate, TaskList, AskUserQuestion, Skill, Task
 model: sonnet
 ---
 
@@ -15,7 +15,7 @@ Guide the user through creating a complete plugin marketplace from initial conce
 - **Load marketplace-structure skill**: Use the Skill tool to load the marketplace-structure skill for schema and pattern guidance
 - **Use plugin-validator agent**: Leverage the plugin-validator agent for comprehensive marketplace validation
 - **Follow best practices**: Apply patterns from this repository's own marketplace.json
-- **Use TodoWrite**: Track all progress throughout all phases
+- **Use Task tools**: Track all progress throughout all phases using TaskCreate, TaskUpdate, and TaskList
 
 **Initial request:** $ARGUMENTS
 
@@ -29,7 +29,7 @@ Guide the user through creating a complete plugin marketplace from initial conce
 
 **Actions**:
 
-1. Create todo list with all 8 phases
+1. Create task list with all 8 phases
 2. If marketplace purpose is clear from arguments:
    - Summarize understanding
    - Identify marketplace type (team internal, community, single-plugin, multi-plugin)
@@ -336,7 +336,7 @@ git commit -m "feat: initial marketplace structure"
    - [ ] External plugins accessible (if public)
 
 3. **Create summary**:
-   - Mark all todos complete
+   - Mark all tasks complete
    - List what was created:
      - Marketplace name and purpose
      - Number of plugins configured
@@ -360,7 +360,7 @@ git commit -m "feat: initial marketplace structure"
 
 ### Throughout All Phases
 
-- **Use TodoWrite** to track progress at every phase
+- **Use Task tools** to track progress at every phase (TaskCreate, TaskUpdate, TaskList)
 - **Load marketplace-structure skill** for schema reference
 - **Use plugin-validator agent** for validation
 - **Ask for user confirmation** at key decision points

plugins/plugin-dev/commands/create-plugin.md

@@ -1,7 +1,7 @@
 ---
 description: Create plugins with guided 8-phase workflow
 argument-hint: [plugin-description]
-allowed-tools: Read, Write, Edit, Grep, Glob, Bash(mkdir:*), Bash(git init:*), TodoWrite, AskUserQuestion, Skill, Task
+allowed-tools: Read, Write, Edit, Grep, Glob, Bash(mkdir:*), Bash(git init:*), TaskCreate, TaskUpdate, TaskList, AskUserQuestion, Skill, Task
 model: sonnet
 ---
 
@@ -16,7 +16,7 @@ Guide the user through creating a complete, high-quality Claude Code plugin from
 - **Use specialized agents**: Leverage agent-creator, plugin-validator, and skill-reviewer agents for AI-assisted development
 - **Follow best practices**: Apply patterns from plugin-dev's own implementation
 - **Progressive disclosure**: Create lean skills with references/examples
-- **Use TodoWrite**: Track all progress throughout all phases
+- **Use Task tools**: Track all progress throughout all phases using TaskCreate, TaskUpdate, and TaskList
 
 **Initial request:** $ARGUMENTS
 
@@ -30,7 +30,7 @@ Guide the user through creating a complete, high-quality Claude Code plugin from
 
 **Actions**:
 
-1. Create todo list with all 8 phases
+1. Create task list with all 8 phases
 2. If plugin purpose is clear from arguments:
    - Summarize understanding
    - Identify plugin type (integration, workflow, analysis, toolkit, etc.)
@@ -247,7 +247,7 @@ git commit -m "feat: initial plugin structure"
 4. Implement settings reading in hooks/commands as needed
 5. Add to .gitignore: `.claude/*.local.md`
 
-**Progress tracking**: Update todos as each component is completed
+**Progress tracking**: Update tasks as each component is completed
 
 **Output**: All plugin components implemented
 
@@ -375,7 +375,7 @@ git commit -m "feat: initial plugin structure"
    - Validate marketplace after update using plugin-validator agent
 
 4. **Create summary**:
-   - Mark all todos complete
+   - Mark all tasks complete
    - List what was created:
      - Plugin name and purpose
      - Components created (X skills, Y commands, Z agents, etc.)
@@ -402,7 +402,7 @@ git commit -m "feat: initial plugin structure"
 
 ### Throughout All Phases
 
-- **Use TodoWrite** to track progress at every phase
+- **Use Task tools** to track progress at every phase (TaskCreate, TaskUpdate, TaskList)
 - **Load skills with Skill tool** when working on specific component types
 - **Use specialized agents** (agent-creator, plugin-validator, skill-reviewer)
 - **Ask for user confirmation** at key decision points

plugins/plugin-dev/commands/start.md

@@ -1,7 +1,7 @@
 ---
 description: Start plugin development - choose your path
 argument-hint: [description]
-allowed-tools: AskUserQuestion, Skill, TodoWrite
+allowed-tools: AskUserQuestion, Skill, TaskCreate, TaskUpdate, TaskList
 model: sonnet
 disable-model-invocation: true
 ---