audit-claude-md — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-claude-md (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It audits every CLAUDE.md in the current repo — checking whether existing files have drifted from the codebase and whether any directories should have one but don't — then produces a ranked report and offers to invoke /init on each problem file after per-file approval.
It pairs with /init (which writes/rewrites a CLAUDE.md) and /where-claude (which scouts new placements). This skill is the health-check that keeps existing docs from rotting silently.
Each CLAUDE.md "owns" its directory and all subdirectories that do not have their own CLAUDE.md. This scoped ownership is how git churn is attributed: a commit that only touches files under frontend/ does not make the root CLAUDE.md stale if frontend/ has its own file.
For each CLAUDE.md, the freshness baseline is its last-commit timestamp (git log -1 --format=%aI -- <path>). Commits since then that touched files within the file's scope (excluding noise — see below) are the staleness count. Thresholds:
| Commits in scope since last touch | Signal |
|---|---|
| 0 – 4 | Likely fresh |
| 5 – 14 | Possibly stale — worth reviewing |
| 15+ | Likely stale — recommend /init |
Also treat as likely stale if any of these changed since the CLAUDE.md was last touched: a manifest file (package.json, pyproject.toml, go.mod, Cargo.toml, etc.), a CI config, or a top-level config file — these signal structural change.
Exclude from the churn count: lock files (*.lock, package-lock.json, yarn.lock, Pipfile.lock), generated/vendored dirs (node_modules, dist, build, out, vendor, .venv, target, __pycache__, .next, coverage), and binary/asset files. Count only source and config changes.
For files flagged as possibly/likely stale, read them and do a quick sanity check:
This check is semantic and approximate — flag anything suspicious for the user to decide, not for you to auto-correct.
If a CLAUDE.md's parent directory has been largely deleted or its subtree collapsed into another module, flag it as orphaned. These need deletion, not /init.
Apply the /where-claude scoring heuristic to find directories that qualify for their own CLAUDE.md but don't have one. Only report clear candidates; bias to restraint (same as /where-claude).
find . -name CLAUDE.md -not -path '*/node_modules/*' -not -path '*/.git/*'
/init for the root, then stop.Explore agentand score from its summary.
that have their own CLAUDE.md.
For each CLAUDE.md:
git log -1 --format=%aI -- <path>git log --oneline --since="<timestamp>" -- <scope-dir> | wc -l (then manually exclude noise paths in the scope if needed)
/where-claude heuristic to identify directories that clearly qualify buthave no CLAUDE.md. Report only strong candidates.
Present the findings in this order:
/init to rewrite.
/init.For each finding include: file path, last-touch date, churn count, and a one-line rationale. For content drift, add the specific concern(s).
For each file in categories 1–3:
/init (for stale/missing) or flag for manual deletion (orphaned)./init without explicit per-file approval.touched a child-scoped subtree.
staleness scores.
pronouncements about what the file "should" say.
list of borderline ones.
observed.
Explore agent rather thanreading every file in the main thread.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.