[BUG] Same-named agents duplicated across plugins with divergent content (9 agents flagged by garden)

Preliminary Checks

• I have read the Code of Conduct
• I have searched existing issues to ensure this is not a duplicate
• This report contains only technical information about a bug

Harness

Claude Code

Harness version

N/A — repo/docs consistency issue, harness-independent

Affected plugin / agent / skill / command

README.md, docs/agents.md, and the duplicated agents listed below (security-auditor, django-pro, fastapi-pro, python-pro)

Bug description

Found during an automated repo audit (LLM-assisted; every claim below re-verified by hand against a fresh shallow clone, 2026-07-31). Three related consistency bugs, likely sharing one root cause (§3):

1. README counts drift from the tree. README.md claims 203 agents / 175 skills / 109 commands. Actual: 204 agents, 180 skills, 109 commands (matches).

2. docs/agents.md model column is stale. The catalog lists sonnet for python-pro, django-pro and fastapi-pro, but every corresponding file's frontmatter says model: opus (checked all copies of each).

3. Same-named agents duplicated across plugins WITH divergent content — not byte-identical copies; they have drifted apart, so fixes land in one copy and miss the others:

• security-auditor.md in 5 plugins (security-compliance, security-scanning, comprehensive-review, full-stack-orchestration, backend-development) — all five md5s differ
• django-pro.md in api-scaffolding + python-development — md5s differ
• fastapi-pro.md in api-scaffolding + python-development — md5s differ

Steps to reproduce

git clone --depth 1 https://github.com/wshobson/agents && cd agents
find plugins -path '*/agents/*.md' | wc -l          # 204, README says 203
find plugins -name 'SKILL.md' | wc -l               # 180, README says 175
grep -E 'python-pro|django-pro|fastapi-pro' docs/agents.md   # model column: sonnet
grep '^model:' plugins/*/agents/{python-pro,django-pro,fastapi-pro}.md 2>/dev/null  # opus
find plugins -name security-auditor.md | xargs md5sum        # 5 distinct hashes

Expected behavior

README counts match the tree; docs/agents.md model tiers match frontmatter; same-named agents are either a single canonical copy or kept identical by CI.

Actual behavior

As described: counts off by +1/+5, model column stale, 9 divergent copies across 3 agent names.

Additional context

Suggestion: a canonical copy + build-step/symlinks, or a CI check asserting same-named agent files are identical, plus an automated count check for README. Separate minor advisory: some command templates interpolate raw $ARGUMENTS into tool-enabled agent prompts (e.g. dgx-spark-ops/commands/spark-preflight.md lines 8, 13) — a prompt-injection→tool-execution path if fed untrusted text; possibly worth a CONTRIBUTING note.