detect-stack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited detect-stack (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scan the current project to detect its technology stack, map it to installed rad-* plugins, identify gaps, configure stack-aware development guidance, and generate team settings.
Announce at start: "Scanning your project to detect the tech stack, configure guidance, and map to available skills..."
Read package.json from the project root. Extract:
name (project name)dependencies (runtime dependencies)devDependencies (development dependencies)If no package.json exists, note this and continue with file-based detection only.
Use Glob to check for these files in the project root:
astro.config.*
next.config.*
tailwind.config.*
tsconfig.json
wxt.config.*
Dockerfile
docker-compose.*
compose.*If manifest.json exists in the project root (or common extension paths like src/manifest.json, extension/manifest.json), read it and check for the manifest_version field. Only classify as Chrome Extension if manifest_version is present.
Use Glob to check if the project contains .tsx, .jsx, or .astro files:
**/*.tsx
**/*.jsx
**/*.astroIf any exist, the project has UI components (relevant for accessibility).
Using the detection rules in references/technology-map.md, compile a list of detected technologies. For each, note:
Based on detected technologies, classify the project type:
Using references/technology-map.md, map each detected technology to:
/review-for-shipRead .claude/stack-profile.local.md if it exists. If found:
--update, proceed to overwriteCreate (or update) .claude/stack-profile.local.md.
First, ensure the .claude/ directory exists. If .gitignore exists, check if *.local.md is already ignored. If not, suggest the user add .claude/*.local.md to .gitignore.
File format:
---
detected: YYYY-MM-DD
project_name: [from package.json name or directory name]
project_type: [classified type]
technologies:
- name: [tech]
version: "[version or 'detected']"
source: "[detection method]"
plugins:
core:
- [plugin-name]
supporting:
- [plugin-name]
pre_ship:
- [plugin-name]
final_gate:
- rad-code-review
review_agents:
- name: [agent-name]
subagent_type: "[full subagent type string]"
---
# Stack Profile: [project name]
## Detected Technologies
- **[Tech Name] [version]** — [one-line description of what it is] (detected via [source])
## Plugin Guide
### Core — Use During Development
These plugins match your project's primary technologies. Their skills should be consulted when writing code.
- **[plugin-name]** — [what it helps with]. Key skills: [list 2-3 most relevant skills]
### Supporting — Use When Relevant
These plugins apply broadly. Consult them when touching related code.
- **[plugin-name]** — [what it helps with]. Key skills: [list 1-2 most relevant skills]
### Pre-Ship — Run Before Deploying
These review agents will be dispatched when you run `/review-for-ship`.
- **[agent-name]** — [what it checks for]
### Final Gate
After all specialist reviewers complete, rad-code-review runs as the generalist final gate covering AI slop detection, architecture, release readiness, and general security.After writing the profile, check which rad-* plugins from the profile are actually available in this environment. For each plugin listed in plugins.core, plugins.supporting, and plugins.pre_ship:
## Plugin Status
### Installed
✓ rad-react — React best practices, hooks rules, accessibility, security
✓ rad-typescript — Strict mode, type safety, API boundaries
### Recommended (Not Installed)
✗ rad-nextjs — Server Actions security, App Router patterns, middleware bypass protection
✗ rad-a11y — WCAG 2.2 AA compliance, ARIA patterns, keyboard navigation
To install missing plugins from the rad-claude-skills marketplace:
claude plugins install rad-nextjs@rad-claude-skills
claude plugins install rad-a11y@rad-claude-skillsAll recommended plugins are installed. ✓Unless the user passed --skip-claude-md, offer to add stack-aware guidance to the project's CLAUDE.md.
CLAUDE.md from the project root (if it exists)## Stack Guidance section"Want me to add stack guidance to your CLAUDE.md? This helps Claude proactively use the right skills for your stack."
Generate dynamically based on detected technologies. Only include routing rules for technologies that were actually detected:
## Stack Guidance
This project uses [comma-separated tech list with versions].
Stack profile: .claude/stack-profile.local.md
### Skill Routing
When working on this project, consult these skills proactively:
- **React components** (`*.tsx`, `*.jsx` with JSX): use rad-react skills (react-foundations, react-performance, react-security)
- **Next.js patterns** (`app/` directory, Server Actions, Route Handlers): use rad-nextjs skills (nextjs-best-practices, nextjs-security)
- **TypeScript code** (`*.ts`, `*.tsx`): use rad-typescript skills (typescript-strict-mode, typescript-api-safety)
- **Fastify server code** (routes, plugins, hooks): use rad-fastify skills (fastify-best-practices, fastify-schemas-validation)
- **Astro pages and components** (`*.astro`, `src/pages/`): use rad-astro skills (astro-best-practices, astro-performance)
- **Accessibility** (any UI components, ARIA, forms, keyboard): use rad-a11y skills (a11y-semantic-html, a11y-aria-patterns)
- **Chrome Extension** (manifest, content scripts, service worker): use rad-chrome-extension skills (chrome-ext-best-practices, chrome-ext-security)
- **Zod schemas** (validation, parsing, type inference): use rad-zod skills (zod-schema-design, zod-security)
### Before Shipping
Run `/review-for-ship` for comprehensive stack-aware review with specialist reviewers + rad-code-review as final gate.## Stack Guidance sectionUnless the user passed --skip-settings, offer to generate or update .claude/settings.json with enabledPlugins.
.claude/settings.json if it existsenabledPlugins key already exists{
"enabledPlugins": {
"rad-stack-guide@rad-claude-skills": true,
"[each core plugin]@rad-claude-skills": true,
"[each supporting plugin]@rad-claude-skills": true
}
}.claude/settings.json already exists, merge the enabledPlugins field — preserve all other settingsrad-claude-skills marketplace"Want me to generate .claude/settings.json with enabledPlugins for your team? When teammates trust this project folder, they'll be prompted to install: [list]"
Display a clear, friendly summary:
## Stack Configured!
**Project:** [name]
**Type:** [project type]
### Technologies Found
[Table or bullet list of technologies with versions]
### Skills That Apply to This Project
**Core (always active):**
- rad-[name] — [one-sentence explanation]
**Supporting (when relevant):**
- rad-[name] — [one-sentence explanation]
**Pre-Ship Review:**
- [agent-name] — [what it checks]
**Final Gate:**
- rad-code-review — AI slop detection, architecture, security, release readiness
### What's Configured
- ✓ Stack profile saved to `.claude/stack-profile.local.md`
- ✓ / ✗ CLAUDE.md updated with skill routing rules
- ✓ / ✗ Team settings generated at `.claude/settings.json`
- [If gaps:] ⚠ [N] recommended plugins not installed (install commands above)
### What This Means
[2-3 sentences explaining how this changes the development experience.]package.json in packages/ or apps/ directories. Create a single profile noting the full stack across all packages.rad-react skills partially apply (component patterns and JSX similar, hooks and server components differ).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.