1. .claude/templates/README.md

   - Add template entry

2. .claude/context/artifacts/catalogs/template-catalog.md

   - Add catalog entry
3. CLAUDE.md Section 2 or 8.5 if template is framework-significant or user-invocable
4. Consuming creator skill if template standardizes an artifact type

5. .claude/context/memory/learnings.md

   - Record creation

grep "<template-name>" .claude/templates/README.md || echo "ERROR: README NOT UPDATED!"
grep "<template-name>" .claude/context/artifacts/catalogs/template-catalog.md || echo "ERROR: CATALOG NOT UPDATED!"

• Agent definitions - Standardized agent structures
• Skill definitions - Reusable capability patterns
• Workflow definitions - Multi-agent orchestration patterns
• Spawn prompts - Agent spawn prompt templates consumed by

  spawn-template-resolver.cjs

• Reports - Report document templates
• Code style guides - Language-specific coding standards
• General documents - ADRs, specs, checklists, and other framework documents

• Creating a new type of artifact that will be replicated
• Standardizing an existing pattern across the codebase
• Adding a new template category
• Improving existing templates with better patterns

• One-off files that will never be replicated
• Temporary/throwaway code

1. No Secrets (SEC-TC-007): Templates MUST NOT include secrets, credentials, tokens, or API keys
2. Path Safety: All template references MUST use relative paths (

   .claude/templates/...

   ), never absolute paths
3. No Sensitive Metadata: Templates MUST NOT expose internal system paths or user directories
4. No Windows Reserved Names: Template names MUST NOT use

   nul

   ,

   con

   ,

   prn

   ,

   aux

   ,

   com1

   -

   com9

   ,

   lpt1

   -

   lpt9

5. Retention Mandates (SEC-TMPL-006): Templates flagged by SEC-TMPL-006 MUST remain at designated locations
6. Spawn Template Placeholder Safety (SEC-TC-001): Spawn templates with

   {{PLACEHOLDER}}

   tokens in

   prompt:

   fields MUST reference

   sanitizeSubstitutionValue()

   from

   prompt-factory.cjs

   for value sanitization. Unsanitized placeholders in spawn prompts create a prompt injection surface. Do NOT place

   {{PLACEHOLDER}}

   tokens where user-provided input is directly substituted without sanitization.
7. No Eval/Exec: Templates MUST NOT contain

   eval()

   ,

   exec()

   ,

   Function()

   , or other code execution patterns

unified-creator-guard.cjs

NO TEMPLATE WITHOUT PLACEHOLDER DOCUMENTATION

{{PLACEHOLDER}}

1. What value should replace it
2. Valid options/formats
3. Example value

• Every placeholder is documented
• Every required field is marked
• Every optional field has a default

research-synthesis

Skill({ skill: 'research-synthesis' });

• Search existing templates:

  Glob: .claude/templates/**/*.md

• Review template catalog: Read

  .claude/context/artifacts/catalogs/template-catalog.md

• Check if similar template already exists in the ecosystem
• If creating for a new domain, research best-practice template structures via WebSearch

1. Use

   companion-check.cjs

   from

   .claude/lib/creators/companion-check.cjs

2. Call

   checkCompanions("template", "{template-name}")

   to identify companion artifacts
3. Review the companion checklist — note which required/recommended companions are missing
4. Plan to create or verify missing companions after this artifact is complete
5. Include companion findings in post-creation integration notes

1. Template Type: Which category (spawn, agent, skill, workflow, report, code-style, document)?
2. Purpose: What will this template be used for?
3. Required Fields: What fields are mandatory?
4. Optional Fields: What fields are optional with defaults?
5. Validation Rules: What constraints apply?
6. Consumers: Which creators/agents will use this template?

Template Request: "Create a template for security audit reports"
- Type: Report
- Purpose: Standardize security audit report structure
- Required: findings, severity_levels, recommendations
- Optional: compliance_framework, remediation_timeline
- Rules: severity must be CRITICAL|HIGH|MEDIUM|LOW
- Consumers: security-architect, qa

/^[a-z0-9][a-z0-9-]*[a-z0-9]$/

• Lowercase letters, digits, and hyphens only
• Must start and end with a letter or digit (not a hyphen)
• No path separators (

  /

  ,

  \

  ), no

  ..

  , no special characters
• No Windows reserved names (

  nul

  ,

  con

  ,

  prn

  ,

  aux

  ,

  com1

  -

  com9

  ,

  lpt1

  -

  lpt9

  )

REJECTED: "../hooks/malicious-hook"  (path traversal)
REJECTED: "My Template"             (spaces, uppercase)
REJECTED: "-leading-hyphen"         (starts with hyphen)
REJECTED: "template_with_underscores" (underscores not allowed)
ACCEPTED: "security-audit-report"   (valid kebab-case)
ACCEPTED: "agent-template-v2"       (valid with version)

.claude/templates/<category>/<validated-template-name>.md

<category>

spawn/

agents/

skills/

workflows/

reports/

code-styles/

• Path MUST start with

  .claude/templates/

• Path MUST NOT contain

  ..

  segments after normalization
• Path MUST end with

  .md

• No

  {{PLACEHOLDER}}

  tokens inside

  prompt:

  fields that accept unsanitized user input
• Reference to

  sanitizeSubstitutionValue()

  from

  prompt-factory.cjs

  included in documentation
• TaskUpdate protocol is present in the spawn prompt body

• allowed_tools

  array does not grant

  Task

  tool to non-orchestrator agents
• No prompt override patterns (

  IGNORE PREVIOUS

  ,

  SYSTEM:

  , etc.) in template body
• Template size under 50KB

model: { { MODEL:sonnet } }

undefined

1. Read current catalog:
   bash

   cat .claude/context/artifacts/catalogs/template-catalog.md

2. Determine template category based on type:
   • Spawn (

     spawn/

     ), Creator (

     agents/

     ,

     skills/

     ,

     workflows/

     ), Document (root), Report (

     reports/

     ), Code Style (

     code-styles/

     )
3. Add template entry in correct category section:
   markdown

   ### <template-name>.md
   
   | Field              | Value                                             |
   | ------------------ | ------------------------------------------------- |
   | **Path**           | `.claude/templates/<category>/<template-name>.md` |
   | **Category**       | <Category> Templates                              |
   | **Status**         | active                                            |
   | **Used By Agents** | <agent-list>                                      |
   | **Used By Skills** | <skill-list>                                      |
   
   **Purpose:** <Purpose description>

4. Update Template Categories Summary table (totals row)
5. Verify update:
   bash

   grep "<template-name>" .claude/context/artifacts/catalogs/template-catalog.md || echo "ERROR: CATALOG NOT UPDATED!"

JSON.stringify()

location

.claude/templates/

..

.claude/templates/README.md

1. Add to appropriate section (or create new section)
2. Document usage instructions
3. Add to Quick Reference table

undefined

{{directory}}/{{template-name}}.md

1. Copy template to

   {{target-path}}

2. Replace all

   {{PLACEHOLDER}}

   values
3. {{Additional steps}}

**Verification:**

```bash
grep "<template-name>" .claude/templates/README.md || echo "ERROR: README NOT UPDATED - BLOCKING!"

1. Check if template needs CLAUDE.md entry:
   • Is it a new spawn template? -> Update Section 2 (Spawn Templates)
   • Is it a new creator template? -> Update relevant creator section
   • Is it a user-invocable template? -> Update Section 8.5
2. If YES, add entry:
   markdown

   **{Template Name}:** `.claude/templates/{category}/{name}.md`

3. Verify:
   bash

   grep "<template-name>" .claude/CLAUDE.md || echo "WARNING: Template not in CLAUDE.md (may be OK if internal-only)"

1. Identify consumers based on template type:
   • Agent templates -> agent-creator skill should reference
   • Skill templates -> skill-creator skill should reference
   • Workflow templates -> workflow-creator skill should reference
   • Report templates -> relevant agents (qa, developer, etc.)
   • Spawn templates -> router documentation, spawn-template-resolver
   • Code style templates -> developer, code-reviewer
2. Update consuming skill/agent to reference the template:
   markdown

   **Available Templates:**
   
   - See `.claude/templates/<category>/<template-name>.md` for standardized <type> template

3. Verify at least one consumer references the template:
   bash

   grep -r "<template-name>" .claude/skills/ .claude/agents/ || echo "WARNING: No consumer references template"

TaskUpdate({ status: "completed" })

1. Run the integration checklist:
   bash

   node .claude/tools/cli/validate-integration.cjs .claude/templates/<category>/<template-name>.md

2. Verify exit code is 0 (all checks passed)
3. If exit code is 1 (one or more checks failed):
   • Read the error output for specific failures
   • Fix each failure:
     • Missing README entry -> Add to

       .claude/templates/README.md

     • Missing catalog entry -> Add to

       template-catalog.md

     • Missing memory update -> Update

       learnings.md

   • Re-run validation until exit code is 0
4. Only proceed when validation passes

.claude/workflows/core/post-creation-validation.md

• Templates:

  .claude/templates/{category}/

  (spawn, agents, skills, workflows, reports, code-styles)
• Archived templates:

  .claude/templates/_archive/

• Template catalog:

  .claude/context/artifacts/catalogs/template-catalog.md

• Tests:

  tests/

  (NOT in

  .claude/

  )

• Reference files use @notation: @TOOL_REFERENCE.md, @SKILL_CATALOG_TABLE.md
• Located in:

  .claude/docs/@*.md

• See: CLAUDE.md Section 2 (Spawn Templates)

• Spawn templates MUST include:

  cd "$PROJECT_ROOT" || exit 1

  for background tasks
• Environment variables control validators (block/warn/off mode)
• See:

  .claude/docs/SHELL-SECURITY-GUIDE.md

• Apply to: all spawn templates, background task templates

• Templates MUST NOT include hardcoded secrets, credentials, or API keys
• Templates MUST use relative paths (

  .claude/templates/...

  ), never absolute paths
• Templates MUST NOT expose internal system paths or user directories
• Retention mandates: security-design-checklist.md and error-recovery-template.md must remain at designated locations
• Spawn template placeholder sanitization: reference

  sanitizeSubstitutionValue()

  in

  prompt-factory.cjs

• ADR-075: Router Config-Aware Model Selection
• ADR-076: File Placement Architecture Redesign
• ADR-077: Shell Command Security Architecture
• ADR-085: Template System Overhaul (spawn resolver + dead template cleanup)
• ADR-086: Template-Creator Overhaul to v2.1 Creator Standard

.claude/templates/spawn/universal-agent-spawn.md

• Has clear placeholder documentation
• Placeholders are UPPERCASE with underscores
• Has usage examples section
• Has integration notes
• Has POST-CREATION CHECKLIST
• Has Memory Protocol

1. YAML Frontmatter First
   • All machine-readable metadata
   • Comments explaining each field
2. POST-CREATION CHECKLIST Second
   • Blocking steps after using template
   • Verification commands
3. Content Sections
   • Follow existing pattern for type
   • Include all required sections
4. Memory Protocol Last
   • Standard format across all templates
   • Always present

.claude/workflows/core/router-decision.md

• How the Router discovers and invokes this skill's artifacts

.claude/workflows/core/skill-lifecycle.md

• Discovery, creation, update, deprecation phases
• Version management and registry updates
• CLAUDE.md integration requirements

.claude/workflows/core/external-integration.md

• Safe integration of external artifacts
• Security review and validation phases

.claude/lib/spawn/spawn-template-resolver.cjs

• Programmatic template selection for spawn operations
• Template scoring and fallback logic

.claude/templates/

• spawn/

  - Agent spawn prompt templates (4 templates)

• agents/

  - Agent definition templates (2 templates)

• skills/

  - Skill definition templates (1 template)

• workflows/

  - Workflow definition templates (1 template)

• reports/

  - Report document templates (5 templates)

• code-styles/

  - Language style guides (3 templates)
• Root level - General document templates (8+ templates)

• _archive/

  - Archived/deprecated templates (14 templates)

• File Placement: See

  .claude/docs/FILE_PLACEMENT_RULES.md

• Developer Workflow: See

  .claude/docs/DEVELOPER_WORKFLOW.md

• Artifact Naming: See

  .claude/docs/ARTIFACT_NAMING.md

• Workspace Conventions: See

  .claude/rules/workspace-conventions.md

  (output placement, naming, provenance)

1. Research: Invoke

   research-synthesis

   , review existing report templates in

   .claude/templates/reports/

2. Gather: Analyze report type, security focus, audit findings structure
3. Validate name:

   security-audit-report-template

   matches

   /^[a-z0-9][a-z0-9-]*[a-z0-9]$/

4. Design: Structure for security audit reports
5. Create:

   .claude/templates/reports/security-audit-report-template.md

---

severity_levels: [CRITICAL, HIGH, MEDIUM, LOW]

• All findings categorized by severity
• Recommendations actionable and specific
• Evidence provided for all claims

1. Research: Invoke

   research-synthesis

   , review

   .claude/templates/spawn/universal-agent-spawn.md

2. Gather: Analyze spawn pattern, specialized vs general-purpose
3. Validate name:

   specialized-agent-spawn

   matches name regex
4. Design: Structure for specialized spawn prompts with security considerations (SEC-TC-001)
5. Create:

   .claude/templates/spawn/specialized-agent-spawn.md

---

complexity: { { COMPLEXITY:medium } }

• task_id is unique and matches prompt
• Model matches agent complexity requirements
• TaskUpdate protocol included in prompt
• Success criteria clearly defined
• No unsanitized user input in prompt field

6. **Update catalog**: Add to template-catalog.md under Spawn Templates
7. **Update README**: Add to spawn section in templates README
8. **Update CLAUDE.md**: Add to Section 2 (Spawn Templates) if framework-standard
9. **Assign consumers**: Update router and spawn-template-resolver references
10. **Update memory**: Record in learnings.md

---

{{PLACEHOLDER}}

• Check placeholder format (double braces, UPPER_CASE)
• Ensure user replaced all placeholders
• Add validation command to catch unreplaced

• Verify template-catalog.md is updated (Step 8)
• Verify README.md is updated (Step 9)
• Check file is in correct directory
• Run:

  grep "<template-name>" .claude/context/artifacts/catalogs/template-catalog.md

• Review existing templates before creating
• Use this skill's patterns
• Compare against reference template (universal-agent-spawn.md)
• Run consistency check across templates

• Review SEC-TC-001 guidance in this skill
• Ensure

  sanitizeSubstitutionValue()

  is referenced
• Do not place

  {{PLACEHOLDER}}

  tokens directly in

  prompt:

  fields for user input
• Use structured task descriptions that separate user content from system instructions

unified-creator-guard.cjs

• Ensure you invoked this skill properly:

  Skill({ skill: 'template-creator' })

• Check that the creator state is active (3-minute TTL)
• If debugging:

  CREATOR_GUARD=warn

  (temporary, restore to

  block

  after)
• Never use

  CREATOR_GUARD=off

  in production

cat .claude/context/memory/learnings.md

• Previously created templates
• Known template patterns
• User preferences for template behavior

• New template pattern ->

  .claude/context/memory/learnings.md

• Issue found ->

  .claude/context/memory/issues.md

• Decision made ->

  .claude/context/memory/decisions.md

ASSUME INTERRUPTION: If it's not in memory, it didn't happen.

1. Call

   runIntegrationChecklist(artifactType, artifactPath)

   from

   .claude/lib/creators/creator-commons.cjs

2. Call

   queueCrossCreatorReview(artifactType, artifactPath)

   from

   .claude/lib/creators/creator-commons.cjs

3. Review the impact report — address all

   mustHave

   items before marking task complete
4. Log any

   shouldHave

   items as follow-up tasks

• Template added to template-catalog.md
• Template README exists at template location
• Template assigned to consuming skill(s)
• Template examples provided

• agent-creator

  for ownership and execution paths

• skill-creator

  for capability packaging and assignment

• tool-creator

  for executable automation surfaces

• hook-creator

  for enforcement and guardrails

• rule-creator

  and

  semgrep-rule-creator

  for policy and static checks

• template-creator

  for standardized scaffolds

• workflow-creator

  for orchestration and phase gating

• command-creator

  for user/operator command UX

1. Artifact route exists in

   .claude/CLAUDE.md

   and related routing docs.
2. Discovery/registry entries are updated (catalog/index/registry as applicable).
3. Companion artifacts are created or explicitly waived with reason.

4. validate-integration.cjs

   passes for the created artifact.
5. Skill index is regenerated when skill metadata changes.

1. Use Exa first for implementation and ecosystem patterns.
2. If Exa is insufficient, use

   WebFetch

   plus arXiv references.
3. Record decisions, constraints, and non-goals in artifact references/docs.
4. Keep updates minimal and avoid overengineering.

• Follow strict RED -> GREEN -> REFACTOR for behavior changes.
• Run targeted tests for changed modules.
• Run lint/format on changed files.
• Keep commits scoped by concern (logic/docs/generated artifacts).