skillhash

Is project-artifact safe?

Grade A, 98/100. No meaningful risk found.

Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.

anthropics/claude-plugins-official/plugins/project-artifact/skills/project-artifact 43kChecked 3h agoContent last changed 3h ago
A

project-artifact

plugins/project-artifact/skills/project-artifact
98/100 · No meaningful risk found1 low

Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.

Content hash
sha256:96919a8d3e525f32992a4fd3793998c28078035970255cd7389d9848f2326c59
Files
3
Quality
100/100

Security findings

  • lowHides actions from the userSL102 · plugins/project-artifact/skills/project-artifact/SKILL.md:43
    see **"Reading an existing artifact page"** below. Don't ask the user to paste content or hand you a local file

    The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md19.9 KB
  • swe.md5.4 KB
  • template.html20.3 KB

Questions about project-artifact

Is project-artifact safe to install?
Our scanner gave project-artifact grade A (98/100): no meaningful risk found. It matched 1 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
How do I install project-artifact in Claude Code or Codex?
Run skillhash add github:anthropics/claude-plugins-official/plugins/project-artifact/skills/project-artifact. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
What happens if project-artifact changes upstream?
Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.

More from anthropics/claude-plugins-official