Building BlogSAFE
CLI tool for configuring and monitoring Claude Code
Overview
CLI tool for configuring and monitoring Claude Code
aa855ad1e58dOBSERVED · 2026-10-02Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| codex | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: building-blog
description: "Use when adding a blog to a Next.js + Sanity site, building a blog section from scratch, integrating Sanity CMS for editorial content, or setting up an SEO-optimized article surface. Triggers on phrases like 'add a blog', 'build the blog', 'create blog section', 'set up blog with Sanity', 'integrate Sanity CMS', 'blog architecture', or any new-blog scoping conversation on a Next.js project."
risk: safe
source: community
date_added: "2026-05-21"
---
# Building a Blog (Next.js + Sanity)
## Overview
Universal workflow for adding a blog to a Next.js site backed by Sanity CMS. Targets a corporate blog: SEO-first, i18n-ready, performance-budgeted, accessibility-compliant.
**SKILL.md is the orchestrator. The spec lives in the two reference files.**
## Files
- `blog-technical-requirements.md` — §0 intake questionnaire (30+ questions) → §1 Project Profile → §2–§20 universal spec → checklist. Edit only §0 answers and §1 per project.
- `blog-image-style-guide.md` — universal template for AI-generated hero imagery via Gemini 3 Pro Image (Nano Banana Pro). Intake questions on top, aesthetic skeleton in the middle, three example slots at the bottom.
## Workflow
### Step 1 — Scan the host project (before asking anything)
Read what's already there. Pre-filling answers from detected values is much better than asking the user. Look for:
- `package.json` — Next.js version, `next-intl`, Sanity packages, Tailwind, `framer-motion`
- `next.config.{ts,js,mjs}` — existing `images.formats`, i18n config
- `src/messages/**`, `src/i18n/**`, `messages/**` — current locale set
- `src/app/[locale]/**` or `app/[locale]/**` — routing pattern
- `tailwind.config.*`, `globals.css`, design-system files — tokens, fonts
- `CLAUDE.md`, `AGENTS.md`, `GEMINI.md` — project conventions and approved overrides
- Existing `sanity-studio/` or `studio/` folder
- `app/layout.{tsx,jsx}` — fonts, analytics, motion config
- `public/brand/**`, `public/logo*` — publisher logo
- `sitemap.ts`, `robots.ts` — existing routes
- `.env*` files — names of already-set env vars (do not log secret values)
Record findings as a brief "Detected" list before the questionnaire.
### Step 2 — Run the intake questionnaire
Open `blog-technical-requirements.md` and walk through §0.
- **Claude Code:** use `AskUserQuestion`. Group related questions into single calls (max 4 per call). Pre-fill recommended answers from the scan.
- **Codex / CLIs without an interactive picker:** list questions numerically in plain text, ask the user to answer in batches of 5–10. Show recommended answers from the scan.
- **Headless / non-interactive:** apply universal defaults to whatever the prompt did not explicitly cover; list every assumption.
Write the answers into §1 "Project Profile" (in a project-local copy under `docs/blog/`, not in the universal source).
### Step 3 — Produce the high-level plan
Use the plan template at the end of §0. One page. Phases, locked-in scope, out-of-scope items, open decisions. **Wait for explicit user approval. Do not start coding.**
### Step 4 — Implement against the spec
Follow §2–§20 in order. §19 (Pass/Fail Checklist) is the definition of done. The image style guide drives §20 if AI-generated hero images are in scope.
## When NOT to use this skill
- Static / MDX-only blogs (no CMS) — different stack, different patterns
- High-velocity news publishers — sitemap chunking and editor tooling become primary concerns
- Documentation sites — use a docs framework instead
- Marketing landing pages that aren't really a blog
## Source
Maintained at [BuildShipGrowRepeat/nextjs-sanity-blog-skill](https://github.com/BuildShipGrowRepeat/nextjs-sanity-blog-skill). MIT licensed.Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
aa855ad1e58dfull audit observations/trust-audit/skill/davila7__building-blog.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-02 | aa855ad1e58d | SAFE | B | 89 | first audit |
Questions
What does the Building Blog skill do?
CLI tool for configuring and monitoring Claude Code
Is Building Blog safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Building Blog access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Building Blog work with?
Its documentation mentions claude-code and codex. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (aa855ad1e58d), read on 2026-10-02. The repository is watched, and a new audit runs when it changes — this is the first audit.