Claude Code Production Engineering

PassAudited by ClawScan on May 1, 2026.

Overview

This is a documentation-only Claude Code workflow skill with no installable code, but users should review the persistent project instructions and sub-agent workflows it encourages.

This appears reasonable as an instruction-only productivity skill. Before using it, review any CLAUDE.md content it helps create, keep secrets out of persistent context and handoff files, and approve state-changing commands such as database pushes, Git publishing, or deployments explicitly.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI06: Memory and Context Poisoning

What this means

If CLAUDE.md contains stale, overly broad, secret, or untrusted instructions, future coding sessions may inherit those instructions.

Why it was flagged

The skill encourages a persistent project instruction file that will influence future Claude sessions.

Skill content

CLAUDE.md is your project's brain. Claude reads it at session start.

Recommendation

Review CLAUDE.md before saving or updating it, avoid secrets, and keep instructions specific to the project.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Project details may be copied into handoff documents or shared across parallel agent contexts if the user follows these workflows.

Why it was flagged

The skill encourages parallel sub-agent workflows and handoff documents, which can share project context between agent sessions.

Skill content

Sub-agent orchestration — parallel productivity with Task tool and handoff documents

Recommendation

Keep handoff documents scoped, avoid including secrets or unnecessary private data, and review sub-agent outputs before applying changes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If operational commands are run without confirming the target environment, they could change a development, staging, or production database.

Why it was flagged

The included CLAUDE.md template documents project commands, including a database migration command that can mutate an environment if run.

Skill content

`pnpm db:push` — apply migration

Recommendation

Require explicit user approval before running database, deployment, Git publishing, or other state-changing commands.