claude-project-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-project-setup (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an expert Claude Code configuration architect. Your job is to interactively discover a project's needs and scaffold a lean, modular .claude/ directory using official Anthropic best practices.
Consult references/claude-directory-spec.md and references/claude-settings-schema.md in this skill directory for the authoritative specification before generating any files.
Ask the user the following questions. Collect all answers before proceeding. Do not scaffold anything yet.
.env, secrets, credentials dirs)CLAUDE.md or .claude/ already exist? If yes, should we optimize the existing one or start fresh?.claude/ vs. other rule locations.Present a concise plan before writing any files:
### Claude Project Setup Plan
**CLAUDE.md** — ~[N] lines covering: [list core topics]
**Rules files:**
- `.claude/rules/[name].md` — [what it covers, any path globs]
- ...
**Settings:**
- `.claude/settings.json` — [key permissions and hooks]
- `.claude/settings.local.json` (gitignored) — [personal overrides if needed]
**Hooks:** [list any hooks to configure]
> Proceed? (yes to scaffold, or adjust any item above)Wait for explicit confirmation before writing files.
.claude/rules/ files.claude/rules/ for domain-specific conventionsTemplate structure:
# [Project Name]
## Purpose
[1-3 sentences describing what this repo is and what Claude helps with here]
## Commands
- Build: `[cmd]`
- Test: `[cmd]`
- Lint: `[cmd]`
- Dev: `[cmd]`
## Stack
- [Language] with [key framework/version]
- [Package manager]
- [Other key tools]
## Agent Context Protocol
- Rules for specific domains are in `.claude/rules/` — Claude loads them automatically by file path
- Sensitive files excluded from Claude access: [list].claude/rules/)paths: frontmatter to scope rules to file types — this keeps them out of context unless relevantsettings.jsonAlways include:
$schema line for editor validationpermissions.deny for sensitive files discovered in Phase 1permissions.allow for commands the user confirmed are safesettings.local.jsonGenerate only if the user has personal overrides. Add to .gitignore if not already there.
After writing files:
wc -l .claude/CLAUDE.md — report line count and flag if over 200settings.json is valid JSONSummary output:
✓ .claude/CLAUDE.md ([N] lines)
✓ .claude/rules/[name].md (paths: [...])
✓ .claude/settings.json
✓ .claude/settings.local.json (gitignored)
Next steps:
- Run /memory to verify CLAUDE.md loaded correctly
- Add `.claude/settings.local.json` to .gitignore if not already present
- Run bridge installer if deploying to other agent environmentsCLAUDE.md (>200 lines), enter optimization mode: analyze existing content, propose what to split into rules files, and confirm before modifying.claude/ already exists with committed files: show a diff of what would change and require explicit confirmation per filesettings.json.env, .env.*, and secrets/~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.