CLAUDE MD Initializer

Use when onboarding a repository into Claude Code by creating or improving CLAUDE.md, and optionally identifying useful skills, hooks, and verifier setup.

Security Scan

The skill's requested actions (reading a repo and producing onboarding docs) match its description and it asks for no extra credentials or installs; main risk is accidental inclusion of secrets from the repo if the agent has broad read access.

Purpose & Capability

Name/description (create/improve CLAUDE.md for repo onboarding) align with the runtime instructions (read repo, identify commands, summarize architecture, produce CLAUDE.md and suggest skills). Nothing requested—no env vars, binaries, or installs—is disproportionate to this purpose.

Instruction Scope

Instructions tell the agent to "read the repository structure, README, existing instructions, and tooling config," which is appropriate for repo onboarding. However, that broad read operation can include secrets or sensitive files in the repo (e.g., .env, credentials, keys) unless explicitly excluded. The Guardrails disallow inventing commands but do not explicitly forbid reading or reproducing secrets or private files; consider adding explicit redaction/ignore rules.

Install Mechanism

Instruction-only skill with no install spec and no code files. Lowest-risk install footprint (nothing is written to disk or downloaded).

Credentials

No environment variables, credentials, or config paths are required. The skill does not ask for unrelated secrets or services.

Persistence & Privilege

always:false and no claims of modifying other skills or system-wide settings. Autonomous invocation is allowed (default) but not combined with other concerning privileges.

Assessment

This skill appears coherent and low-risk: it only instructs the agent to read the repository and produce a CLAUDE.md. Before installing or invoking it, ensure the agent's repository access is scoped appropriately: if the repo contains secrets (API keys, .env files, private keys), the agent could read and summarize them unless you add explicit guardrails. Practical precautions: (1) add or request a guardrail to ignore/redact files like .env, credentials, and secrets; (2) review any generated CLAUDE.md before committing or sharing; (3) confirm the skill's provenance (the metadata claims it was derived from src/commands/init.ts) if you need stronger assurance about origin; and (4) avoid granting the skill broader permissions (e.g., write access or external network posting) unless necessary.

Use this skill when a repo needs onboarding documentation for future agent sessions.

Workflow

1. Read the repository structure, README, existing instructions, and tooling config.
2. Identify key build, test, and run commands.
3. Summarize the high-level architecture and important conventions.
4. Create or improve CLAUDE.md without stuffing it with generic advice.
5. Suggest follow-on skills, hooks, or verifier setup if they materially help.

Guardrails

• Do not invent commands or conventions.
• Focus on repo-specific knowledge, not generic coding advice.
• Keep the file practical for future agent sessions.

Source Provenance

Derived from src/commands/init.ts.