AI Agent Configuration Policy (Configuration & Security)
When to use this skill
Build AI agent environment for new projects
Write and optimize project description files
Configure Hooks/Skills/Plugins
Establish security policies
Share team configurations
1. Project Description File Writing Policy
Overview
Project description files (CLAUDE.md, README, etc.) are project manuals for AI. AI agents reference these files with top priority.
Auto-generate (Claude Code)
/init # Claude analyzes the codebase and generates a draft
Required Section Structure
# Project: [Project Name]## Tech Stack-**Frontend**: React + TypeScript
: Node.js + Express
: PostgreSQL
: Drizzle
Use TypeScript strict mode
Prefer server components over client components
Use instead of
Always validate user input with Zod
Never commit files
Never use type in TypeScript
Never bypass authentication checks
Never expose API keys in client code
: Start development server
: Build for production
: Run tests
-
**Backend**
-
**Database**
-
**ORM**
## Coding Standards
-
-
-
`async/await`
`.then()`
-
## DO NOT
-
`.env`
-
`any`
-
-
## Common Commands
-
`npm run dev`
-
`npm run build`
-
`npm run test`
Writing Principles: The Art of Conciseness
Bad (verbose):
Our authentication system is built using NextAuth.js, which is a
complete authentication solution for Next.js applications...
(5+ lines of explanation)
Rules that always apply → Project Description File
Knowledge needed only for specific tasks → Skills (token efficient)
Frequently used commands → Slash Commands
External service integration → Plugins / MCP
Custom Skill Creation
# Create skill directorymkdir -p ~/.claude/skills/my-skill
# Write SKILL.mdcat > ~/.claude/skills/my-skill/SKILL.md << 'EOF'
---
name: my-skill
description: My custom skill
platforms: [Claude, Gemini, ChatGPT]
---
# My Skill## When to use
- When needed for specific tasks
## Instructions
1. First step
2. Second step
EOF
4. Security Policy
Prohibited Actions (DO NOT)
Absolutely Forbidden
Using unrestricted permission mode on host systems
Auto-approving root directory deletion commands
Committing secret files like .env, credentials.json
~/.claude/settings.json # Global settings
~/.claude/skills/ # Global skills
.claude/settings.json # Project settings
.claude/skills/ # Project skills
.agent-skills/ # Universal skills
CLAUDE.md # Project AI manual
Security Priority
1. Block dangerous commands with Hooks
2. Auto-approve only safe commands with /sandbox
3. Regular audit with cc-safe
4. Experiment mode in containers only