/init  # Claude分析代码库后生成初稿

# Project: [项目名称]

## Tech Stack
- **Frontend**: React + TypeScript
- **Backend**: Node.js + Express
- **Database**: PostgreSQL
- **ORM**: Drizzle

## Coding Standards
- Use TypeScript strict mode
- Prefer server components over client components
- Use `async/await` instead of `.then()`
- Always validate user input with Zod

## DO NOT
- Never commit `.env` files
- Never use `any` type in TypeScript
- Never bypass authentication checks
- Never expose API keys in client code

## Common Commands
- `npm run dev`: Start development server
- `npm run build`: Build for production
- `npm run test`: Run tests

Our authentication system is built using NextAuth.js, which is a
complete authentication solution for Next.js applications...
(5行以上的说明)

## Authentication
- NextAuth.js with Credentials provider
- JWT session strategy
- **DO NOT**: Bypass auth checks, expose session secrets

// ~/.claude/settings.json
{
  "hooks": {
    "PreToolUse": [
      {
        "pattern": "rm -rf /",
        "action": "block",
        "message": "拦截根目录删除命令"
      },
      {
        "pattern": "rm -rf /*",
        "action": "block",
        "message": "拦截危险删除命令"
      },
      {
        "pattern": "sudo rm",
        "action": "warn",
        "message": "注意使用sudo删除命令"
      },
      {
        "pattern": "curl * | sh",
        "action": "block",
        "message": "拦截管道执行脚本"
      },
      {
        "pattern": "chmod 777",
        "action": "warn",
        "message": "注意设置过度权限"
      }
    ]
  }
}

需始终应用的规则 → 项目说明文件
仅特定任务需要的知识 → Skills（Token高效）
常用命令 → Slash Commands
外部服务集成 → Plugins / MCP

# 创建Skill目录
mkdir -p ~/.claude/skills/my-skill

# 编写SKILL.md
cat > ~/.claude/skills/my-skill/SKILL.md << 'EOF'
---
name: my-skill
description: 我的自定义Skill
platforms: [Claude, Gemini, ChatGPT]
---

# My Skill

## When to use
- 需要执行特定任务时

## Instructions
1. 第一步
2. 第二步
EOF

# 使用cc-safe工具检测危险命令
npx cc-safe .
npx cc-safe ~/projects

# 检测目标:
# - sudo, rm -rf, chmod 777
# - curl | sh, wget | bash
# - git reset --hard, git push --force
# - npm publish, docker run --privileged

# 仅自动批准安全命令
/sandbox "npm test"
/sandbox "npm run lint"
/sandbox "git status"
/sandbox "git diff"

# 模式批准
/sandbox "git *"       # 所有git命令
/sandbox "npm test *"  # 所有npm test相关命令

# MCP工具模式
/sandbox "mcp__server__*"

project/
├── .claude/                    # Claude Code配置
│   ├── team-settings.json
│   ├── hooks/
│   └── skills/
├── .agent-skills/              # 通用Skill
│   ├── backend/
│   ├── frontend/
│   └── ...
├── CLAUDE.md                   # 面向Claude的项目说明
├── .cursorrules               # Cursor配置
└── ...

{
  "permissions": {
    "allow": [
      "Read(src/)",
      "Write(src/)",
      "Bash(npm test)",
      "Bash(npm run lint)"
    ],
    "deny": [
      "Bash(rm -rf /)",
      "Bash(sudo *)"
    ]
  },
  "hooks": {
    "PreToolUse": {
      "command": "bash",
      "args": ["-c", "echo 'Team hook: validating...'"]
    }
  },
  "mcpServers": {
    "company-db": {
      "command": "npx",
      "args": ["@company/db-mcp"]
    }
  }
}

提交.claude/目录 → 团队成员克隆 → 自动应用相同配置 → 维持团队标准

.agent-skills/
├── backend/
├── frontend/
├── code-quality/
├── infrastructure/
├── documentation/
├── project-management/
├── search-analysis/
└── utilities/

~/.claude/settings.json     # 全局配置
~/.claude/skills/           # 全局Skill
.claude/settings.json       # 项目配置
.claude/skills/             # 项目Skill
.agent-skills/              # 通用Skill
CLAUDE.md                   # 项目AI说明书

1. 使用Hooks拦截危险命令
2. 使用/sandbox仅自动批准安全命令
3. 使用cc-safe定期审计
4. 仅在容器中使用实验模式

项目说明文件：始终加载（保持简洁）
Skills：按需加载（Token高效）
.toon模式：节省95% Token