# Claude Field Kit
A battle-tested setup for Claude Code โ hooks, slash commands, and skills refined across real production projects.
The headline feature is a **security scanner** that catches prompt injection and unicode attacks in skills before they touch your context. The rest is a complete project workflow: automatic issue tracking, inventory management, project scaffolding, and UI generation skills that don't look like generic AI output.
---
## What You Get
| | What | Why it matters |
|---|---|---|
| ๐ก๏ธ | **Skill security scanner** | Detects prompt injection, unicode tricks (zero-width chars, bidi overrides, homoglyphs), hidden instructions, and exfiltration URLs before a skill is installed |
| ๐ | **`/audit-skill <url>`** | Manual pre-install review command โ scan any GitHub URL or local path before running `npx skills add` |
| ๐๏ธ | **`/new-project`** | Scaffolds CLAUDE.md, INVENTORY.md, CHANGELOG.md, initialises Beads, creates `.mcp.json` โ one command, everything wired up |
| ๐ | **Inventory hook** | Fires after every source file change and reminds Claude to update `INVENTORY.md` โ upgrades it from a rule to an enforced habit |
| ๐ข | **Beads hook** | Fires after every git commit and prompts Claude to close or update related Beads issues |
| ๐จ | **`saas-design` skill** | Modern SaaS UI generation grounded in 60+ real component patterns โ clean, minimal, production-quality. Use when you want polish over expression |
| ๐ | **Context7 MCP** | Adds live documentation lookup globally โ Claude can resolve `use context7` to pull fresh docs for any library |
---
## Install
> **Read before you run.** We built a security scanner for skills. It would be embarrassing to distribute this as a blind `curl | bash`. Clone it, read `install.sh` (it's short and commented), then run it.
```bash
git clone https://github.com/mbennell/claude-field-kit
cd claude-field-kit
cat install.sh # read it first
./install.sh
```
Then **restart Claude Code** for all changes to take effect.
### What the installer does
1. Copies hooks to `~/.claude/hooks/`
2. Copies commands to `~/.claude/commands/`
3. Merges hook config into `~/.claude/settings.json` (non-destructive โ your existing config is preserved)
4. Installs the `saas-design` skill into your Claude plugin marketplace
5. Enables `saas-design` in settings
6. Adds Context7 as a global MCP server via the `claude` CLI
### Requirements
- **bash** + **python3** (for the security scanner)
- **Claude Code** with the `claude` CLI in your PATH
- Optional: `npx` (for Context7), `bd` (Beads), `npx gitnexus` (code intelligence)
---
## After Installing
### Recommended extras (not auto-installed)
These are third-party tools โ install them yourself so you know what you're getting:
```bash
# Beads โ git-backed issue tracking designed for AI agents
curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
# GitNexus โ code intelligence (run in each project)
npx gitnexus analyze
# Anthropic's frontend-design skill (expressive/creative UI)
npx skills add https://github.com/anthropics/skills --skill frontend-design
# The installer will automatically enhance it with the components.md reference
# if it's already installed when you run install.sh
```
### Start a new project
```
/new-project
```
Asks 6 questions then scaffolds everything: CLAUDE.md, INVENTORY.md, CHANGELOG.md, Beads init, and `.mcp.json`.
### Audit a skill before installing
```
/audit-skill https://github.com/some-person/some-skill
```
Fetches, scans, runs through a manual checklist, gives you a go/no-go verdict.
---
## The Security Scanner
The scanner runs in two ways:
**Automatically** โ a `PreToolUse` hook intercepts any `Write` or `Edit` call targeting a skill file. Critical issues block the write. Warnings let it through but flag for review.
**Manually** โ run it on any file or directory:
```bash
~/.claude/hooks/skill-scanner.sh <file_or_directory>
```
### What it detects
| Severity | Check |
|---|---|
| ๐ด Critical | Zero-width characters (invisible instruction hiding) |
| ๐ด Critical | Unicode bidirectional control characters (RLO/LRO โ visually reverses text) |
| ๐ด Critical | Homoglyph attacks (Cyrillic/Greek mixed with Latin to impersonate words) |
| ๐ด Critical | Null bytes |
| ๐ด Critical | Classic injection phrases ("ignore all previous instructions", "you are now", etc.) |
| ๐ด Critical | Base64 blobs that decode to suspicious content |
| ๐ก Warning | HTML comments with hidden content |
| ๐ก Warning | Unknown external URLs with query params (potential exfiltration endpoints) |
| ๐ก Warning | Large base64 blobs |
| ๐ก Warning | Private Use Area unicode characters |
| ๐ก Warning | Oversized skill files |
### Honest limitations
The scanner catches **mechanical attacks** reliably. Semantically subtle prompt injection โ instructions that read naturally but subtly shift behaviour โ remains an unsolved problem in the field. Treat trusted sources (Anthropic official, Vercel official, repos you've manually inspected) as lower risk; treat unknown skills.sh packages as higher risk.
---
## The saas-design Skill
A synthesis of real-world SaaS design patterns, distinct from Anthropic's `frontend-design` skill:
| | `saas-design` (this kit) | `frontend-design` (Anthropic) |
|---|---|---|
| **Goal** | Production SaaS quality | Expressive, unforgettable |
| **Style** | Modern minimal, SaaS conventions | Brutalist, editorial, retro, luxury, etc. |
| **Component knowledge** | 60+ patterns from component.gallery | None |
| **Style presets** | Modern SaaS / Apple Minimal / Enterprise / Dashboard | Unlimited โ picks based on context |
| **When to use** | Dashboards, admin panels, forms, settings | Landing pages, portfolios, brand moments |
Both are available after install โ Claude picks the right one based on what you're building.
---
## Attribution
- **component.gallery** โ the UI component patterns that power `saas-design`'s `components.md`
https://component.gallery
- **@carmahhawwari** โ compiled and structured the component patterns into the original skill
https://github.com/carmahhawwari/ui-design-brain
- **Anthropic** โ original `frontend-design` skill
https://github.com/anthropics/skills
- **Upstash** โ Context7 MCP server
https://github.com/upstash/context7
- **steveyegge/beads** โ git-backed issue tracking for AI agents
https://github.com/steveyegge/beads
---
## Contributing
PRs welcome, especially:
- New scanner patterns (prompt injection signatures, new unicode attack vectors)
- Improvements to the `/new-project` scaffold
- Additional skills that meet the quality bar
If you add a scanner pattern, include a test case in `hooks/skill-scanner.sh`'s comments showing what it catches.
---
## License
MIT โ do what you want, attribution appreciated.