using-halal-investing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-halal-investing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are the front door of the Halal Terminal plugin. Triggered by any Shariah-investing / halal-finance intent. Do NOT do the work yourself — route to the right sub-skill.
Every downstream sub-skill needs the Halal Terminal MCP. If the user has no API key, the MCP cannot answer and the sub-skills will fail. Your job is to catch this BEFORE routing and walk them through setup — quickly, without lecturing.
Check both credential locations, in order:
~/.claude/halalterminal/credentials — look for HALALTERMINAL_API_KEY=ht_... (length ≥ 20).~/.claude/settings.json → pluginConfigs["halalterminal-claude-skills@halalterminal-claude-skills"].mcpServers.halalterminal.HALALTERMINAL_API_KEY.If EITHER location has a valid-looking `ht_`-prefixed key, proceed to routing.
If NEITHER does, do the setup flow inline. Do NOT route. Do NOT explain methodologies. Do NOT mention that a skill "can't run" — just help them get set up:
You'll need a free Halal Terminal API key first — takes about 30 seconds.
>
1. Open https://api.halalterminal.com and drop your email in the Get your free API key in seconds panel. (Free plan, no credit card.) 2. Check your inbox for a key starting with ht_. 3. Paste it below and I'll take it from there.Then: "Paste your Halal Terminal API key:"
When the user replies, follow the full commands/halal-setup.md flow:
ht_ prefix, length ≥ 20, no whitespace).curl -H 'X-API-Key: <key>' https://api.halalterminal.com/api/education/methodologies (need HTTP 200).~/.claude/halalterminal/credentials (with chmod 700 on dir, chmod 600 on file) AND ~/.claude/settings.json under the pluginConfigs path.After setup completes, do not silently continue — the MCP bridge typically needs a restart. Tell the user to re-ask their original question after the restart.
references/disclaimer.md once per session and apply its hard rules for every downstream output.references/audience-rendering.md.| User intent | Route to |
|---|---|
| "Is X halal?", "Screen X", "Compliance of X" | halal-verdict |
| "Audit my portfolio", "Screen these holdings" | halal-portfolio-audit |
| "Build me a halal portfolio", "Construct a Shariah basket", "Halal DCA plan" | halal-portfolio-builder |
| "Is <ETF> halal?", "Halal ETFs for <theme>" | halal-etf-analysis |
| "Calculate zakat", "Purification for my dividends" | halal-zakat |
| "Explain <methodology>", "Difference between <X> and <Y>", "Which methodology should I use" | halal-methodologies |
| "News on X's compliance", "Filings affecting my holdings" | halal-news-watch |
| "My halal watchlist", "Add X to watchlist" | halal-watchlist |
If the intent is ambiguous, ask one clarifying question with multiple-choice options covering the top 2–3 candidates.
If the user says audience: retail|advisor|scholar mid-session, propagate this to every downstream skill for the remainder of the session.
Three cases — otherwise always route:
/halal-doctor, do not call any sub-skill./halal-doctor.If a downstream sub-skill reports an auth failure (HTTP 401/403 from the MCP), the stored key may have been rotated or revoked. Do not let the sub-skill blather — intercept and say:
The stored Halal Terminal key was rejected by the API. Let's refresh it — same 30-second flow.
Then run the Step 0 setup flow again.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.