project-artifact

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 159d63a7c255 · 31 Oct 2026Report an issue or request a re-scan

• Publisheranthropics GitHub organizationOwner of the repository this skill is read from
• Source folderanthropics/claude-plugins-official/plugins/project-artifact/skills/project-artifactThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict159d63a7c255A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks &…

---
name: project-artifact
description: Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.
user-invocable: true
---

# project-artifact — an opinionated project status page

This skill produces one specific *kind* of artifact: a tabbed status page that represents a
project too big for one update — a software migration, a research effort, a launch, an org
initiative; anything with a set of parallel/dependent workstreams tracked over time. It
generates the HTML (one file, self-contained — the Artifact CSP blocks all external hosts,
so everything is inlined; the only `<script>` is the tab switcher) and publishes it with
the built-in `Artifact` tool to `https://claude.ai/code/artifact/<uuid>`. The page is
default-private; the viewer gives the owner a version picker and lets them share it with
teammates. (The general "render any HTML/Markdown to a web page" capability is the built-in
`Artifact` tool; this is the project-tracker structure on top — defining what an artifact
*is* belongs to that tool, not here.)

The SWE specifics for PR-driven projects are in `swe.md`, kept out of this file so the
project-artifact structure stays domain-neutral.

## Workflow

1. **Resolve the artifact config, then locate the project.** Each project gets a directory
   at `${CLAUDE_PLUGIN_DATA}/artifacts/<slug>/` holding `config.md` (see **"The artifact
   config"** below) and `page.html` (the current render); listing `artifacts/` is the
   registry of this skill's artifacts on this machine (enumerate it with Glob or a
   directory read — a shell listing of the data dir can be blocked in restricted
   environments). If the user names a project,
   load that slug; if exactly one config matches the session (its repo is the cwd, or its
   project came up in conversation), use it; a config that exists means this is a
   **refresh** — follow **"Refreshing an artifact"** below. No config means a first build:
   gather from scratch and write the config after the first publish — but if the user says
   the project already has a published artifact (made on another machine or in a lost
   session), get that URL and record it instead of minting a new one.
   Then collect the source material: the goal, the set of workstreams (PRs, milestones,
   sub-projects, tasks), owners, dates, and any sibling docs (design doc, plan, spec).
   Pull whatever the domain gives you cheaply — always live, never from memory or earlier
   turns — for software that's `gh pr list` / `git log` / `gh pr view` (see `swe.md`); for
   other domains it's the project doc, a tracker, a spreadsheet, your own notes. If the
   source is itself an existing `claude.ai/code/artifact/...` page to reshape, fetch it —
   see **"Reading an existing artifact page"** below. Don't ask the user to paste content or hand you a local file
   as a substitute for fetching it yourself.

2. **Pick the tabs** from the catalog below — only the ones with real content.
   **Overview** and the **Workstreams** sequence are the spine and are essentially always
   there; **Attention**, **Background**, **Plan**, **Risks & open questions**, and
   **Decisions/FAQ** each earn a tab only when there's something substantive to put in it
   (a simple, self-explanatory project may have just Overview + Workstreams; a big one ~6–8). Never
   ship an empty tab. If this is a software project, `swe.md` notes the extra tabs a
   rigorous one tends to want — none of them mandatory.

3. **Generate the HTML** from `template.html` in this skill directory (same folder as this
   SKILL.md): it already has the house style (light/dark via `prefers-color-scheme`, CSS
   variables), the header, the status banner, the next-steps strip, both tab mechanisms
   (JS-toggled panes as the default; pure-CSS radio tabs as a no-JS alternative), the
   status-pill classes, and a stub `<section>` per catalog tab with fill-in comments. Fill the stubs, delete unused
   tabs, keep it one file. **Set a concise `<title>`** — the Artifact tool uses it as the
   page's name in the browser tab and the claude.ai gallery, and falls back to the file
   basename without one; keep it stable across redeploys. **Write the file to the config's
   `html` path** — default `${CLAUDE_PLUGIN_DATA}/artifacts/<slug>/page.html`, next to the
   config (not `/tmp`; not inside the user's repo unless they ask — if they do, use
   `<repo>/.claude/project-artifact/<slug>.html` and record it as the config's `html` path):
   a stable path means the Artifact tool redeploys to the same URL within a session, and
   the previous render stays around for the next refresh's delta. **Embed the state
   block** (see "Refreshing an artifact") so the next run can compute what changed.

4. **Review the output for cut-off text and overflow.** Before publishing, re-read the
   file and check that nothing gets clipped or truncated: fixed-width table columns
   squeezing their contents, long unbroken strings (URLs, PR/branch names, IDs) overflowing
   their container, anything sitting behind `overflow:hidden` or `white-space:nowrap`. The
   viewport is unknown (could be a phone): wide content — tables, diagrams, code blocks 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-31
   ✓SAFE B 89 / 100

   first audit · source 159d63a7c255

Questions about project-artifact

• github.com/anthropics/claude-plugins-official/tree/main/plugins/ — the audited source at commit 159d63a7c255 and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology