claude-md-maintenance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited claude-md-maintenance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When Claude makes the same mistake twice, it should update CLAUDE.md to prevent a third occurrence. This is "self-healing" — the system learns from its errors.
The cycle:
This is why the Gotchas section exists. It grows organically from real problems encountered during development.
CLAUDE.md should stay under 200 lines of actual content. This is the official Claude Code guidance and matches worclaude doctor's WARN threshold (150 lines / 30,000 chars) and ERROR threshold (200 lines). It is a target, not a hard limit, but exceeding it significantly means CLAUDE.md is trying to do too much.
Claude reads CLAUDE.md at the start of every session and after every /compact. Long CLAUDE.md files waste context on every single interaction.
YES:
NO:
CLAUDE.md: things Claude needs to know EVERY session, regardless of task. Skills: things Claude needs to know SOMETIMES, for specific types of work.
Example:
(only needed when actually writing commits)
The Gotchas section captures project-specific traps. Format:
## Gotchas
- The settings merger must handle comment strings in JSON arrays (they're not valid
JSON but we support them for readability)
- Always use path.join(), never string concatenation for file paths — breaks on Windows
- The backup directory uses timestamps with colons replaced by hyphens for Windows compatEach gotcha should be:
Review CLAUDE.md when:
Pruning checklist:
The /update-claude-md command helps at session end:
Always review proposed changes before applying. Not every mistake needs a rule. Only add rules for recurring problems.
When CLAUDE.md outgrows what one file can hold cleanly, use @path/to/import to split content into separate files that still load with CLAUDE.md:
# CLAUDE.md
## Key Files
@README
@docs/git-instructions.md
@~/.claude/my-project-instructions.mdSyntax (per official Claude Code docs):
@path/to/import — relative to the file containing the directive(e.g., @README, @docs/git-instructions.md)
@~/path — home-directory relative(e.g., @~/.claude/my-project-instructions.md)
Behavior:
context budget. Splitting CLAUDE.md into 5 files of 50 lines each produces the same context cost as one 250-line file.
resolving after 5 levels.
path outside the project root (e.g., a system-wide config) prompts the user to confirm before the import resolves. This is a one-time approval.
@~/.claude/... worktree-share patternWorktree agents (isolation: worktree) operate in a freshly-checked-out copy of the repo. Anything in .claude/CLAUDE.local.md or other gitignored files is not present in the worktree, so the agent loses your local rules.
Workaround: store shared local rules in a home-directory file and import it from the project's CLAUDE.md:
# CLAUDE.md
@~/.claude/my-team-rules.mdThe worktree agent re-reads ~/.claude/my-team-rules.md at launch (it lives outside the repo, so no checkout is needed) and gets the same rules as your main session. The first run triggers an external-import approval; after that it loads silently.
Reserve this pattern for rules that belong to you across all projects (coding style preferences, personal shortcuts). Team-shared rules should still live inside the repo.
not as documentation. "Use path.join for file paths" not "The project uses path.join for file paths because..."
rules clutter the file without proven value.
intentionally.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.