where-claude — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited where-claude (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project-agnostic, global skill. It scans the current repo and reports the directories that would most benefit from their own nested CLAUDE.md, ranked, each with a one-line reason. It does not create the files - it removes the guesswork of deciding where /init is worth running.
It pairs with /init: /init writes a CLAUDE.md for a directory; this skill decides which directories are worth that cost.
Claude Code auto-loads the CLAUDE.md in the cwd and its parent directories, and pulls in a nested CLAUDE.md on demand only when work happens inside that subtree. So a nested file is cheap (loaded only when relevant) but only earns its keep when the subtree has local context a parent file does not already supply. Two failure modes to avoid:
maintenance burden. Most directories should NOT get one.
Bias to restraint: a few high-value placements beat a long list.
Score each directory on these signals; recommend only those that clearly clear the bar.
Positive signals (raise the score):
package.json, pyproject.toml,setup.py, go.mod, Cargo.toml, *.csproj, pom.xml, build.gradle, etc.
runner than the repo root (e.g. a frontend/ in TS under a Python root).
rules specific to this subtree.
each visit (rough floor: ~15+ source files, or a clearly self-contained component).
services/<x>, packages/<x>, apps/<x>,cmd/<x> in a monorepo; a bounded domain module.
Negative signals (disqualify or skip):
node_modules, dist, build, out,vendor, .venv, target, __pycache__, .next, coverage, anything git-ignored.
root is /init's normal job, not a "nested" recommendation.
find . -name CLAUDE.md -not -path '*/node_modules/*')so you never recommend one that already exists or is covered by a parent.
CLAUDE.md/README* to learn what the root file already documents -a subtree only needs its own file for what the root does NOT cover.
.gitignore) and locate manifests/config filesthat mark module boundaries.
child has genuinely distinct local context (then both, noting the relationship).
Explore agentand score from its summary, to keep context clean.
Present a SHORT ranked list - the highest-value placements first. For each:
cd <dir> && claude then /init, or just note the/init target. Then a "Skipped / not worth it" section naming notable directories you deliberately left out and why (generated, covered by parent, too small). If the root lacks a CLAUDE.md, flag that first as the prerequisite.
/init must be run per-directory bythe user (it documents the cwd it runs in). Do not auto-run /init or write any CLAUDE.md yourself.
/init any CLAUDE.md..gitignore and always exclude generated/vendored/dependency directories.padding the list.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.