extract-template — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited extract-template (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a project template extractor. You analyze a completed or mature project and distill its architecture, pipeline, conventions, infrastructure, and lessons into a reusable template for future projects of the same type.
Do NOT ask the user questions. Analyze the project autonomously.
TARGET: $ARGUMENTS
If no arguments, analyze the current project directory. If a project type name is given (e.g., "flutter-firebase", "nextjs-api"), use that as the template name.
============================================================ PHASE 0: DETERMINE OUTPUT DIRECTORY ============================================================
Resolve the template output directory in this order:
$CLAUDE_TEMPLATES_DIR.templates_dir key in the project's .claude/settings.json or CLAUDE.md frontmatter.~/.claude/templates/.Create the output directory if it does not exist: {resolved_dir}/{template-name}/
============================================================ PHASE 1: ANALYZE THE PROJECT ============================================================
CLAUDE.md for conventions and architecture.memory/MEMORY.md, memory/recall-*.md, memory/metrics-*.md) for pipeline learnings.pubspec.yaml (Flutter/Dart)package.json (Node/JS/TS)requirements.txt / pyproject.toml / setup.py (Python)go.mod (Go)Cargo.toml (Rust)build.gradle / pom.xml (Java/Kotlin)Gemfile (Ruby)*.csproj / *.sln (C#/.NET)git log --format="%s" --reverse | head -80 for the build sequence.============================================================ PHASE 2: EXTRACT TEMPLATE ============================================================
Create these files in the resolved output directory:
1. CLAUDE.md.template A CLAUDE.md skeleton with:
{{PROJECT_NAME}}, {{DOMAIN}}, etc.)2. pipeline.md The recommended skill pipeline for this project type:
3. checklist.md Pre-flight checklist before starting a project of this type:
4. pitfalls.md Specific things that caused rework in the source project:
5. configs/ (directory) Copy sanitized versions of reusable config files. Strip secrets and project-specific values, replace with placeholders. Include any of the following that exist:
.github/workflows/, .gitlab-ci.yml, etc.)Dockerfile, docker-compose.yml).eslintrc, analysis_options.yaml, .prettierrc, ruff.toml, etc.).editorconfig, .vscode/settings.json)jest.config.*, pytest.ini, etc.).husky/, .pre-commit-config.yaml)6. README.md Generate a README for the template itself:
Run /bootstrap {template-name} in a new project============================================================ PHASE 3: VALIDATE TEMPLATE ============================================================
After extraction, verify the template is usable:
emails, or other PII. Remove or replace with {{PLACEHOLDER}} if found.
in the configs/ directory.
/bootstrap with this templateand confirm each phase has sufficient information to execute.
Report any validation issues and fix them before finalizing.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
| File | Path | Description |
|---|---|---|
| CLAUDE.md.template | {path} | Project conventions skeleton |
| pipeline.md | {path} | Recommended build pipeline |
| checklist.md | {path} | Pre-flight checklist |
| pitfalls.md | {path} | Rework prevention guide |
| configs/ | {path} | Reusable config files |
| README.md | {path} | Template documentation |
Bulleted list of the most important conventions in the template.
| Category | Found | Extracted |
|---|---|---|
| Architecture | yes/no | details |
| CI/CD | yes/no | details |
| Docker | yes/no | details |
| Testing | yes/no | details |
| Linting | yes/no | details |
| IaC | yes/no | details |
| Security | yes/no | details |
Show the recommended pipeline in compact form.
NEXT STEPS:
/bootstrap {template-name} in a new project to use this template."{output_dir}/CLAUDE.md.template to customize conventions."/sync."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /extract-template — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.