Claude Code skill: scan a JS/TS project + interview the user, generate a dual-audience handbook (HTML site for humans, md/json for AI)
SaferSkills independently audited project-handbook (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a complete project handbook with two audiences served by ONE set of files:
docs-site/index.html (via the launch script) — a navigable site witharchitecture diagrams (Mermaid) and a health dashboard.
docs-site/data/*.md and *.json directly — they ARE the site'scontent. There is no separate "AI version" to keep in sync.
The viewer template (index.html, assets/, serve.cjs, launch scripts) is copied once and never modified afterwards. All maintenance happens in data/ only.
Designed for JS/TS projects (npm / pnpm / yarn). For other ecosystems, tell the user the scan phase is JS/TS-specific and offer to proceed with AI-only analysis (no tool data) — health facets that depend on missing tools get status: "unknown".
The handbook content language follows the user's convention: check the user's CLAUDE.md language, the language of their messages, and existing project docs. A Traditional-Chinese-speaking user gets a 繁體中文 handbook; an English speaker gets English. Viewer UI strings and file names stay English. When unsure, ask.
Track phases with the task tools. Phases run in order.
If docs-site/ already exists in the target project, do NOT silently overwrite. Ask the user (AskUserQuestion) with these options, recommending the first:
commit from data/manifest.js. Rungit diff --name-status <baseline>..HEAD and git log --oneline <baseline>..HEAD. If the baseline is unreachable (rebase, squash, shallow clone) or there is no git history, fall back to a full audit of every section.
architecture; package.json scripts, configs, lockfile → dev-guide; API-layer files → integration; setup files → onboarding). Deep-read and fix only the affected sections.
their content and updatedAt untouched; do not re-read them.
health.json (tool-driven, cheap).deployment, collaboration) is not derivable from acode diff — just re-ask previously unanswered "⚠️ To confirm" items.
generatedAt/commit to the new baseline; bump a section's updatedAt only if its content actually changed (see freshness contract, Phase 4).
because the diff proved them unchanged.
If docs-site/ does not exist, continue to Phase 1.
Principle: prefer real tool output; fall back to AI code-reading only when a tool cannot run, and record which sources were actually used in health.json meta.toolsUsed. A facet with no reliable data gets status: "unknown" — never invent numbers.
| Facet | Primary commands | AI fallback |
|---|---|---|
code-health | line counts of tracked source files (git ls-files + count); npx -y knip --no-progress --reporter compact for unused exports/files | read the largest files; note dead/commented-out code seen while reading |
dependencies | npm outdated --json; npm audit --json (or pnpm/yarn equivalents — detect via lockfile) | compare package.json ranges against lockfile |
git-hotspots | git log --since="12 months ago" --pretty=format: --name-only aggregated per file (top ~20); git shortlog -sn; files untouched ≥ 12 months in active dirs | skip facet with unknown if no git history |
testing | count test files (*.test.*, *.spec.*, __tests__/); run coverage only if a coverage script already exists; npx tsc --noEmit if tsconfig present; eslint error count if config present | map test files against key logic areas (payment, auth, data writes) and name untested ones |
Write results into data/health.json following references/health-schema.md. Cross-link insights between facets (e.g. a file that is both oversized AND a git hotspot deserves a warn item saying so).
Read the project deeply enough to produce CORRECT diagrams and a navigable guide: entry points, routing, state management, API layer, module boundaries, build setup. Draft (as Mermaid flowchart) at minimum: a system map (frontend ↔ backend ↔ external services) and a frontend data-flow diagram. Verify every path/name you write actually exists — diagrams with wrong names are worse than no diagrams.
Enumerate once, then batch-ask. Never drip-feed questions one at a time.
(e.g. found an axios baseURL pointing to a domain → ask who owns that backend and where its docs live; found a Dockerfile → ask where images are deployed).
who has access? rollback procedure?
API docs location? auth model?
who decides priorities? release cadence?
logs location?
pointer: who to ask / where to look (e.g. "ask whoever owns the CI config", "check the cloud console billing page"). Collect all of these into a "To-confirm list" in the relevant data file. Never present a guess as fact.
template/ directory →<project>/docs-site/ (creating it). On macOS/Linux also chmod +x docs-site/open-handbook.sh.
data/manifest.js:window.HANDBOOK_MANIFEST = {
project: "<Project Name>",
generatedAt: "<YYYY-MM-DD>", // date of this generation or audit run
commit: "<short hash>", // code baseline this handbook was verified against
language: "<content language code>",
sections: [
{ id: "overview", title: "...", file: "overview.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "architecture", title: "...", file: "architecture.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "dev-guide", title: "...", file: "dev-guide.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "deployment", title: "...", file: "deployment.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "integration", title: "...", file: "integration.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "collaboration", title: "...", file: "collaboration.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "onboarding", title: "...", file: "onboarding.md", type: "markdown", updatedAt: "<YYYY-MM-DD>" },
{ id: "health", title: "...", file: "health.json", type: "health", updatedAt: "<YYYY-MM-DD>" }
]
};Section titles are written in the content language. The list above is the default skeleton — scale to the project: a frontend-only demo with no backend merges integration into architecture; drop collaboration for a solo project. Every section in the manifest must have a corresponding file.
Freshness contract: generatedAt and commit describe the latest run (initial generation OR audit). Each section's updatedAt is the date its CONTENT last changed. On an audit run, update generatedAt/commit always, but bump a section's updatedAt only if you actually edited that file — sections verified-but-unchanged keep their old updatedAt. The viewer shows "Updated <updatedAt> · verified at <commit>" under each page title.
data/*.md files. Content guide:overview.md — what the project is, who uses it, what problem it solves. Mostlyinterview-sourced.
architecture.md — the Phase 2 diagrams + module map table with real paths.dev-guide.md — how to run it locally (verified commands), conventions, branchstrategy.
deployment.md — where it runs, how releases happen, capacity. Interview-sourced;this is where most ⚠️ To confirm items usually live.
integration.md — upstream APIs, external services, who owns them. Scan + interview.collaboration.md — design handoff, review rules, team workflow. Interview-sourced.onboarding.md — a new developer's day one: environment → run it → make a firstsmall change (point at a real, easy file).
file:line references for code pointers; do not paste long code excerpts.
data/health.json from Phase 1 results (schema: references/health-schema.md).## Project handbook
`docs-site/data/` holds this project's handbook as markdown/JSON — read it for
architecture, deployment, and team context. Humans: run `docs-site/open-handbook.bat`
(Windows) or `docs-site/open-handbook.sh` (macOS/Linux) to browse it.node docs-site/serve.cjs 8787, background) and verify:/, /data/manifest.js, and every file referenced in the manifest return 200.
health pages and confirm Mermaid diagrams rendered as SVG (not raw text). Otherwise, tell the user to open the handbook and check the diagrams.
file:line and path references in the data files against the real code.complete ⚠️ To-confirm list with its "who to ask / where to look" pointers.
unknown, and meta.toolsUsed reflects reality.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.