Skip to content
Back to skills

Scaffold Project

ASecurity

Scaffold a new design-product project that matches the recommended Claude Code layout (the reference structure). Use when starting a fresh product/app that will be built with this design system.

  • 1,539 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 6, 2026
designpythonshellgitapi

Works with

  • claude code
  • api
  • mcp

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 6, 2026

npx -y skills add plugin87/ux-ui-agent-skills --skill scaffold-project --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Scaffold Project?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Scaffold Project
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/plugin87-scaffold-project/badge)](https://www.skillsdirectory.com/skills/plugin87-scaffold-project)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: scaffold-project
description: Scaffold a new design-product project that matches the recommended Claude Code layout (the reference structure). Use when starting a fresh product/app that will be built with this design system.
# A command the user runs. Converted from .claude/commands/ so it has a
# CLAUDE_SKILL_DIR of its own and its paths resolve on every install route.
# disable-model-invocation keeps the behaviour a command had: the user
# starts it, the model never does, and its description stays out of the
# listing budget the model's skill choice is drawn from.
disable-model-invocation: true
---
> **Step 0 — is the kit here?** This skill reads files from the kit. Check once:
> `ls ${CLAUDE_SKILL_DIR}/../../../tokens >/dev/null 2>&1 && echo KIT_OK || echo KIT_MISSING`
> On `KIT_MISSING` only the skill folders were installed, which is what
> `npx skills add` does. Say so plainly, point the user at
> `npx ux-ui-agent-skills init` or the plugin install, and stop. Do not guess the
> contents of a file you could not open.

Generate a new design-project skeleton from `${CLAUDE_SKILL_DIR}/../../../templates/product-design/` into a target directory the user names.

The layout to produce (exactly the reference structure):

```
<target>/
  # CONTEXT CLAUDE LOADS
  CLAUDE.md              the brief Claude reads every session
  CLAUDE.local.md        your personal prefs, gitignored
  .mcp.json              Figma, Notion, Drive connections

  # TEAM TOOLKIT
  .claude/
    rules/               conventions, loaded only when relevant
    skills/              repeatable workflows, off main context
    commands/            your custom slash commands
    settings.json        shared permissions, checked into git

  # YOUR PROJECT
  design-tokens.json     source of truth: color, type, spacing
  src/components/        the real UI Claude reads and edits
  public/images/         real images so prototypes don't break
  reference/             real screens Claude studies for context
```

The fast path, when the kit is installed or reachable via npx:

```
npx ux-ui-agent-skills new <target>
```

That does steps 2 and 3 below in one call (template copied, `CLAUDE.local.md`
un-suffixed, engine areas installed without overwriting the lean brief). Then pick
up at step 4. The manual steps are spelled out so the same result can be produced
by hand from a clone.

Steps:
1. Ask for the target directory if not given. Create it if it does not exist.
2. Copy every file of `${CLAUDE_SKILL_DIR}/../../../templates/product-design/` into it, preserving the tree.
   Two rules on the copy:
   - `CLAUDE.local.md.template` lands as `CLAUDE.local.md` (the suffix exists
     only so the kit's own gitignore cannot swallow the file).
   - `.gitkeep` stays in `.claude/skills/`, `.claude/commands/`,
     `src/components/`, `public/images/`, and `reference/` so the empty folders
     survive the first commit.
   The template already ships `.gitignore` (which ignores `CLAUDE.local.md`),
   `.mcp.json`, `.claude/settings.json`, and three rules files
   (`components.md`, `tokens.md`, `accessibility.md`).
3. Install the engine next to it so the gates the brief references actually run:

   ```
   npx ux-ui-agent-skills add tokens components taste accessibility \
       workflows content frameworks design-systems scripts skills
   ```

   Use `add`, not `init`: `init` also writes the full engine `CLAUDE.md` over the
   lean project brief. The project brief stays short by design, and the engine
   knowledge loads from the copied folders when a task needs it.
4. Install the render gates' one dependency in the target: `npm i -D playwright`.
   Skipping this is silent: every render gate prints `SKIPPED` and exits 0.
5. Fill in the placeholders in `CLAUDE.md` with the user: product, primary user,
   stack, icon set, vocabulary. Leave nothing in angle brackets behind.
6. Point `design-tokens.json` at the brand: replace the `primitive.brand` ramp,
   keep the semantic and component tiers, then prove it still passes:

   ```
   python3 ${CLAUDE_SKILL_DIR}/../../../scripts/validate_contrast.py
   ```

7. Remind the user to fill `reference/` with real screens and `public/images/`
   with real imagery, and to set the MCP env vars (`FIGMA_API_KEY`, ...) in their
   own shell. Never write a secret into `.mcp.json`.

Verify before handing over: the target tree matches the layout above, and

```
python3 ${CLAUDE_SKILL_DIR}/../../../scripts/validate_template.py
```

passes against the source template.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…