bloom-987b27 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bloom-987b27 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bloom puts the current session into a sticky HTML-output mode. Once activated, every substantial artifact (status report, PR review, plan, doc, comparison, diagram, editor UI) blooms into a self-contained .html file using the warm clay/olive/oat/slate palette, semantic HTML5, inline CSS + JS, and zero external dependencies.
Canonical split: droids/bloom-core.md (session + rules) and droids/bloom-patterns.md (categories + copy-paste patterns). The rules below are the Claude-Code-specific operating instructions.
Slash:
/bloom/bloom-on/bloom-modePhrases:
File marker:
.bloom exists at the repo root at session start, activate immediately without waiting for an explicit trigger.Slash:
/bloom-off/no-bloom/bloom-mode-offPhrases:
Write a self-contained .html artifact for any of the following:
After writing the file, reply with a single plain-text line stating the path. Example:
Wrote ./bloom/2025-05-13-pr-312-review.html — open it in your browser.Do NOT paste the HTML source into the chat. The file is the artifact.
| Template | Category | Interactive |
|---|---|---|
templates/status-report-v2.html | Reports | Light (tabs/motion) |
templates/annotated-pr-review.html | Code review | No |
templates/exploration-code-approaches.html | Exploration | No |
templates/incident-timeline.html | Reports | No |
templates/triage-board.html | Custom editors | Yes — DnD + markdown export |
templates/animation-sandbox.html | Prototyping | Yes — easing controls |
For slide decks, flag editors, or complex DnD, read droids/bloom-patterns.md Category sections before generating.
Rule of thumb: if the user could act on the answer in under 5 seconds of reading, keep it plain text.
.md filenamesWhen the user asks you to create or update one of these files and bloom is on, write both the canonical .md (so the harness contract keeps working) and a richer .html companion next to it:
| Canonical (.md) | Companion (.html) |
|---|---|
README.md | README.html |
CLAUDE.md | CLAUDE.html |
AGENTS.md | AGENTS.html |
CONTRIBUTING.md | CONTRIBUTING.html |
CHANGELOG.md | CHANGELOG.html |
Files under .github/, .factory/, .cursor/, .windsurf/, .continue/, .claude/, and LICENSE / CODEOWNERS follow the same rule: keep the canonical form, add a sibling .html if it would be a substantial doc.
For non-reserved docs (docs/architecture.md, notes/sprint-44.md, etc.), default to writing the .html version as the primary artifact unless the user explicitly asks for markdown.
README.md → README.html)../bloom/ at the repo root with a kebab-case filename. Prefix with the date when relevant: ./bloom/2025-05-13-sprint-44-status.html../bloom/ if it doesn't exist.Every .html file produced must:
var(--clay), var(--olive), var(--oat), var(--slate), var(--ivory), var(--rust), var(--gray-100..700), --serif, --sans, --mono.<header>, <main>, <section>, <article>, <nav>, <aside>, <details>, <figure>).addEventListener only — no inline on* attributes, no eval, no new Function, no setTimeout(string).max-width page wrapper, clamp() for type, @media breakpoints at 640px and 960px.document.execCommand('copy') fallback.aria-label on SVGs, proper heading hierarchy, visible focus states.<meta name="viewport" content="width=device-width, initial-scale=1">.alert() / prompt() / confirm() — use inline UI instead.<link>, <script src>, @import url() to external).fetch(), XMLHttpRequest, WebSocket, EventSource, or external <img src>.eval(), new Function(), setTimeout(string), setInterval(string).innerHTML with user-controlled content — use createElement + textContent.onclick, onload, etc.). Use addEventListener.javascript: URIs.data:text/html or data:text/javascript URIs.innerHTML.default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'.On activation (first time per session):
Bloom is on. Artifacts will be written as self-contained.htmlfiles under./bloom/(companion.htmlalongside any reserved.md). Say "bloom off" or/bloom-offto deactivate.
On deactivation:
Bloom is off. Returning to default markdown output.
Do NOT produce an HTML splash screen on activation. The confirmation is a single plain-text line.
Every produced file uses this skeleton:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>[Specific descriptive title]</title>
<style>
:root {
--ivory: #FAF9F5;
--slate: #141413;
--clay: #D97757;
--oat: #E3DACC;
--olive: #788C5D;
--rust: #B04A3F;
--gray-100: #F0EEE6;
--gray-300: #D1CFC5;
--gray-500: #87867F;
--gray-700: #3D3D3A;
--white: #FFFFFF;
--serif: ui-serif, Georgia, "Times New Roman", serif;
--sans: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
--mono: ui-monospace, "SF Mono", Menlo, Monaco, Consolas, monospace;
}
* { margin: 0; padding: 0; box-sizing: border-box; }
body {
background: var(--ivory);
color: var(--gray-700);
font-family: var(--sans);
font-size: 15px;
line-height: 1.6;
-webkit-font-smoothing: antialiased;
padding: 56px 24px 120px;
}
.page { max-width: 860px; margin: 0 auto; }
</style>
</head>
<body>
<div class="page"><!-- semantic content --></div>
<script>
// addEventListener only; no eval, no innerHTML with user data
</script>
</body>
</html>.html file, not the chat../bloom/ or a .html companion to an existing .md?.md in addition to the companion (for reserved filenames)?~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.