util-projectsync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited util-projectsync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Synchronize project folder structure, PRD.md, and BUG.md files to match the canonical structure defined in CLAUDE.md. Validates dependencies before syncing.
This skill requires no arguments. All configuration is read from CLAUDE.md in the project root.
| Section | Purpose |
|---|---|
# Custom Applications | List of custom applications to create folders for and validate |
# Supporting 3rd Party Applications | List of 3rd party applications referenced as dependencies |
## External Services | External services (SMTP, Push Notifications, AI, WAF, etc.) referenced as dependencies |
# Modules | Module definitions grouped under ## System Module and ## Business Module |
# Custom Applications section in CLAUDE.md## <Application Name> heading under the section**No Custom Applications** or similar "none" indicator, report that there are no applications to sync and stop# Supporting 3rd Party Applications section in CLAUDE.md## <Application Name> heading under the section**No Supporting 3rd Party Applications** or similar "none" indicator, treat as having zero 3rd party applications## External Services sub-section in CLAUDE.md. It may appear under # Environment, under # Supporting 3rd Party Applications, or as a standalone section — search the whole document.## External Services until the next top-level (#) heading. They typically appear at ## <Service Name> level (siblings of ## External Services), but may also appear at ### <Service Name> level — accept either.# Modules section in CLAUDE.md## System Module and ## Business Module subsections# Modules wrapper. Do not skip modules just because they use ### — ### is the correct and expected level.### <Name> heading that appears between a ## System Module / ## Business Module heading and the next ## or # heading. Treat siblings to the tier heading (not just immediate children in an outline sense) as in-scope. A module may be the first, last, or any-position heading in the list.**There is no System Module** or **There is no Business Module** or similar "none" indicator, treat that category as having zero modules.#### Heading-Level Mapping Reference
Modules live at different heading levels in different files. Match them by name, not heading level:
| File | Parent heading | Module heading | Example |
|---|---|---|---|
| CLAUDE.md | ## System Module / ## Business Module (nested under # Modules) | ### <Module> — three hashes | ### Support Ticket |
| PRD.md | # System Module / # Business Module (top-level) | ## <Module> — two hashes | ## Support Ticket |
| BUG.md | # System Module / # Business Module (top-level) | ## <Module> — two hashes | ## Support Ticket |
When comparing module names across files, strip heading hashes and whitespace, and compare case-insensitively. A ### Support Ticket in CLAUDE.md is the same module as ## Support Ticket in PRD.md/BUG.md.
#### Pre-Flight Module Count
After parsing CLAUDE.md, print a one-line confirmation of what was detected before proceeding to PRD.md/BUG.md sync, so a missed module is caught immediately:
[Module Detection] System Modules: <count> — <comma-separated names>
[Module Detection] Business Modules: <count> — <comma-separated names>If a module the user expects to see is missing from this line, stop and investigate CLAUDE.md heading levels before continuing.
Read CLAUDE.md from the project root and extract:
## <Name> headings under # Custom Applications## <Name> headings under # Supporting 3rd Party Applications## <Name> headings under ## External Services### <Name> heading (three hashes) appearing between ## System Module and the next ## or # heading. Do not look for ## <Name> — that level is reserved for the tier heading itself.### <Name> heading (three hashes) appearing between ## Business Module and the next ## or # heading.After collecting both lists, emit the pre-flight module count line (see Module Detection → Pre-Flight Module Count). If the count is lower than expected for this project, stop and re-check heading levels before syncing — silently skipping a module that was incorrectly parsed is the primary failure mode this step guards against.
Run all validation checks across # Custom Applications, # Supporting 3rd Party Applications, and ## External Services. Collect all issues found. After all checks are complete, insert [TODO] annotations into CLAUDE.md for each issue.
#### 2a. Dependency Validation
For each application (custom and 3rd party) that has a - Depends on: section, extract its dependency list. Each dependency is a bullet item under "Depends on:" — the dependency name is the text before any parenthetical qualifier or "for"/"to"/"when" clause.
Check 1: No Circular Dependencies
Build a directed dependency graph from all applications. Detect cycles using depth-first traversal. A circular dependency exists when application A depends on B, and B depends (directly or transitively) on A.
Example of a circular dependency:
For each cycle found, record the full cycle path (e.g., Hub Middleware -> HC Adapter Message Queue -> Hub Single Sign On -> Hub Middleware).
Check 2: All Dependencies Exist
For each dependency listed, verify that a matching entry exists in # Custom Applications, # Supporting 3rd Party Applications, or ## External Services. Match by name, case-insensitively. The dependency name may include a database name qualifier in parentheses (e.g., Hub Support Database (urp_hub_kc)) — match against the application/service name only (e.g., Hub Support Database).
Check 3: Dependencies Are Logical and Consistent
Check for logical issues:
Hub Cache listed twice under Hub Middleware)Check 4: No Orphaned Services or 3rd Party Applications
For each application in # Supporting 3rd Party Applications and each service in ## External Services, check whether at least one custom application (from # Custom Applications) lists it in its - Depends on: section. Match by name, case-insensitively, stripping parenthetical qualifiers.
Flag any 3rd party application or external service that is not depended on by any custom application. These are orphaned — they are defined in CLAUDE.md but no custom application uses them, which may indicate a missing dependency declaration or a service that is no longer needed.
#### 2b. Insert TODO Annotations into CLAUDE.md
For each validation issue found, insert a [TODO] annotation line immediately above the ## <Application Name> heading of the affected application in CLAUDE.md.
Format:
- [TODO] <CATEGORY>: <description>
## <Application Name>Categories:
| Category | Code |
|---|---|
| Circular Dependency | CIRCULAR_DEP |
| Missing Dependency | MISSING_DEP |
| Duplicate Dependency | DUP_DEP |
| Self Dependency | SELF_DEP |
| Illogical Dependency | ILLOGICAL_DEP |
| Orphaned Service | ORPHANED_SVC |
Examples:
- [TODO] CIRCULAR_DEP: Circular dependency detected: Hub Middleware -> HC Adapter Message Queue -> Hub Single Sign On -> Hub Middleware
- [TODO] MISSING_DEP: Dependency "Hub Analytics" does not exist in Custom Applications, Supporting 3rd Party Applications, or External Services
- [TODO] DUP_DEP: Dependency "Hub Cache" is listed more than once
- [TODO] ORPHANED_SVC: No custom application depends on this service
## Hub MiddlewareNote: If an application has multiple issues, insert multiple [TODO] lines above its heading — one per issue.
For each application in the # Custom Applications list:
snake_case for the folder name (e.g., "Hub Middleware" -> hub_middleware)1_hub_middleware)Note: Folders are only created for Custom Applications, not for Supporting 3rd Party Applications.
For each custom application folder:
#### 4a. PRD.md Does Not Exist
Create a new PRD.md inside the application folder using the template below:
# System Module section with all system modules from CLAUDE.md# Business Module section with all business modules from CLAUDE.md### User Story, ### Non Functional Requirement, ### Constraint, ### Reference, ### Test — all versioned with [v1.0.0]#### 4b. PRD.md Already Exists
# Context and # System Module:# Design System# Architecture Principle# High Level Process FlowFor each section that is missing, insert it at the correct position (after # Context and before # System Module, in the order listed above) using the placeholder content from the PRD.md template. Record the addition for the summary output.
For each section that already exists, do nothing — never modify existing content.
## <Module Name>) under # System Module, # Business Module, and (if present) # Deprecated Modules. For deprecated headings like ## ~~<Module>~~ [DEPRECATED], strip the strikethrough markers and [DEPRECATED] tag to obtain the canonical module name for comparison.# Deprecated Modules): Restore it. Remove the ~~...~~ strikethrough and [DEPRECATED] tag from the heading, remove the _Was: System Module_ / _Was: Business Module_ hint line directly below the heading, and move the entire module block (heading through its closing ---) back to the end of its original parent section (# System Module or # Business Module, per the hint). Preserve all existing content (user stories, NFRs, versions). Record the restoration for the summary.# System Module or # Business Module) using the template structure with empty versioned subsections [v1.0.0]## <Module> to ## ~~<Module>~~ [DEPRECATED], insert an italic hint line _Was: System Module_ or _Was: Business Module_ immediately below the heading (so the original tier is recoverable), and move the entire module block (heading through its closing ---) to a # Deprecated Modules section at the end of the file. If # Deprecated Modules does not yet exist, create it (see Deprecated Modules Template). Do not touch the inner subsections or version tags — only the heading is marked, and the block is relocated. Record the deprecation for the summary output.# System Module or # Business Module (not under # Deprecated Modules), check whether it contains a ### Test subsection. If the ### Test subsection is missing, insert it after the last existing standard subsection (### Reference) and before the --- separator that ends the module section, using the template: ### Test
[v1.0.0]Record the addition for the summary output. If the ### Test subsection already exists, do nothing — never modify existing content. Deprecated modules are skipped for this check.
For each custom application folder:
#### 5a. BUG.md Does Not Exist
Create a new BUG.md inside the application folder using the template below:
# Common Module section# System Module section with all system modules from CLAUDE.md# Business Module section with all business modules from CLAUDE.md#### 5b. BUG.md Already Exists
## <Module Name>) under # System Module, # Business Module, and (if present) # Deprecated Modules. For deprecated headings like ## ~~<Module>~~ [DEPRECATED], strip the strikethrough markers and [DEPRECATED] tag to obtain the canonical module name for comparison.# Deprecated Modules): Restore it. Remove the ~~...~~ strikethrough and [DEPRECATED] tag from the heading, remove the _Was: ..._ hint line, and move the block back to the end of its original parent section (# System Module or # Business Module, per the hint). Preserve all existing bug content and version tags. Record the restoration for the summary.## <Module> to ## ~~<Module>~~ [DEPRECATED], insert an italic hint line _Was: System Module_ or _Was: Business Module_ immediately below the heading, and move the entire module block (heading through its closing ---) to a # Deprecated Modules section at the end of the file. If # Deprecated Modules does not yet exist, create it (see Deprecated Modules Template). Do not alter bug entries or version tags. Record the deprecation for the summary output.PRD.md and BUG.md files are located inside the application folder. The exact path depends on whether the project uses a context/ subfolder:
<app_folder>/context/ exists, use <app_folder>/context/PRD.md and <app_folder>/context/BUG.md<app_folder>/PRD.md and <app_folder>/BUG.mdFollow the folder structure defined in CLAUDE.md's # Application Folder structure section (or # Folder structure in older projects) to determine the correct path. When the CLAUDE.md specification lists context/ as the home of PRD.md and BUG.md, treat the context/ subfolder path as authoritative and create it if missing before scaffolding the files.
Print a summary of all actions taken, validation results, and warnings:
## Project Sync Summary
### Modules Detected in CLAUDE.md
| Tier | Count | Names |
|------|-------|-------|
| System Module | 7 | Authentication and Authorization, User, Notification, Activities, Audit Trail, Document Management, Batch Job |
| Business Module | 14 | Dashboard, Location Information, Corridor, Recruitment Step, Employer, Recruitment Agent, Industrial Classification, Occupation Classification, Job Demand, Candidate Profile, Recruitment Agent Sync, News and Announcement, Support Ticket, ... |
### Dependency Validation
| Check | Status | Issues |
|-------|--------|--------|
| Circular Dependencies | PASS/FAIL | 0 or description |
| Missing Dependencies | PASS/FAIL | 0 or count |
| Duplicate Dependencies | PASS/FAIL | 0 or count |
| Self Dependencies | PASS/FAIL | 0 or count |
| Illogical Dependencies | PASS/FAIL | 0 or count |
| Orphaned Services | PASS/FAIL | 0 or count |
### Validation TODOs Inserted
| Application | Section | Issues |
|-------------|---------|--------|
| Hub Middleware | Custom Applications | DUP_DEP: "Hub Cache" listed twice |
| Hub Analytics | Supporting 3rd Party Applications | ORPHANED_SVC: No custom application depends on this service |
### Application Folders
| Application | Folder | Status |
|-------------|--------|--------|
| Hub Middleware | hub_middleware | Created |
| HC Adapter | hc_adapter | Already exists |
### PRD.md Sync
| Application | Status | Sections Added | Modules Added | Modules Deprecated | Modules Restored | Test Subsections Added |
|-------------|--------|----------------|---------------|--------------------|------------------|------------------------|
| hub_middleware | Updated | Design System, Architecture Principle | Payment, Billing | Legacy Auth | Activities | User, Notification |
| hc_adapter | Created | (all sections) | (all modules) | - | - | (all modules) |
### BUG.md Sync
| Application | Status | Modules Added | Modules Deprecated | Modules Restored |
|-------------|--------|---------------|--------------------|------------------|
| hub_middleware | Updated | Payment, Billing | Legacy Auth | Activities |
| hc_adapter | Created | (all modules) | - | - |
### Deprecation Notes
- [hub_middleware/PRD.md] Module "Legacy Auth" was removed from CLAUDE.md — soft-deprecated under `# Deprecated Modules` (content preserved).
- [hub_middleware/PRD.md] Module "Activities" is back in CLAUDE.md — restored from `# Deprecated Modules` to `# System Module`.When creating a new PRD.md or adding module sections, use this structure:
# Context
- This document contain user stories, non-functional requirements, constraints and references by module about this application
- The application name can be inferred from the root folder name where this file is located.
- This is a version controlled document, the version is indicated in the square bracket after each section title, and it will be updated whenever there is any change in the content of that section. The versioning format is [v{major}.{minor}.{patch}] where:
- Major version will be updated when there is a significant change in the content that may affect the overall understanding of the module or the system.
- Minor version will be updated when there is a minor change in the content that may affect some details but not the overall understanding of the module or the system.
- Patch version will be updated when there is a small change in the content that does not affect the overall understanding of the module or the system, such as fixing typos or formatting issues.
- For user any item which is no longer valid or applicable, it will be marked with strikethrough and indicated in the new version.
---
# Design System
- No design system defined yet. Refer to a design system specification file if available (e.g., `[DESIGN_SYSTEM.md](reference/DESIGN_SYSTEM.md)`).
---
# Architecture Principle
- No architecture principles defined yet.
---
# High Level Process Flow
- No high level process flows defined yet.
---
# System Module
## {{System Module Name}}
### User Story
[v1.0.0]
### Non Functional Requirement
[v1.0.0]
### Constraint
[v1.0.0]
### Reference
[v1.0.0]
### Test
[v1.0.0]
---
# Business Module
## {{Business Module Name}}
### User Story
[v1.0.0]
### Non Functional Requirement
[v1.0.0]
### Constraint
[v1.0.0]
### Reference
[v1.0.0]
### Test
[v1.0.0]
---When a module exists in CLAUDE.md but not in PRD.md, append this block at the end of the appropriate parent section (before the next # heading or end of file):
## {{Module Name}}
### User Story
[v1.0.0]
### Non Functional Requirement
[v1.0.0]
### Constraint
[v1.0.0]
### Reference
[v1.0.0]
### Test
[v1.0.0]
---When creating a new BUG.md or adding module sections, use this structure:
# Context
- This document contain list of bugs reported by users or testers about this application
- All previously reported bugs have been resolved and merged into the PRD.md as NFRs or constraints.
---
# Common Module
[v1.0.0]
---
# System Module
## {{System Module Name}}
[v1.0.0]
---
# Business Module
## {{Business Module Name}}
[v1.0.0]
---When a module exists in CLAUDE.md but not in BUG.md, append this block at the end of the appropriate parent section:
## {{Module Name}}
[v1.0.0]
---When a module is soft-deprecated (present in PRD.md/BUG.md but removed from CLAUDE.md), it is relocated under a single trailing # Deprecated Modules section. The original tier is preserved in an italic hint line for later restoration.
Section skeleton (created on first deprecation, appended to end of file):
---
# Deprecated Modules
- Modules in this section were present in a prior CLAUDE.md but have since been removed. Content is preserved (not deleted) so that historical user stories, NFRs, constraints, tests, or bug reports remain auditable. If a module returns to CLAUDE.md, the sync skill restores it automatically.
---
## ~~{{Module Name}}~~ [DEPRECATED]
_Was: System Module_
### User Story
[v1.0.0]
... (original content preserved verbatim) ...
---Rules for the deprecation move:
## <Module> heading is rewritten (to ## ~~<Module>~~ [DEPRECATED]) and a single _Was: <tier>_ hint line is inserted directly under it. Everything else inside the module block — subsection headings, version tags, text, tables — is moved verbatim.--- separator that closes the module block moves with it.# Deprecated Modules already exists, append the block to its end rather than creating a second section.[v1.0.0] (or whatever version was already present) followed by any bug entries — move them verbatim.Rules for restoration (module returns to CLAUDE.md):
~~...~~ and [DEPRECATED]).## <Module> and delete the _Was: <tier>_ hint line.# System Module or # Business Module).# Deprecated Modules contains no more module blocks, leave the empty # Deprecated Modules section in place — do not delete it (users may want to see that deprecations have historically occurred). Re-running the skill with all modules active leaves it untouched.[v1.0.0]). These are immutable, including when a module is deprecated or restored.## <Module> heading may be rewritten (for deprecation marking or restoration), and only the _Was: <tier>_ hint line may be inserted or removed by this skill.snake_case.# Custom Applications, not for # Supporting 3rd Party Applications.# Custom Applications.# Custom Applications, # Supporting 3rd Party Applications, and ## External Services.1_hub_middleware matches application "Hub Middleware").# System Module, business modules under # Business Module.---) between module sections.[v1.0.0] as the initial version.# Deprecated Modules if a deprecated block with the same canonical name exists).~~...~~ [DEPRECATED], block relocated under # Deprecated Modules). Content is never destroyed.~~ strikethrough, [DEPRECATED] tag, and surrounding whitespace before comparing against CLAUDE.md entries. Name matching is case-insensitive.[TODO] annotations in CLAUDE.md, insert them immediately above the ## <Application Name> heading — never inside the application's content.[TODO] annotations. If re-running the skill, check for existing [TODO] lines above each application heading and skip if the same issue is already annotated.Hub Support Database (urp_hub_kc) matches Hub Support Database).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.