client-onboard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited client-onboard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
USE when:
CLAUDE.md at rootSKIP when:
/daily or brain notes instead)CLAUDE.md = facts always true. Skill = procedures you'd re-paste.
If a step is a repeatable PROCEDURE (deploy dance, audit format, content batch), do NOT bloat CLAUDE.md with it — note it and suggest building a Skill. CLAUDE.md only holds: the _what_ (stack), the _why_ (architecture rationale), the _how_ (conventions + the exact build/deploy commands for THIS repo).
Hard limits:
claude.md / Claude.md.your-site, travel-client (infer from dir name, confirm)If client/stack ambiguous → ASK before writing. Never invent a deploy target.
cd <repo>
git rev-parse --is-inside-work-tree 2>/dev/null && echo "git repo" || echo "NOT a git repo"
# Casing guard: detect lowercase dup that Windows hides but git tracks
git ls-files | grep -iE '(^|/)claude\.md$' || true
ls -la | grep -iE 'claude\.md' || trueIf a lowercase `claude.md` exists → WARN loudly. On case-insensitive Windows it silently shadows CLAUDE.md; Claude Code only auto-loads the uppercase name. Fix:
git mv claude.md CLAUDE.md.tmp && git mv CLAUDE.md.tmp CLAUDE.md # two-step: Windows needs itProbe files at root (and one level down). First match wins; a repo can be multi-type.
| Type | Detection signal |
|---|---|
| wp-theme | style.css with Theme Name: header, or functions.php, wp-content/ |
| wp-plugin | *.php with Plugin Name: header in header comment |
| react-next | next.config.* OR (package.json with next/react dep) |
| vite-static | vite.config.* or package.json w/ vite, no next |
| static | index.html at root, no package.json |
| n8n | *.json workflow exports w/ "nodes"+"connections" keys, or /workflows/ |
| video | *.mp4/*.mov/*.mkv assets + ffmpeg/.ps1 render scripts |
# quick probes
test -f style.css && grep -l "Theme Name:" style.css 2>/dev/null && echo "TYPE: wp-theme"
test -f next.config.js -o -f next.config.mjs -o -f next.config.ts && echo "TYPE: react-next"
test -f package.json && grep -qE '"(next|react)"' package.json && echo "TYPE: react-next"
test -f index.html && test ! -f package.json && echo "TYPE: static"
grep -rlE '"nodes"\s*:' --include='*.json' . 2>/dev/null | head -1 && echo "TYPE: n8n (maybe)"
ls *.mp4 *.mov *.mkv 2>/dev/null | head -1 && echo "TYPE: video (maybe)"Pick deploy block by client + type. NEVER mix these up.
| Client / type | Deploy truth (bake verbatim) |
|---|---|
| Hostinger Node app (e.g. main agency site) | Deploys via Hostinger manual ZIP archive upload in hPanel. NOT GitHub auto-deploy — GitHub auto-deploy is hPanel-locked/unavailable here. Build → ZIP → hPanel File Manager → upload → extract. Rollback = re-upload previous ZIP. |
WP plugin/login styler (e.g. travel client on client-site.example.com) | WP plugin: bump version header, ZIP the plugin folder, upload via WP admin Plugins → or hosting File Manager. LoginPress coexistence rules apply (style CSS-first, gettext for text, never DOM-surgery on register). |
| react-next (any) | Deploys to Vercel. git push to connected branch = auto-deploy preview; merge to main = production. vercel --prod for manual. |
| vite-static / static | Host-dependent — confirm. If Hostinger → manual ZIP (same as the Hostinger Node app rule). If Vercel/Netlify → push-to-deploy. |
| n8n | Workflows live in n8n instance, NOT auto-deployed from repo. Import JSON via n8n UI / API. Repo = source of truth backup. Activate manually after creds wired. |
| video | No "deploy" — render then publish via GHL drip (/ghl-video-drip). |
If and only if TYPE includes video, add to CLAUDE.md:
- ffmpeg on this box: NVENC is BROKEN → always encode with libx264.
- Alpha .mov overlays fail → use PNG sequences/stills instead.
- Talking-head: face-safe right-panel pattern (see memory: video-edit-gotchas).Do NOT add this to non-video repos.
Use the template below. Fill every <...>. Cut anything that isn't a durable fact. Procedures → list under "Procedures (build as Skills)" with a one-line pointer, NOT full steps.
.claude/ + gitignore + MCP notemkdir -p .claude
# starter settings (permissions only — keep minimal)
test -f .claude/settings.json || cat > .claude/settings.json <<'JSON'
{ "permissions": { "allow": [], "deny": [] } }
JSON
# CLAUDE.local.md = personal/secret context, never committed
grep -qxF 'CLAUDE.local.md' .gitignore 2>/dev/null || echo 'CLAUDE.local.md' >> .gitignore
grep -qxF '.claude/settings.local.json' .gitignore 2>/dev/null || echo '.claude/settings.local.json' >> .gitignoreMCP suggestion (print, don't auto-wire — needs creds):
hostinger-mcp (DNS, deploy WP theme/plugin, File Manager).ghl MCP (contacts, social posting, conversations).vercel auth (deploy logs, env).n8n-mcp (search/validate nodes, validate workflow).Print exactly what was created + next steps (template at bottom).
# <Client Name> — <one-line what this repo is>
## Stack (the what)
- Type: <wp-theme | react-next | static | n8n | video>
- Lang/Framework: <e.g. WordPress (PHP), Next.js 14 / React, vanilla HTML+JS>
- Hosting: <Hostinger | Vercel | n8n instance>
- Live URL: <https://...>
- Key deps: <list 3-6 that matter; from package.json / composer.json>
## Architecture rationale (the why)
- <Why this structure. e.g. "Standalone plugin so LoginPress is removable.">
- <Key constraint that shapes the code. e.g. "Italian client → IT copy via gettext, never hardcoded.">
- <Any hard-won decision. e.g. "CSS-first login styling, no DOM surgery on register.">
## Conventions (the how)
- File layout: <where things live>
- Naming: <conventions>
- Do: <repo-specific musts>
- Don't: <repo-specific traps>
## Build & deploy commands
\`\`\`bash
<build cmd, e.g. npm run build | or "no build step">
\`\`\`
DEPLOY (read carefully — this repo's truth):
<paste the exact deploy gotcha block from step 3>
## Gotchas
- <repo-specific landmines>
<video-only: NVENC broken → libx264; alpha .mov fails → PNG>
## Procedures (build as Skills, NOT in this file)
- <repeatable workflow> → suggest Skill: <name>CLAUDE.md; a lowercase claude.md is silently ignored on load but tracked by git → split-brain.git ls-files | grep -i claude.md in step 1 and warn.CLAUDE.local.md = your private, gitignored layer (secrets, personal notes). Never committed.CLIENT ONBOARDED: <slug>
Detected type: <type(s)>
Deploy target: <Hostinger manual ZIP | Vercel | n8n import | render-only>
Created:
[x] CLAUDE.md (<N> lines, < 200 ✓)
[x] .claude/settings.json
[x] .gitignore (+ CLAUDE.local.md, .claude/settings.local.json)
Warnings:
[<x|->] lowercase claude.md dup <none | FOUND — renamed>
Suggested MCP (wire with creds):
- <hostinger-mcp | ghl | vercel | n8n-mcp>
Suggested Skills (procedures, not facts):
- <skill ideas surfaced during scan>
NEXT:
1. Review CLAUDE.md — fill any <...> placeholders I couldn't infer.
2. git add CLAUDE.md .claude/settings.json .gitignore && commit.
3. Wire suggested MCP if working the live site this session.
4. Open a fresh session so CLAUDE.md auto-loads.| Slug | Type | Hosting / deploy | Special |
|---|---|---|---|
| your-site | WP/site | Hostinger MANUAL ZIP (NOT GitHub auto-deploy) | rollback = re-upload prev ZIP |
| travel-client | WP plugin (login styler) | WP admin / File Manager ZIP | LoginPress coexistence; localized copy; never DOM-surgery register |
| jewelry-client | site/demo | confirm host | jewelry niche demo |
| fashion-client | site/demo | confirm host | fashion niche demo |
| car-dealer | site/demo | confirm host | dealer niche demo |
| health-clinic | site/demo | confirm host | health/wellness niche demo |
| social-pipeline | n8n/automation | n8n instance, manual import+activate | scraper→n8n→GHL; creds gated |
claude.md (won't auto-load; creates a dup)CLAUDE.local.md (it's the gitignored private layer)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.