Team UpdateSAFE
Skills for Claude Code CLI such as full stack dev Cloudflare, React, Tailwind v4, and AI integrations.
Overview
Skills for Claude Code CLI such as full stack dev Cloudflare, React, Tailwind v4, and AI integrations.
be410003e718OBSERVED · 2026-10-12What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: team-update description: "Post project updates to team chat, gather feedback, triage responses, and plan next steps. Adapts to available tools (chat, git, issues, tasks). First run discovers tools and saves a playbook; subsequent runs execute from the playbook. Trigger with 'team update', 'post update', 'sync with team', 'standup', 'check team chat', 'feedback loop', 'project update', 'what did the team say'." compatibility: claude-code-only allowed-tools: "*" --- # Team Update Post project updates to team chat, read and triage feedback, and plan next steps. Adapts to whatever communication and project tools are available. ## The Playbook Pattern This skill uses a **playbook** file at `.claude/team-update-playbook.md` in the project root. - **First run**: Discover available tools, ask the user for preferences, execute, save a playbook - **Subsequent runs**: Read the playbook, skip discovery, execute directly - **User edits playbook**: Changes take effect immediately (channel, style, triage rules) The playbook is plain markdown the user can edit. It captures tool configuration, channel preferences, message style, triage rules, and last-run metadata. --- ## Phase 0: Playbook Check Check if `.claude/team-update-playbook.md` exists in the project root. **If it exists**: Read it. All tool configuration, channel info, message style, and triage rules are in there. Jump to Phase 1 with known config. **If it does not exist**: Run Phase 0b (Discovery) first. --- ## Phase 0b: Discovery (First Run Only) Detect available capabilities by checking what MCP tools are connected and what local tools exist. Read [references/discovery-patterns.md](references/discovery-patterns.md) for detection patterns. ### Capability Detection Check for each capability category: | Capability | How to detect | Fallback if missing | |---|---|---| | **Chat** | MCP tools matching `chat`, `slack`, `discord`, `teams` | Output formatted text for manual posting | | **Git** | `git rev-parse --is-inside-work-tree` | Skip commit summaries | | **Issues** | MCP tools matching `github`, `linear`, `jira` | Skip or output text list | | **Tasks** | MCP tools matching `tasks`, `todos`, `asana` | Skip or output text list | | **Knowledge** | Basalt Cortex (`~/Documents/basalt-cortex/`) | Search for related knowledge notes | ### User Preferences (Ask) After discovery, ask the user to confirm: 1. **Channel**: Which chat space/channel to post updates to? (List discovered options) 2. **Identity**: Post as yourself or a bot identity? (e.g. Anthro Morphic) 3. **Repo scope**: Which repo(s) to track? (Default: current repo) 4. **Message style**: Brief standup, detailed changelog, or conversational update? 5. **Team context**: Any team members to be aware of? (Names, roles) 6. **Triage rules**: Any custom rules for handling feedback? (Or use defaults) ### Save Playbook After discovery + user preferences, save the playbook to `.claude/team-update-playbook.md`. Read [references/playbook-format.md](references/playbook-format.md) for the full template. Fill in all sections with discovered tools and user preferences. If a capability was not found, note it as "Not available" in the playbook. Ensure `.claude/` is in `.gitignore` (the playbook contains space IDs and preferences that shouldn't be committed). --- ## Phase 1: Gather Context Collect information from all available sources. Use the playbook's "Data Sources" section to know which tools to call. ### 1a. Determine Time Window Check the playbook's "Last Run" section for the last update timestamp. If no previous run, ask the user how far back to go (default: 24 hours). ### 1b. Collect Data Gather from each available source: | Source | What to collect | Tool | |---|---|---| | **Git commits** | `git log --oneline --since=<last-update>` | Bash | | **Chat messages** | Messages in the configured channel since last update | Chat MCP tool from playbook | | **Open issues/PRs** | Recently updated or newly created items | Issue tracker from playbook | | **Active tasks** | In-progress or recently completed tasks | Task tracker from playbook | ### 1c. Summarise for Drafting Group commits by theme (not individual hashes). Note any issues closed, PRs merged, or tasks completed. Flag any team messages that need response. --- ## Phase 2: Draft and Post Update ### 2a. Compose Message Read [references/message-composition.md](references/message-composition.md) for message patterns. Follow the playbook's "Message Style" section. General principles: - Lead with what shipped or changed, not process - Group related commits into themes - Mention specific people only when relevant - Keep it scannable (short paragraphs, bullet points) - **Write like a teammate, not an AI** — no emoji spam, no hedging, no over-explaining context the team already has. See the Communication Style section in [references/message-composition.md](references/message-composition.md). ### 2b. Preview and Approval Show the draft to the user. Include: - The composed message - Which channel it will be posted to - Whether it's a new message or thread reply **APPROVAL REQUIRED**: Never post to external channels without explicit user approval. ### 2c. Post Post the approved message using the chat tool from the playbook. If no chat tool is available, output the formatted message for the user to post manually. ### 2d. Update Playbook After posting, update the "Last Run" section of the playbook with: - Current timestamp - Thread key (if applicable) - Brief summary of what was posted --- ## Phase 3: Read and Triage Feedback ### 3a. Read Responses Read messages from the configured channel since the update was posted. Look for: - Direct replies to the update - New messages in the channel that reference the project - Reactions or acknowledgements ### 3b. Classify Feedback Read [references/feedback-triage.md](references/feedback-triage.md) for classification patterns. Use the playbook's "Triage Rules" se
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
be410003e718full audit observations/trust-audit/skill/jezweb__team-update.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | be410003e718 | SAFE | B | 89 | first audit |
Questions
What does the Team Update skill do?
Skills for Claude Code CLI such as full stack dev Cloudflare, React, Tailwind v4, and AI integrations.
Is Team Update safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Team Update access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (be410003e718), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.