chore(catalog): review disclosure for jwt-ref

plugin-catalog/jwt-ref.yaml

@@ -2,7 +2,7 @@ name: jwt-ref
 repo: https://github.com/olric3015/hermes-plugins
 sha: 9c842d6da34cce6bce21a43af097629217828634
 subdir: jwt-ref
-description: "@jwt: context references that decode a JSON Web Token for the model: @jwt:<token> (or a quoted \"Bearer <token>\") attaches the header with the algorithm in words, every claim as JSON, the exp, nbf, iat and auth_time claims in UTC with how long ago or ahead they are, whether the token has expired and its lifetime, and notes on alg none, a missing or empty signature, a header that names its own key (jku, x5u, jwk), crit and duplicate names; encrypted tokens (JWE) show their header only; the TUI and Desktop composer preview a token as you type it. The signature is never verified. Disclosure — reads only the text of the reference itself and the system clock, using Python's base64, json and datetime; no network (no key sets fetched), no files read or written, no subprocess, no credentials read, the token is not stored; register() only adds the @jwt: reference provider"
+description: "@jwt: context references that decode a JSON Web Token for the model: @jwt:<token> (or a quoted \"Bearer <token>\") attaches the header with the algorithm in words, every claim as JSON, the exp, nbf, iat and auth_time claims in UTC with how long ago or ahead they are, whether the token has expired and its lifetime, and notes on alg none, a missing or empty signature, a header that names its own key (jku, x5u, jwk), crit and duplicate names; encrypted tokens (JWE) show their header only; the TUI and Desktop composer preview a token as you type it. The signature is never verified. Disclosure — reads only the text of the reference itself and the system clock, using Python's base64, json and datetime; no network (no key sets fetched), no files read or written, no subprocess, no credentials read; the plugin keeps no copy of the token, but the @jwt: reference and the decoded header and claims become part of the message sent to your model provider and saved in the session history, so decode only tokens you are willing to share with it; register() only adds the @jwt: reference provider."
 maintainer: olric3015
 tier: community
 category: tools