Skills setup
📦

setup

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access

Initialize Claude and Codex Project Workflows

New projects often lack consistent AI workflow files and setup rules. This skill guides setup, scaffolding, and settings generation for Claude, Codex, and Claude Code projects.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "setup" from https://skillstore.io/skills/chachamaru127-setup.md and its manifest at https://skillstore.io/api/skills/chachamaru127-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/chachamaru127-setup.md Signed manifest GET /api/skills/chachamaru127-setup/manifest Signed lockfile GET /api/skills/chachamaru127-setup/lockfile

Test it

Using "setup". A new TypeScript web project needs AI workflow files.

Expected outcome:

  • Created a plan for AGENTS.md, CLAUDE.md, and Plans.md.
  • Detected TypeScript and selected web workflow sections.
  • Asked before writing files that already existed.

Using "setup". An existing repository has partial Claude Code settings.

Expected outcome:

The skill reports the current settings state, proposes a merge, and lists permission changes for review.

Using "setup". The repository state is ambiguous.

Expected outcome:

  • The skill asks whether the project is new or existing.
  • Setup continues only after the user chooses a project type.

Security Audit

High Risk
v8 • 7/6/2026 Open versioned report

Most static findings are false positives from Markdown examples, Japanese text, and protective deny-list documentation. I confirmed the hidden-plugin shell execution path in adaptive setup and added semantic findings for permission-bypass and overbroad allowlist guidance. The author should narrow permission defaults and avoid encouraging bypass modes before publication.

6
Files scanned
751
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (2)

High
generate-claude-settings/doc.md:34-43generate-claude-settings/doc.md:92-95generate-claude-settings/doc.md:140-145generate-claude-settings/doc.md:242-263
Unsafe Permission Bypass Guidance
The settings generator presents bypassPermissions as the preferred mode, recommends project-local default bypass settings, and removes disableBypassPermissionsMode. This weakens normal confirmation prompts for edits and commands.
Multiple sections explicitly recommend bypassPermissions, mention dangerously-skip-permissions, and instruct removal of disableBypassPermissionsMode. This is direct policy guidance, not a weak pattern match.
High
generate-claude-settings/doc.md:44-65generate-claude-settings/doc.md:172-185
Overbroad Tool Allowlist Guidance
The settings guidance recommends wildcard MCP permissions and broad Bash allow entries such as package manager commands and cat. These defaults can grant more tool access than a project needs.
The file contains concrete wildcard MCP patterns and broad Bash allow examples. The guidance may be operationally useful, but it creates a clear least-privilege concern.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
adaptive-setup/doc.md:38
Shell command substitution
ANALYSIS=$("$PLUGIN_PATH/scripts/analyze-project.sh")
The skill instructs Bash to execute analyze-project.sh from a plugin path controlled by CLAUDE_PLUGIN_ROOT or a hidden home directory. This is legitimate setup behavior only when the plugin path is trusted, so the execution risk remains real.
Medium
adaptive-setup/doc.md:37
Hidden file access
PLUGIN_PATH="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/claude-code-harness}"
The documented default path reads from $HOME/.claude/plugins, and the next line executes a script from that hidden location. Hidden plugin execution can evade project-local review if the install root is not verified.

Risk Factors

⚙️ External commands (2)
adaptive-setup/doc.md:38 generate-claude-settings/doc.md:251-258
📁 Filesystem access (4)
adaptive-setup/doc.md:37 generate-claude-settings/doc.md:88 generate-claude-settings/doc.md:262 generate-claude-settings/doc.md:262
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/chachamaru127-setup/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/chachamaru127-setup/security.svg)](https://skillstore.io/skills/chachamaru127-setup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/chachamaru127-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/chachamaru127-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/chachamaru127-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Chachamaru127. (2026). setup security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/chachamaru127-setup/audits/8

BibTeX citation

@techreport{chachamaru127-chachamaru127-setup-2026, author = {Chachamaru127}, title = {setup security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/chachamaru127-setup/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "Chachamaru127" date-released: "2026-07-06" url: "https://skillstore.io/skills/chachamaru127-setup/audits/8" identifiers: - type: other value: "skillstore:chachamaru127-setup:audit:8" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
Emz1998 Recommended

emz1998-setup

Skillstore Score 77
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

Chachamaru127 Current

chachamaru127-setup

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
85
Content
73
Community
83
Spec Compliance

What You Can Build

Start an AI-ready project

Create starter files and workflow documents for a new Claude Code or Codex project.

Standardize team setup

Generate shared AGENTS.md, CLAUDE.md, and Plans.md files for consistent AI-assisted work.

Repair missing workflow files

Add missing setup files to an existing repository without overwriting user work.

Try These Prompts

Set up a new project 
Initialize this repository for a new Claude Code and Codex workflow. Ask before overwriting any existing file.
Add workflow files 
Generate AGENTS.md, CLAUDE.md, and Plans.md for this existing project. Use the detected technology stack.
Scaffold project structure 
Scaffold a minimal web application structure for my selected stack. Show created files and skip dependency installation.
Merge Claude settings 
Review the current .claude settings, merge the safe policy template, and explain any permission changes before writing files.

Best Practices

  • Review generated permission settings before enabling them in a real repository.
  • Commit shared workflow files, but keep local settings out of version control.
  • Run setup in a clean branch so changes are easy to inspect.

Avoid

  • Do not enable bypass permissions without a project-specific security review.
  • Do not use generated settings as a substitute for repository policy.
  • Do not run setup scripts from untrusted plugin paths.

Frequently Asked Questions

Does this skill create files?
Yes. It can write workflow files, settings files, and starter project structure when the user approves the setup flow.
Does it work with Codex?
Yes. It supports Codex-oriented workflow files such as AGENTS.md, alongside Claude and Claude Code files.
Will it overwrite existing files?
The documented flow asks before overwriting and prefers merges or additions for existing projects.
Does it install dependencies?
No. The scaffolder says dependency installation should wait for user confirmation.
Why is security review important?
The settings generator discusses permission bypass and broad tool allowlists, so teams should review those choices.
What projects fit best?
It fits repositories that need AI coding workflow files, project setup guidance, or Claude Code settings.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/Chachamaru127/claude-code-harness/tree/main/skills/setup

Ref

dd4a3ef9f20ddf38830950b4bb713df96b431fd6

Maintenance freshness

7/20/2026

Usage

6 downloads · 423 views

File structure

📁 adaptive-setup/

📄 doc.md

📁 ask-project-type/

📄 doc.md

📁 generate-claude-settings/

📄 doc.md

📁 generate-workflow-files/

📄 doc.md

📁 project-scaffolder/

📄 doc.md

📄 SKILL.md

More from Chachamaru127

View all

Related Skills

View all