Atlas / Skills / davila7 / Building Blog

Building BlogSAFE

skills/davila7/building-blog

CLI tool for configuring and monitoring Claude Code

Verdict
SAFE
Grade
B
Trust score
89 /100
Version
—
Hosts
2 documented
License
MIT
Stars
32,283
01

Overview

CLI tool for configuring and monitoring Claude Code

Read from source at commit aa855ad1e58dOBSERVED · 2026-10-02
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
codexmentioned
03

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: building-blog
description: "Use when adding a blog to a Next.js + Sanity site, building a blog section from scratch, integrating Sanity CMS for editorial content, or setting up an SEO-optimized article surface. Triggers on phrases like 'add a blog', 'build the blog', 'create blog section', 'set up blog with Sanity', 'integrate Sanity CMS', 'blog architecture', or any new-blog scoping conversation on a Next.js project."
risk: safe
source: community
date_added: "2026-05-21"
---

# Building a Blog (Next.js + Sanity)

## Overview

Universal workflow for adding a blog to a Next.js site backed by Sanity CMS. Targets a corporate blog: SEO-first, i18n-ready, performance-budgeted, accessibility-compliant.

**SKILL.md is the orchestrator. The spec lives in the two reference files.**

## Files

- `blog-technical-requirements.md` — §0 intake questionnaire (30+ questions) → §1 Project Profile → §2–§20 universal spec → checklist. Edit only §0 answers and §1 per project.
- `blog-image-style-guide.md` — universal template for AI-generated hero imagery via Gemini 3 Pro Image (Nano Banana Pro). Intake questions on top, aesthetic skeleton in the middle, three example slots at the bottom.

## Workflow

### Step 1 — Scan the host project (before asking anything)

Read what's already there. Pre-filling answers from detected values is much better than asking the user. Look for:

- `package.json` — Next.js version, `next-intl`, Sanity packages, Tailwind, `framer-motion`
- `next.config.{ts,js,mjs}` — existing `images.formats`, i18n config
- `src/messages/**`, `src/i18n/**`, `messages/**` — current locale set
- `src/app/[locale]/**` or `app/[locale]/**` — routing pattern
- `tailwind.config.*`, `globals.css`, design-system files — tokens, fonts
- `CLAUDE.md`, `AGENTS.md`, `GEMINI.md` — project conventions and approved overrides
- Existing `sanity-studio/` or `studio/` folder
- `app/layout.{tsx,jsx}` — fonts, analytics, motion config
- `public/brand/**`, `public/logo*` — publisher logo
- `sitemap.ts`, `robots.ts` — existing routes
- `.env*` files — names of already-set env vars (do not log secret values)

Record findings as a brief "Detected" list before the questionnaire.

### Step 2 — Run the intake questionnaire

Open `blog-technical-requirements.md` and walk through §0.

- **Claude Code:** use `AskUserQuestion`. Group related questions into single calls (max 4 per call). Pre-fill recommended answers from the scan.
- **Codex / CLIs without an interactive picker:** list questions numerically in plain text, ask the user to answer in batches of 5–10. Show recommended answers from the scan.
- **Headless / non-interactive:** apply universal defaults to whatever the prompt did not explicitly cover; list every assumption.

Write the answers into §1 "Project Profile" (in a project-local copy under `docs/blog/`, not in the universal source).

### Step 3 — Produce the high-level plan

Use the plan template at the end of §0. One page. Phases, locked-in scope, out-of-scope items, open decisions. **Wait for explicit user approval. Do not start coding.**

### Step 4 — Implement against the spec

Follow §2–§20 in order. §19 (Pass/Fail Checklist) is the definition of done. The image style guide drives §20 if AI-generated hero images are in scope.

## When NOT to use this skill

- Static / MDX-only blogs (no CMS) — different stack, different patterns
- High-velocity news publishers — sitemap chunking and editor tooling become primary concerns
- Documentation sites — use a docs framework instead
- Marketing landing pages that aren't really a blog

## Source

Maintained at [BuildShipGrowRepeat/nextjs-sanity-blog-skill](https://github.com/BuildShipGrowRepeat/nextjs-sanity-blog-skill). MIT licensed.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.

Audited 2026-10-02 · audit v0.4.1 · source sha aa855ad1e58dfull audit observations/trust-audit/skill/davila7__building-blog.json · Report an issue / request a re-scan
05

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-02aa855ad1e58dSAFEB89first audit
06

Questions

What does the Building Blog skill do?

CLI tool for configuring and monitoring Claude Code

Is Building Blog safe to install?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.

What can Building Blog access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

Which assistants does Building Blog work with?

Its documentation mentions claude-code and codex. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (aa855ad1e58d), read on 2026-10-02. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement