Initialize Project Structure

AdvisoryAudited by Static analysis on May 8, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the referenced slim-claude-md skill is missing, outdated, or altered, the generated project instructions may differ from what is visible in this package.

Why it was flagged

The skill incorporates content from a separate skill that is not included in this manifest. This is disclosed and related to the purpose, but the external templates can affect the generated CLAUDE files.

Skill content
Read templates from the `slim-claude-md` skill's `references/` directory
Recommendation

Use a trusted copy of slim-claude-md and review the generated CLAUDE.md and CLAUDE.local.md before relying on them.

What this means

Future sessions may reference these deployment steps; an accidental approval or misread workflow could affect a live production branch.

Why it was flagged

The generated workflow documents production deployment commands. The surrounding template requires explicit approval for production and destructive operations, so this is purpose-aligned but high-impact if later followed incorrectly.

Skill content
git checkout main    && git merge canary  && git push  # deploy to production — explicit approval
Recommendation

Keep the explicit per-action approval rules, verify the branch topology matches the real project, and review any production or destructive command before allowing it to run.

What this means

Database or service connection strings placed in CLAUDE.local.md could be exposed to local agent sessions or leaked if the file is later committed by mistake.

Why it was flagged

The scaffold intentionally creates persistent local context for environment-specific configuration. Gitignore reduces sharing risk, but future local agent sessions may read whatever the user places there.

Skill content
Connection strings live in `CLAUDE.local.md` (gitignored).
Recommendation

Keep CLAUDE.local.md gitignored, prefer placeholders or least-privilege/read-only credentials, and avoid storing production secrets unless absolutely necessary.