contentrain-generate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited contentrain-generate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate the typed Contentrain query client from model definitions using the Prisma-pattern codegen.
The user wants to generate or regenerate the SDK client, or says something like "generate client", "regenerate types", "set up contentrain imports", "run contentrain generate", "update SDK types".
Call contentrain_status to verify:
.contentrain/ directory exists with config.json..contentrain/models/.If the project is not initialized, stop and suggest running /contentrain-init first. If no models exist, suggest /contentrain-content to create content first.
Check that the required packages are available:
@contentrain/query must be installed in the project's package.json (as a dependency).contentrain CLI must be available (via npx contentrain or globally installed).If @contentrain/query is not installed, install it using the project's package manager:
# Use whichever package manager the project uses
pnpm add @contentrain/query
# or: npm install @contentrain/query
# or: yarn add @contentrain/queryExecute the generation command:
npx contentrain generateTwo ways to invoke the generator: -contentrain generate— via thecontentrainCLI (recommended; requires thecontentrainpackage installed). This is what all examples in this skill use. -npx contentrain-query generate— directly via the@contentrain/querypackage's own bin, for projects that depend only on@contentrain/query(programmatic / build-tool flows). Both run the same generator.
If the project uses a non-standard root directory, specify it:
npx contentrain generate --root .This reads .contentrain/models/ and .contentrain/content/ to produce:
.contentrain/client/
index.mjs — ESM entry (query runtime + re-exports)
index.cjs — CJS entry (NestJS, Express, legacy tooling)
index.d.ts — Generated types (from model schemas)
data/
{model}.{locale}.mjs — Static data modules per model/localeThe generator should have added #contentrain subpath imports to package.json. Verify the full import map:
{
"imports": {
"#contentrain": {
"types": "./.contentrain/client/index.d.ts",
"import": "./.contentrain/client/index.mjs",
"require": "./.contentrain/client/index.cjs",
"default": "./.contentrain/client/index.mjs"
},
"#contentrain/*": {
"types": "./.contentrain/client/*.d.ts",
"import": "./.contentrain/client/*.mjs",
"require": "./.contentrain/client/*.cjs",
"default": "./.contentrain/client/*.mjs"
}
}
}If the imports entry is missing or incomplete, update package.json manually to match the full structure above.
Ensure tsconfig.json does not block the generated client:
paths should not conflict with #contentrain.rootDir or include should not exclude .contentrain/client/.moduleResolution: "bundler" or "node16", subpath imports resolve natively.The #contentrain subpath import works natively in Node.js 22+ but does NOT resolve in browser bundlers. If the project uses a bundler, configure an alias so #contentrain resolves to the generated client.
See references/generated-client.md for framework-specific bundler configuration patterns (Vite, Next.js, Nuxt 3, SvelteKit, Expo/React Native, Pure Node.js).
Run a quick verification that the imports resolve correctly.
Node.js / SSR-only projects:
node -e "import('#contentrain').then(m => console.log('OK:', Object.keys(m)))"Browser / bundler projects: run the framework's build command instead, since the Node.js check does not exercise the bundler alias:
# Vite-based (Vue, React, Svelte, Astro)
npx vite build
# Next.js
npx next build
# Nuxt 3
npx nuxi build
# Expo
npx expo exportA successful build confirms the #contentrain alias resolves correctly through the bundler pipeline.
If verification fails, check:
package.json has "type": "module" (for ESM projects)..contentrain/client/ directory was generated successfully.Based on the detected stack and available models, show relevant examples using actual model IDs and field names from the project — not generic placeholders.
See references/generated-client.md for the complete SDK API reference, relation patterns, and framework-specific usage patterns.
Suggest setting up watch mode for development:
npx contentrain generate --watchThis re-generates the client automatically whenever models or content change under .contentrain/. Recommend running it alongside the framework's dev server.
For convenience, suggest adding a script to package.json:
{
"scripts": {
"contentrain:watch": "contentrain generate --watch"
}
}.contentrain/client/ is git-ignored (it is generated output, like Prisma's client). That means a fresh clone or CI checkout has no client, so any #contentrain import fails at typecheck/build until generate runs.
Wire generation into the build lifecycle so it always runs before a build:
{
"scripts": {
"prebuild": "contentrain generate",
"predev": "contentrain generate"
}
}prebuild/predev run automatically before build/dev (npm/pnpm lifecycle), so CI and teammates regenerate the client without a manual step.postinstall hook, but prebuild/predev are preferred (they don't run on every dependency install and stay close to when the client is actually needed).prebuild hook covers CI and fresh clones.Report to the user:
.contentrain/client/ contents.#contentrain is ready to use.index.d.ts.query from #contentrain and start querying content.contentrain generate after model or content changes.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.