add-resource — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-resource (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Append a user-supplied resource to CLAUDE.md's canonical ## Resources section so it becomes part of the project's permanent state and is surfaced by /startup on every new session.
This skill only writes to CLAUDE.md at the project root. It never touches other files.
Cross-model note. Model-agnostic. Always use targeted Edit operations to insert single lines rather than Write to rewrite the whole file — whole-file rewrites churn trailing whitespace and line endings on Windows, inflate diffs, and risk clobbering manual edits the user made between sessions.
Extract from the user's message:
MCPs — MCP servers (e.g., "supabase", "coolify", "stripe")Stack CLIs — command-line tools available for this project (e.g., "supabase CLI", "gh", "wrangler")Scripts — npm/pnpm/make targets worth rememberingNotes — freeform resource notes that don't fit above (e.g., "API docs at https://...", "staging DB creds in 1Password item 'X'")If the user's message is ambiguous (e.g., just "remember this"), ask one clarifying question:
Which category? MCP server, CLI tool, script, or a freeform note?
Do not proceed until the category is clear.
Read CLAUDE.md at the project root.
# [Project Name — from directory name]
## Tech Stack
[TBD]
## Conventions
[To be established]
## ResourcesThen proceed to Phase 3.
## Resources section at the end of the file (after the last existing section). Use this structure: ## Resources
**MCPs:**
**Stack CLIs:**
**Scripts:**
**Notes:**Only include the sub-buckets that will have content. Empty sub-buckets can be omitted — re-add them when needed.
## MCP, ## Tools, ## CLI Tools): use the existing section as-is — do not rename it. Respect the user's chosen heading. Add the new entry under the most appropriate sub-bullet or create one.Within the Resources section, organize entries using bold sub-labels, not sub-headings, so the section stays scannable:
## Resources
**MCPs:**
- `supabase` — Supabase MCP server; use for DB queries, migrations, edge function deploys
- `coolify` — Coolify MCP; deploy, logs, env vars for this project's staging/prod
**Stack CLIs:**
- `supabase` — local DB, migrations, types generation
- `gh` — PR management, issue triage
- `docker` — local compose stack
**Scripts (pnpm):**
- `dev` — start local dev server
- `test` — run vitest
- `typecheck` — tsc --noEmit
**Notes:**
- Staging DB credentials: 1Password vault "Project X" → item "Staging DB"
- API docs: https://docs.example.com/api/v2Format rules:
Before writing, scan the target sub-bucket for an existing entry with the same name:
"<name>" is already registered under <category>."<name>" already exists with description "<old>". Replace with "<new>"? (yes/no)Use Edit to insert the new line at the bottom of the correct sub-bucket. Do not use `Write` to rewrite the entire CLAUDE.md — targeted Edit preserves everything else byte-for-byte. If the sub-bucket does not yet exist within the Resources section, add it (still via Edit, anchored on the section heading) in the order: MCPs → Stack CLIs → Scripts → Notes.
After writing, present the diff compactly:
Added to CLAUDE.md Resources:
**MCPs:**
+ `stripe` — Stripe MCP; billing, subscriptions, webhook inspection
Saved. /startup will include this in future session briefings.If the user asks to add several resources in one request (e.g., "remember we have supabase MCP, stripe MCP, and the gh CLI"), process them as a batch:
Edit if possible Added to CLAUDE.md Resources:
**MCPs:**
+ `supabase` — ...
+ `stripe` — ...
**Stack CLIs:**
+ `gh` — ...
Saved 3 resources. /startup will include these in future session briefings.End with one line:
Saved. Run /startup next session to see it in the briefing.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.