hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin bundling 37signals-style Ruby on Rails skills, a rails-core gotchas skill, and a Rails-detection session hook.
rails-toolkit:<name>)ps with severity-appropriate Rails.logger calls. Wraps thoughtbot's vendored clean-rspec-output skill.Api::BaseController setup, namespace versioning, Jbuilder/Blueprinter serialization, CORS with rack-cors, offset (pagy) and keyset/cursor pagination, standardized JSON error responses, authentication guidance, and request-spec/Minitest patterns.Many code examples are extracted from 37signals' Fizzy codebase and STYLE.md; they illustrate the patterns and are not files in this repository or yours.
bin/rails-detect-hook): when a session opens in a Rails project (a Gemfile that requires the rails gem), injects a reminder to consult rails-toolkit:rails-core and the other rails-toolkit:rails-* skills.bin/rubocop-autocorrect-hook): after Claude edits a Ruby file, runs RuboCop safe-autocorrect on it and reports any remaining offenses back as context. Self-guarding — only acts on .rb/.rake/.gemspec files in a project that opted into RuboCop (a .rubocop.yml) with a resolvable runner; no-ops silently everywhere else, and never blocks. See rails-toolkit:rails-style §10 for the stronger project-local Stop-hook variant.rails-upgrade and upgrade-cleanup skills via plugin.json's skills path.rails-clean-test-output; not registered directly, the wrapper skill reads it. Update either with git submodule update --remote <path> and commit the new pointer.This plugin lives in ~/.claude/skills/rails-toolkit/ and auto-loads as rails-toolkit@skills-dir. Its skills are namespaced rails-toolkit:<name>.
Clone with submodules (or run git submodule update --init --recursive after cloning) so the vendored skills above are present.
Skills load on demand by name (rails-toolkit:<name>) and trigger from their descriptions, so in a Rails project Claude reaches for them automatically — start with rails-toolkit:rails-core. You can also invoke one explicitly, e.g. to clean up a noisy suite:
/rails-toolkit:rails-clean-test-outputTooling is pinned with mise and pre-commit checks run via hk. Set up and verify:
mise trust && mise install # provision hk, shellcheck, shfmt, uv, node, gitleaks (per mise.lock)
hk install # install the git pre-commit hook
hk run check # lint + audits + gitleaks + large-file guard
uv run pytest # exercise the bin/ hook scripts as subprocessesThe same checks run in CI (.github/workflows/ci.yml). Bump the plugin version in .claude-plugin/plugin.json on every commit (patch for fixes, minor for new skills/tools).
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.