claudemap-runtime — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claudemap-runtime (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ClaudeMap is a repo-to-architecture-map workflow.
High-level model:
@claudemap-architect to turn that snapshot into a detailed, human-legible graphPublic commands:
/setup-claudemap: build or rebuild the map for the current repository/open-claudemap: reopen the existing UI without rebuilding/create-map: create or refresh a scoped subsystem map from the current root graph/refresh: update the graph after code changes/explain: run a guided walkthrough through the live map/show: direct the live map for highlights, focus, presentation, and flowsIf this skill is invoked directly, default to the setup workflow.
Target repository:
$ARGUMENTS as the project root.Execution rules:
${CLAUDE_SKILL_DIR}.${CLAUDE_SKILL_DIR}/skill/commands/snapshot.js for the target project root.${CLAUDE_SKILL_DIR}/skill/prompts/enrichment.txt.@claudemap-architect subagent explicitly. Give it:${CLAUDE_SKILL_DIR}/tmp/claudemap-enrichment.json. Do not run the setup JS command until after this file has been written with non-empty valid graph JSON. Do not run setup in parallel with the subagent call.${CLAUDE_SKILL_DIR}/skill/commands/setup-claudemap.js for the target project root with --enrichment-file ${CLAUDE_SKILL_DIR}/tmp/claudemap-enrichment.json. The setup command is strict: if the file is missing, empty, or unparseable it will exit non-zero and refuse to render a heuristic graph. Do not retry setup without fixing the enrichment file first.--force-refresh only when the user explicitly asks for a fresh rebuild.--enrichment-file — that would render a heuristic graph and pollute the cache. The user should rerun /setup-claudemap once the architect issue is resolved.${CLAUDE_SKILL_DIR}/app/public/graph/ (served by the bundled Vite app as /graph/*).Does this map look right, or should I refine it?claudemap-cache.json graph and file snapshot as context when available instead of starting from a blank prompt again.@claudemap-architect, save the refined JSON to ${CLAUDE_SKILL_DIR}/tmp/claudemap-enrichment.json, and run ${CLAUDE_SKILL_DIR}/skill/commands/refresh.js with --enrichment-file so the graph iterates in place./create-map runs an architect-first scoped pipeline:
${CLAUDE_SKILL_DIR}/skill/prompts/scoped-enrichment.txt. This is a dedicated scoped prompt — do not reuse the root enrichment prompt.cachePath when one exists so the architect can refine rather than rebuild.@claudemap-architect subagent with the scoped snapshot, the scoped prompt, and any user instructions. Instruct it to emit a richer internal breakdown (2-6 internal subsystems, tighter edges, function nodes welcome) and to decide between edit-in-place and rebuild based on the intent of the request.${CLAUDE_SKILL_DIR}/tmp/claudemap-enrichment.json and run ${CLAUDE_SKILL_DIR}/skill/commands/create-map.js with --enrichment-file (plus --scope-json and optional --instructions). The command deletes the tmp file after it reads it.buildScopedGraphFromRoot by running without --enrichment-file, but warn the user the scoped map will be a plain filter view and suggest rerunning with architect enrichment for richer grouping.Does this map look right, or should I refine it?).buildScopedSnapshot's priorGraph option) and rerun the architect. Save the refined JSON to the tmp file and rerun create-map.js with the same --scope-json payload plus --enrichment-file./refresh is change-aware for scoped maps:
meta.source === 'claude-scoped'), the scoped map is preserved untouched — no rebuild, no filter fallback.needsRebuild: true so the next /create-map pass knows to rerun the architect for that scope.stale: true and needsRebuild: true and left for the user to confirm.Important details:
${CLAUDE_SKILL_DIR}./setup-claudemap should treat the @claudemap-architect path as the primary path, not an optional extra.claudemap-architect subagent in .claude/agents/ for system identification, graph refinement, and human-first graph restructuring.--force-refresh./open-claudemap instead of rerunning setup./refresh command shipped in .claude/commands/refresh.md.${CLAUDE_SKILL_DIR}/skill/commands/refresh.js --enrichment-file ... over rerunning setup so the current graph context is reused./show should be treated as a presentation-direction command, not just a low-level transport wrapper.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.