kickjs-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kickjs-skill (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude skill for working with KickJS — the decorator-driven Node.js framework on Express 5 + TypeScript.
The skill auto-detects which mode applies and loads the matching guidance:
@forinda/kickjs*. See adopter.md for the full reference.forinda/kickjs monorepo itself. See contributor.md for the full reference.SKILL.md.git clone https://github.com/forinda/kickjs-skill ~/dev/kickjs-framework-skill
~/dev/kickjs-framework-skill/scripts/install.shSymlinks the skill into ~/.claude/skills/kickjs-skill. Restart your Claude Code session to pick it up.
~/dev/kickjs-framework-skill/scripts/install.sh --copy # frozen snapshot
~/dev/kickjs-framework-skill/scripts/install.sh --uninstall # remove
CLAUDE_SKILLS_DIR=/some/path scripts/install.sh # custom destinationWhen Claude detects you're in a KickJS context (a kick.config.ts, an @forinda/kickjs* import, a *.module.ts file, a mention of "KickJS", or you're inside the kickjs monorepo) it loads the skill and applies the framework's conventions.
A few examples of what changes:
kick g module <name> and confirms *.module.ts naming, the typed defineModule({ controllers, routes }) shape, and registration in src/modules/index.ts. Avoids the silent-breakage trap of naming the entry index.ts (full-restart on every save instead of HMR).defineAdapter() factory with the right hooks for the job (beforeMount for routes that bypass the middleware stack, middleware() with explicit phase, shutdown() for resource cleanup). Won't write a class implements AppAdapter — that pattern was dropped in v4.defineHttpContextDecorator({ key: 'tenant', deps, resolve }) instead of @Middleware(). Adds the ContextMeta augmentation. Reads via getRequestValue('tenant') from services. Never reaches for the internal requestStore.getStore() API.pnpm add @forinda/kickjs-cron (the wrapper was dropped in v5).Container.create() per test, never Container.getInstance().reset(). Suggests the in-memory repository pattern when relevant.shutdown() hook on the right adapter, mentions bootstrap({ processHooks }) if a third-party SDK (OTel / Sentry) needs to own the signal handler.The skill ships ~50 categorised links into the canonical KickJS docs — when you ask about a specific topic, Claude will reach for the right guide rather than improvising.
kickjs-framework-skill/
├── .claude-plugin/
│ └── plugin.json Plugin manifest for marketplace install
├── skills/
│ └── kickjs-skill/
│ ├── SKILL.md Always-loaded — mode detection + invariants
│ └── references/
│ ├── adopter.md Loaded in adopter mode
│ └── contributor.md Loaded in contributor mode
├── scripts/
│ └── install.sh symlink / --copy / --uninstall
├── CHANGELOG.md Versioned change log
├── README.md This file
└── LICENSE MITDirect links to the skill content:
skills/kickjs-skill/SKILL.md — mode detection + 8 universal invariants (defineAdapter factories, slash-delimited tokens, Container.create(), getRequestValue, contributors over middleware, BYO recipes, factory-call parens, per-request middleware order, RequestContext 3-instance model, DI scope rules, dependsOn failing at boot).skills/kickjs-skill/references/adopter.md — project shape, critical wiring rules, decorator surface beyond the basics, adapter lifecycle hooks, plugin contributors, validation behaviour, the two middleware signatures, built-in middleware roster, testing patterns, 53 categorised guide URLs, and 12 silent-breakage pitfalls.skills/kickjs-skill/references/contributor.md — repo shape, the packages/core / packages/http deletion rule, build pipeline (Vite + tsc), Vite invariants, lockstep versioning, package add/remove flow, CLI generator extension, BYO doc invariants, doc-ownership map, code style, branching, examples-are-scaffolded rule, lint:tokens, off-roadmap items.Claude loads skills via progressive disclosure:
SKILL.md. Adopter projects never load contributor guidance and vice versa.This keeps the always-on cost small. The full skill is 824 lines but Claude only carries ~190 of them by default.
| KickJS version | Skill version |
|---|---|
| v5.x | 0.1.x (current) |
| v4.x | 0.1.x (downgrade docs URLs to /v4/, otherwise compatible) |
| v3.x and earlier | not supported |
Designed for Claude Code 1.x with Skills support. Should also work in any Claude runtime that loads ~/.claude/skills/<name>/SKILL.md — Codex CLI, Gemini CLI, Copilot CLI all have skill-equivalent mechanisms covered by the Anthropic skill spec.
cd ~/dev/kickjs-framework-skill && git pullIf you symlinked (default), the skill is now updated. If you --copy'd, also run scripts/install.sh --copy again to refresh.
The skill version (in .claude-plugin/plugin.json) is independent of KickJS version. Bumps follow semver:
0.1.x) — clarifications, new pitfalls, additional guide links.0.x.0) — new reference files, restructured guidance, new mode.x.0.0) — incompatible with the prior KickJS major (e.g. when KickJS v6 ships, the skill v1 cutover happens with it).See CHANGELOG.md for release notes.
kick g module foo, but the kick binary has to come from your project's @forinda/kickjs-cli install.CLAUDE.md / AGENTS.md always wins when it disagrees with the skill — the skill says so explicitly and surfaces the disagreement.The skill lives in its own repo (separate from forinda/kickjs) so the framework monorepo stays focused on the framework. PRs welcome — particularly:
description frontmatter (the field that controls when Claude reaches for the skill).adopter.md should match the current docs site structure.To verify locally:
git clone https://github.com/forinda/kickjs-skill && cd kickjs-framework-skill
scripts/install.sh # symlink into ~/.claude/skills/
# Make edits in skills/kickjs-skill/, restart Claude, prompt with a KickJS question.Open a PR with the rule, the source signal that justifies it (production incident / user complaint / framework change link), and ideally a test prompt the skill should now handle correctly.
MIT — Copyright © 2026 Felix Orinda.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.