Claude — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude (MCP Server) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Custom configuration for Claude Code that turns it into a disciplined engineering partner with structured workflows, strict guardrails, and domain-specific expertise.
Out of the box, Claude Code is capable but generic. This repo adds opinionated defaults: a research -> grill -> build -> ship workflow, security boundaries, code standards, and 16 expert subagents that spawn based on task context. The result is more consistent, reviewable, and safe output.
The whole config is symlinked into ~/.claude/, so edits to this repo apply to every Claude Code session. It contains global rules (CLAUDE.md, rules/), automation hooks, slash commands, subagent personas, and reusable workflow skills.
# Clone the repo - the setup script auto-detects its own location
git clone [email protected]:domengabrovsek/claude.git
cd claude
# Dry-run first to see what would change, then apply
bash scripts/setup-symlinks.sh --check
bash scripts/setup-symlinks.sh
# Strip ephemeral state Claude Code writes to settings.json at runtime
git config filter.strip-ephemeral-state.clean 'jq "del(.feedbackSurveyState)" 2>/dev/null || cat'
git config filter.strip-ephemeral-state.smudge catRe-runs are safe: existing files are backed up to <path>.bak.<timestamp> before being replaced. A SessionStart hook warns if a symlink drifts later.
@-imported into CLAUDE.md.rules/agent-routing.md; full list in docs/agents.md. See ADR 0003./<skill> workflows (/grill-with-docs, /build, /ship, /debug, …). Skills marked (mattpocock) are vendored from mattpocock/skills./research, /verify-done, /worktree, …).settings.json for PreToolUse, PostToolUse, SessionStart, SessionEnd events.setup-symlinks.sh, statusline.sh, notify.sh, worktree-prune.sh).RTK.md.settings.json..github/workflows/).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.