ham-0eccfe — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ham-0eccfe (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to apply the file-based HAM workflow from this repo in Codex. Work through CLAUDE.md, scoped CLAUDE.md files, .memory/*, and .ham/*. Do not introduce MCP-based behavior into this skill.
Current HAM skill version: 2026.02.28
Before any HAM command, check for Pro signals:
.ham/config.json with "pro": trueenabledImporters with more than "claude"**/AGENTS.md filesIf Pro is detected:
go ham in Pro-aware modeham remove because it has its own removal logicHAM Pro detected — this project is managed by HAM Pro. Manage at goham.dev and stopNever create, modify, or delete AGENTS.md files from this skill.
List the supported HAM workflows and what each one does:
go ham: set up HAM and detect project structureham remove: remove HAM safely while preserving Pro-owned filesham update: run bash <skill-dir>/scripts/update.sh and update .ham/versionham status: show version, update status, memory file count, and last setup signalham route: add or update ## Context Routing in root CLAUDE.mdham dashboard: launch the dashboard on port 7777HAM savings: show token and cost savingsham carbon: run the carbon reportham insights: generate actionable inbox items from session dataham benchmark: compare baseline and HAM performanceham baseline start: begin baseline captureham baseline stop: stop baseline capture earlyham metrics clear: clear benchmark data after confirmationham audit: check memory system health.ham/version to 2026.02.28. If outdated, print an update notice. Never block setup.*.xcodeproj or Package.swift: iOSbuild.gradle*: Androidpubspec.yaml: Flutterpackage.json with framework hints: Web or React Nativepyproject.toml or requirements.txt: PythonCargo.toml: Rustgo.mod: GoCLAUDE.md filesPro-aware mode:
CLAUDE.mdAGENTS.mdGenerated structure:
project/
├── CLAUDE.md
├── .ham/
│ ├── version
│ └── metrics/state.json
├── .memory/
│ ├── decisions.md
│ ├── patterns.md
│ ├── inbox.md
│ └── audit-log.md
└── [major code dirs]/CLAUDE.mdGreenfield: create root files only. Brownfield: also create scoped CLAUDE.md files in major code areas.
Append the HAM block to .gitignore if missing:
# HAM - AI agent scaffolding (local, do not commit)
.ham/
.memory/
**/CLAUDE.md
!CLAUDE.md
# end HAMBefore creating files, capture .memory/baseline.json:
{"captured_at":"YYYY-MM-DD","existing_claude_md":{"found":true,"chars":4820,"tokens":1205},"notes":"Migrated from monolithic CLAUDE.md"}If no existing root CLAUDE.md exists:
{"captured_at":"YYYY-MM-DD","existing_claude_md":{"found":false},"estimated_baseline_tokens":7500}Create .ham/metrics/state.json with baseline mode enabled:
{"mode":"baseline","tasks_completed":0,"tasks_target":10,"started_at":"ISO-8601","memory_reads":0,"total_prompts":0}The next 10 non-trivial tasks should log to baseline mode without HAM memory loading. Auto-transition to active after 10 completed tasks.
If root CLAUDE.md is over 3,000 tokens, warn that it is oversized, list sections that should probably move into scoped CLAUDE.md files, and offer migration guidance one section at a time.
Embed these ideas in the generated root CLAUDE.md:
CLAUDE.md before workCLAUDE.md before changesCLAUDE.md has ## Context Routing, use it to find the right scoped file.memory/decisions.md before architectural changes.memory/patterns.md before implementing common functionality.memory/audit-log.md, suggest running oneCLAUDE.md in new directories when they need distinct guidance.memory/inbox.mdCLAUDE.md files excluding the root file.## Context Routing section in root CLAUDE.md.Report:
.ham/version if presentCheck:
CLAUDE.md sizeCLAUDE.md files.memory/ entry countsAppend a short result to .memory/audit-log.md.
Read .memory/baseline.json, estimate token load from all CLAUDE.md and .memory/*.md files, and compare baseline versus current HAM setup. If no baseline exists, show raw counts and tell the user savings percentage requires a real baseline.
Use this calculation model:
root_tokens = count_tokens(read("CLAUDE.md"))
subdir_files = glob("**/CLAUDE.md", exclude="root")
avg_subdir = sum(count_tokens(read(f)) for f in subdir_files) / len(subdir_files) if subdir_files else 0
memory_tokens = sum(count_tokens(read(f)) for f in glob(".memory/*.md"))
state = read_json(".ham/metrics/state.json")
memory_weight = state["memory_reads"] / state["total_prompts"] if state.get("total_prompts", 0) >= 10 else 0.30
ham_tokens = root_tokens + avg_subdir + (memory_tokens * memory_weight)
if exists(".memory/baseline.json"):
baseline_mid = baseline_data["old_claude_md_tokens"] + max(500, len(subdir_files) * 300)
baseline_is_measured = True
else:
code_dirs = count_dirs_with_code()
baseline_mid = max(1000, ham_tokens * 1.5) if code_dirs <= 2 else max(3000, ham_tokens * 2.5) if code_dirs <= 10 else max(5000, ham_tokens * 3.5)
baseline_is_measured = FalseDisplay rules:
.memory/ weighting as estimated until at least 10 prompts are trackedstart: write .ham/metrics/state.json with mode: "baseline"stop: set mode: "active" and report captured tasksEach non-trivial task should log two JSONL entries to .ham/metrics/tasks.jsonl, or baseline.jsonl while baseline mode is active:
{"id":"task-<hex8>","type":"task_start","timestamp":"ISO-8601","description":"...","ham_active":true,"model":"codex","files_read":0,"memory_files_loaded":0,"estimated_tokens":0}
{"id":"task-<hex8>","type":"task_end","timestamp":"ISO-8601","status":"completed"}Skip trivial queries such as HAM commands, yes or no answers, and clarifications.
Baseline mode rules:
mode = "baseline", write to baseline.jsonl, set ham_active: false, skip scoped CLAUDE.md and .memory/ reads, and increment tasks_completed only for completed tasks.mode = "active", or the state file is missing or unparseable, write to tasks.jsonl, set ham_active: true, and use HAM memory normally.Run node <skill-dir>/dashboard/benchmark-cli.js [--days 30] [--model name] [--json].
Run node <skill-dir>/dashboard/launch.js --port 7777 from the project root and tell the user to open http://localhost:7777.
Run node <skill-dir>/dashboard/carbon-cli.js [--last] [--days 30].
Run node <skill-dir>/dashboard/insights-cli.js --days 30, extract actionable items, deduplicate against .memory/inbox.md, append new items, and log the audit event.
Run bash <skill-dir>/scripts/update.sh, then update .ham/version.
Require confirmation before deleting benchmark data.
.memory/*.ham/* except Pro-owned configCLAUDE.md files created by HAMCLAUDE.md.gitignoreSee references/templates.md for starter file shapes and references/platforms.md for platform-specific source roots and brownfield analysis cues.
CLAUDE.md short and global.CLAUDE.md files for purpose, conventions, integrations, patterns, and gotchas that only apply in one subtree..memory/inbox.md into canonical memory without user confirmation..memory/decisions.md..memory/patterns.md..memory/inbox.md.Read references/setup-and-scopes.md when deciding where scoped CLAUDE.md files belong.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.