coding-standard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coding-standard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
find . -maxdepth 1 -name "CLAUDE.md" -type ffind . -maxdepth 1 -name "AGENTS.md" -type ffind . -maxdepth 3 -name "project-discovery.md" -type ffind . -maxdepth 4 -type d -path "*/.claude/rules/coding-standards"Determine which mode to operate in based on the user's request:
| Mode | When | Initial Status | Then |
|---|---|---|---|
| Creating new | Building a coding standard from scratch | proposed | → Step 2 |
| Converting existing | User provides an existing document (ADR, etc.) to convert | accepted | → Step 2 |
| Updating existing | Modifying an existing coding standard | — | Read the existing coding standard, → Step 3 |
Coding standard documents are not a replacement for automated tooling. Before proceeding, evaluate whether the proposed coding standard falls into one of these categories:
If the proposed coding standard falls into one of these categories:
If the proposed coding standard does not fall into these categories, proceed to the YAGNI check below.
Apply the evidence-based YAGNI rule from ../../references/yagni-rule.md alongside the companion evidence rule in ../../references/evidence-rule.md. A coding standard is worth writing only when the project actually does the thing the standard governs today and the standard solves a real, concrete problem the team is currently hitting. Standards about patterns the project doesn't use yet, "for future flexibility", "best practice says we should…", or symmetry with other standards ("we have one for backend, so we should have one for frontend" when the frontend codebase is a single file) are YAGNI candidates. Acceptable evidence the standard is needed now:
If no accepted evidence applies, recommend deferring the standard with the trigger that would justify writing it (a third instance of the pattern lands, a real incident occurs, a recurring review finding accumulates). Surface the recommendation to the user with the override option.
## Project Discovery section for docs and coding-standards directories; fall back to project-discovery.md; fall back to Glob defaults (docs/, docs/coding-standards/). Continue without any keys that remain unfound.{docs-dir}/coding-standards/docs/coding-standards/.md files in that directory.svelte-component-naming.md → top-level svelte; svelte-stores-state-shape.md → top-level svelte, second-level stores). Build a list of top-level prefixes and known second-level prefixes per top-level.svelte, rails, postgres, terraform, api, worker).paths: frontmatter in Step 6 needs file globs scoped to the languages and directories the new standard governs. The Step 7 integration then routes the new standard into one or more per-file-type index files under .claude/rules/coding-standards/, where each index file owns a single file-type bucket (for example, svelte.md owns **/*.svelte; typescript.md owns **/*.ts and **/*.tsx; ruby.md owns **/*.rb and app/**/*.rb). Build the candidate glob set and its bucket grouping now so Steps 6 and 7 have them on hand.**/*.go, **/*.ts, **/*.tsx, **/*.py, **/*.rb, app/**/*.rb, services/**/*.go).paths:, collect its globs as candidate glob prefixes — they reflect the project's accepted scoping vocabulary.paths: frontmatter. Each existing file defines an established bucket; reuse it rather than introducing a parallel bucket for the same file type.**/*.{ext} for each extension seen in more than a handful of files) and surface what you found.paths: covers the new glob. Name new buckets after the language, framework, or subsystem they cover (e.g., svelte, typescript, ruby, sql) — the bucket name becomes the index file's filename in Step 7.AskUserQuestion to clarify before writingSkip these agents when the user has already provided full Correct-usage examples and conflicting-pattern evidence. Otherwise, launch both in parallel — one finds what the codebase already does, the other checks what the project has already documented. Include the topic, scope, and docs/coding-standards directories from Step 3.
${CLAUDE_SKILL_DIR}/references/durable-references.md and follow its Rules 1 and 2 to derive them; where Rule 2 reaches escalation, return the place flagged for engineer review instead of an anchor. Focus on real files; do not invent examples."After both agents complete, merge their findings into a context block:
When converting an existing document into a coding standard:
CLAUDE.md, AGENTS.md, and other markdown files)Read the durable-reference rule in durable-references.md and apply it throughout this step — this is the rule's authoring mode — all rules apply. For any candidate Step 4 flagged for engineer review — or any example you cannot cleanly anchor yourself — surface it to the engineer with a recommended resolution rather than emitting a coarse or anchorless reference; do not silently resolve it.
{top-level}[-{second-level}]-{hyphenated-name}.md — a one- or two-level hierarchy prefix followed by the standard's specific name. The hierarchy must come from the taxonomy discovered in Step 3.5, never invented or hardcoded.svelte, rails, postgres, api). Reuse an existing top-level prefix from Step 3.5 when one fits; only introduce a new top-level when no existing prefix applies, and prefer one that matches a language, framework, or subsystem already named in CLAUDE.md or project-discovery.md.svelte-stores-…, svelte-components-…). Reuse an existing second-level prefix from Step 3.5 when one fits. Skip the second level when the standard is the only one (or one of a few) under its top-level.proposed for new, accepted for converted)paths: field in the YAML frontmatter is the canonical declaration of which file globs the standard governs. Step 7 uses each glob to route the new standard into one or more per-file-type index files under .claude/rules/coding-standards/ — the standard itself is never loaded directly as a path-scoped rule. The index files are what Claude Code loads via Claude Code path-scoped rules, and they then point Claude at this standard on demand. Cross-cutting standards whose paths: span multiple file-type buckets get listed in each matching index.src/**/stores/**/*.ts over **/*.ts.AskUserQuestion (or as a recommendation when running unattended). Quote the Applies To text or scope clause that justifies each glob; mark inferred globs as (inferred). Name the index-file bucket(s) each glob will be routed into in Step 7 so the user can see the integration consequence. Do not write the file until the user confirms or proposes a substitute.*, {, [ are YAML-significant and fail to parse unquoted). Globs follow Claude Code's standard glob syntax (**, *, ?, {a,b}).--- block before the # {Title} heading containing at minimum the approved paths: list. Example: ---
paths:
- "**/*.go"
- "internal/services/**/*.go"
---When updating an existing standard (Step 1 mode = "Updating existing"), preserve every existing frontmatter key — only ADD or REPLACE paths:. Never strip name, description, type, or any other key the file already carries.
paths: list that includes one glob per area (e.g., "app/**/*.rb" plus "services/**/*.go")The standard is consumed by Claude Code through a small set of per-file-type index files under .claude/rules/coding-standards/. Each index file is itself a path-scoped rule that carries paths: frontmatter for one file type (or a closely-related group), a brief load-on-demand instruction paragraph, and a list of entries pointing to the canonical standards in the project's coding-standards directory. When Claude Code reads a file matching an index file's globs, Claude loads only that small index, then decides which (if any) of the listed standards to open with the Read tool. The full text of a standard is never loaded automatically. This replaces the prior one-symlink-per-standard layout, which forced every standard whose paths: matched the current file into context at once. Do not add the new standard as an enumerated link in `CLAUDE.md` (or `AGENTS.md`). Rules are discovered through the .claude/rules/ surface, not through the memory file, and enumerating them in the memory file is the failure mode this integration replaces.
paths: to a bucket. The set of matching buckets is the set of index files the standard will be listed in. A standard whose paths: spans multiple buckets (a cross-cutting standard, e.g., "app/**/*.rb" plus "services/**/*.go") will be listed in each matching index — the canonical standards file is still only ever in one place; only the index entries are repeated.mkdir -p .claude/rules/coding-standards..claude/rules/coding-standards/{bucket-name}.md and fill it in:paths: with the bucket's globs (each double-quoted; see the YAML rule in Step 6.5).{File-type} in the heading with the bucket name (e.g., Svelte, TypeScript, Ruby). Use the capitalization that matches the language/framework's own conventions.## Available standards heading) verbatim. It is what tells Claude to make a relevance decision before opening any standard.## Available standards with a single entry for the new standard (see entry format below).## Available standards, in alphabetical order by standard title (or by the existing hierarchy already in use in that index).paths:, the instruction paragraph, or any other entries unless this is update-mode and the change explicitly requires it (see step 5 below).## Available standards is a single bullet of the form: - [{Standard title}]({relative-path-to-canonical-file}) — {1-3 sentence description}# {Title} heading verbatim..claude/rules/coding-standards/. For a canonical file at docs/coding-standards/{filename}.md, the target is ../../../docs/coding-standards/{filename}.md. Adjust the ../ depth when the docs directory is nested differently.paths: changed:paths: no longer overlaps the standard's paths:, remove the standard's entry from that index. Leave the rest of the index untouched..claude/rules/coding-standards/. If yes, leave it alone. Coding standards live in `{docs-directory}`. They are exposed to Claude
Code through a small set of per-file-type index files under
`.claude/rules/coding-standards/`. Each index file is a path-scoped rule
that lists the standards relevant to one file type, with a short
description of each. When Claude reads a file matching an index's
`paths:` glob, Claude loads only the index and then decides which (if
any) standards to open. The full text of a standard is never loaded
automatically. Standards do not appear in the available-skills picker.
Humans continue to browse `{docs-directory}` for the canonical readable
form.Standards with conditional applicability tend to drift toward unconditional application unless the document's structure actively pushes back. Coordinately-listed rationales, buried exception cases, and missing "when not to apply" sections all let the pattern spread on speculation rather than evidence. This audit catches those structural failures before downstream readers and synthesizing agents over-apply the standard.
Walk through the six checks below. For each, cite a specific section, paragraph, or line in the draft that satisfies the check. If you cannot cite one, propose and apply a concrete revision before continuing.
Primary:, Secondary:, Side effect:)? Reject Purpose sections that list rationales coordinately ("X, Y, Z, and W") without ranking.go list -deps ./... to verify a cycle exists; a benchmark threshold for performance-motivated patterns; a coverage metric for testability-motivated patterns. Reject standards whose adoption trigger is purely "if you think you need it" without an objective check.Update-mode delta question — If updating an existing standard (Step 1 mode = "Updating existing"), additionally answer: did this update change which rationale is primary? If yes, re-audit every code example and inline comment to confirm they cite the new primary rationale, not the old one.
A standard that passes all six checks is robust against over-application by downstream readers and synthesizing agents. A standard that fails any of them tends to spread beyond its intended scope — fix the failure before proceeding to Step 9.
Before self-verification, dispatch two review agents in parallel to stress-test the draft standard. Pass each the path to the draft file.
Apply every actionable edit both agents return. For findings that demand a judgment only the author can make (ambiguous scope, disputed rationale), surface them to the user with a recommended resolution; do not silently resolve.
Read back the coding standard file and confirm:
{placeholder} values remain)paths: list, every glob is double-quoted, and the frontmatter closes with --- before the # {Title} heading. When updating an existing standard, confirm no pre-existing frontmatter keys were stripped..claude/rules/coding-standards/ whose paths: overlaps the standard's paths:, and is not listed in any index file whose paths: does not overlap. For each index file the standard was added to, confirm: the file's paths: frontmatter still parses; every pre-existing entry is still present (none were dropped while editing); the instruction paragraph between the heading and ## Available standards is unchanged from the template (verbatim); the new entry's relative link resolves to the canonical standard file; the new entry's description is 1-3 sentences, names both what the standard covers and when a reader should pull the full file, follows durable-reference Rule 3. In update-mode, additionally confirm the standard's entry was removed from any index file whose paths: no longer overlaps.CLAUDE.md (or AGENTS.md) was not given a new enumerated entry for this standard. If a pointer paragraph was added because none existed, confirm it appears exactly once and that its wording describes the per-file-type index-file mechanism (not the prior one-symlink-per-standard mechanism).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.