template-renderer

name	template-renderer
description	Render templates by replacing {{TOKEN}} placeholders with actual values, supporting all three templates (specification, plan, tasks) with schema validation and security sanitization
version	1.0.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Write","mcp__filesystem__read_text_file","mcp__filesystem__write_file"]
args	<template-name> <output-path> [--tokens <json-file>]
best_practices	["Sanitize all token values to prevent injection attacks","Validate template paths within PROJECT_ROOT only","Use token whitelist (only allow predefined tokens)","Validate output against schema for specification templates","Preserve Markdown formatting during token replacement","Error on missing required tokens","Warn on unused tokens provided"]
error_handling	strict
streaming	not_supported
verified	false
lastVerifiedAt	"2026-02-19T05:29:09.098Z"
source	builtin
trust_score	100
provenance_sha	1218b5a52d8f08cb

Template Renderer

Template Renderer Skill - Renders templates by replacing {{TOKEN}} placeholders with actual values. Supports specification-template.md, plan-template.md, and tasks-template.md with schema validation and security controls (SEC-SPEC-003, SEC-SPEC-004). - Render all three template types (specification, plan, tasks) - Token replacement with {{TOKEN}} → value substitution - Security: Token value sanitization (prevent injection) - Security: Token whitelist enforcement (only predefined tokens allowed) - Security: Template path validation (PROJECT_ROOT only) - Schema validation for specification templates - Error handling for missing required tokens - Warning system for unused tokens - Preserve Markdown formatting and structure

Step 1: Validate Inputs (SECURITY - MANDATORY)

Template Path Validation (SEC-SPEC-002):

• Verify template file exists within PROJECT_ROOT
• Reject any path traversal attempts (../)
• Only allow templates from .claude/templates/

Token Whitelist Validation (SEC-SPEC-003):

// Allowed tokens by template type
const SPEC_TOKENS = [
  'FEATURE_NAME',
  'VERSION',
  'AUTHOR',
  'DATE',
  'STATUS',
  'ACCEPTANCE_CRITERIA_1',
  'ACCEPTANCE_CRITERIA_2',
  'ACCEPTANCE_CRITERIA_3',
  'TERM_1',
  'TERM_2',
  'TERM_3',
  'HTTP_METHOD',
  'ENDPOINT_PATH',
  'PROJECT_NAME',
];

const PLAN_TOKENS = [
  'PLAN_TITLE',
  'DATE',
  'FRAMEWORK_VERSION',
  'STATUS',
  'EXECUTIVE_SUMMARY',
  'TOTAL_TASKS',
  'FEATURES_COUNT',
  'ESTIMATED_TIME',
  'STRATEGY',
  'KEY_DELIVERABLES_LIST',
  ,
  ,
  ,
  ,
  ,
  ,
];

  = [
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
  ,
];

**Example 1: Render Specification Template**