Converted and distributed by TomeVault — claim your Tome and manage your conversions.
Clean Code
Use when working with the Foundation Skill. LLM Firewall + 2025 Security + Cross-Skill Coordination. Use for ALL code output - prevents hallucinations, enforces security, ensures quality.
tomevault-io
Updated Clean Code by tomevault-io · aa1880e
npx skillmds@latest add tomevault-io/clean-code-8 File contents
---name: clean-code-8description: Use when working with the Foundation Skill. LLM Firewall + 2025 Security + Cross-Skill Coordination. Use for ALL code output - prevents hallucinations, enforces security, ensures quality.---<domain_overview># 🛡️ CLEAN CODE: THE FOUNDATION> **Philosophy:** This skill is the FOUNDATION - it applies to ALL other skills. Every piece of code must pass these gates.**ALGORITHMIC ELEGANCE MANDATE (CRITICAL):** Never prioritize "clever" code over readable, intent-revealing engineering. AI-generated code often fails by introducing unnecessary abstractions or using vague naming conventions that obscure logic. You MUST use intent-revealing names for every variable and function. Any implementation that increases cognitive complexity without a proportional gain in performance or scalability must be rejected. Avoid "Hype-Driven Development"—proven patterns trump trending but unstable frameworks.</domain_overview><iron_laws>## 🚨 IRON LAWS```1. NO HALLUCINATED PACKAGES - Verify before import2. NO LAZY PLACEHOLDERS - Code must be runnable3. NO SECURITY SHORTCUTS - Production-ready defaults4. NO OVER-ENGINEERING - Simplest solution first```</iron_laws><security_protocols>## 📦 PROTOCOL 1: SUPPLY CHAIN SECURITYLLMs hallucinate packages that sound real but don't exist.1. **Verify before import** - `npm search` or `pip show` for unfamiliar packages2. **Prefer battle-tested** - lodash, date-fns, zod over obscure alternatives3. **Check npm audit / pip-audit** before adding new dependencies4. **Pin versions** in production - no `^` or `~` for critical deps**2025 AI Package Risks:**- Never import AI "wrapper" libraries without verification- LLM SDKs: Use official only (openai, anthropic, google-generativeai)- Vector DBs: Stick to established (pinecone, weaviate, chromadb)## 🔐 PROTOCOL 2: SECURITY-FIRST DEFAULTS**Frontend Security:**| Forbidden | Required ||-----------|----------|| `dangerouslySetInnerHTML` | DOMPurify sanitization || Inline event handlers | Event delegation || `eval()`, `new Function()` | Static code only || Storing tokens in localStorage | httpOnly cookies |**Backend Security:**| Forbidden | Required ||-----------|----------|| `CORS: *` | Explicit origin whitelist || Raw SQL strings | Parameterized queries || `chmod 777` | Principle of least privilege || Hardcoded secrets | Environment variables + validation |**API Security (2025):**- Rate limiting on ALL public endpoints- Input validation at the gate (Zod/Pydantic)- Output sanitization for AI-generated content- PASETO > JWT for new projects</security_protocols><modularity_and_placeholder_rules>## 🏗️ PROTOCOL 3: NO LAZY PLACEHOLDERS**Forbidden Patterns:**```javascript// ❌ BANNED// TODO: Implement this// ... logic goes herefunction placeholder() { }throw new Error('Not implemented');```**Required:**- Every function must be runnable- If too complex, break into smaller complete functions- "Hurry" is not an excuse - write minimal viable implementation## 📐 PROTOCOL 4: MODULARITY & STRUCTURE**The 50/300 Rule:**- Functions > 50 lines → Break down- Files > 300 lines → Split into modules**SOLID Principles:**| Principle | Quick Check ||-----------|-------------|| **S**ingle Responsibility | Does this do ONE thing? || **O**pen/Closed | Can I extend without modifying? || **L**iskov Substitution | Can subtypes replace parent? || **I**nterface Segregation | Are interfaces minimal? || **D**ependency Inversion | Do I depend on abstractions? |</modularity_and_placeholder_rules><complexity_and_dependencies>## 🎯 PROTOCOL 5: COMPLEXITY CAP**Native First:**```javascript// ❌ Don't install is-oddnpm install is-odd// ✅ Use nativeconst isOdd = n => n % 2 !== 0;```**Anti-Patterns:**- AbstractFactoryBuilderManager for simple functions- 10 layers of abstraction for CRUD- "Future-proofing" for requirements that don't exist**YAGNI:** You Aren't Gonna Need It. Build for today's requirements.## 🔄 PROTOCOL 6: DEPENDENCY HYGIENE**Freshness Check:**```bashnpm outdated # Check for updatesnpm audit # Check for vulnerabilities```**The CVE Brake:**- "Latest" is not always "Safest"- If latest has Critical CVE → Rollback to last secure version- Security > New Features**2025 Recommended:**| Category | Recommended ||----------|-------------|| Validation | zod, valibot || HTTP | ky, ofetch || State | zustand, jotai || ORM | drizzle, prisma || Auth | lucia, better-auth |</complexity_and_dependencies><ai_era_protocols>## 🤖 PROTOCOL 7: AI-ERA CONSIDERATIONS**When Building AI Features:**1. **Validate AI outputs** - Never trust raw LLM responses2. **Rate limit AI calls** - Prevent cost explosions3. **Sanitize before display** - AI can generate malicious content4. **Log AI interactions** - For debugging and compliance**When AI is Writing Code:**1. **Verify imports exist** - AI hallucinates packages2. **Check types are correct** - AI guesses at APIs3. **Test edge cases** - AI misses boundary conditions4. **Review security** - AI takes shortcuts</ai_era_protocols><audit_and_reference>## ✅ QUICK AUDIT CHECKLISTBefore committing ANY code:- [ ] No hallucinated imports (verified packages exist)- [ ] No security shortcuts (CORS, eval, hardcoded secrets)- [ ] No lazy placeholders (// TODO, empty functions)- [ ] Functions < 50 lines, files < 300 lines- [ ] Dependencies audited (`npm audit` clean)- [ ] Types are strict (no `any`)---## 🔗 CROSS-SKILL INTEGRATION| When Using... | Clean Code Adds... ||---------------|-------------------|| `@frontend-design` | Security defaults, no eval, CSP awareness || `@backend-design` | Input validation, no raw SQL, Zero Trust || `@tdd-mastery` | No placeholders (tests enforce completeness) || `@planning-mastery` | Modularity guides task breakdown || `@brainstorming` | SOLID/YAGNI guide architecture decisions || `@debug-mastery` | Logging standards, no silent failures |</audit_and_reference>---> Converted and distributed by [TomeVault](https://tomevault.io/claim/xenitv1) — claim your Tome and manage your conversions.<!-- tomevault:4.0:skill_md:2026-04-11 -->
tomevault-io/skills-registry/tree/main/xenitv1--claude-code-maestro--clean-code commit aa1880e512
Frequently asked questions
Run npx skillmds@latest add tomevault-io/clean-code-8 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Use when working with the Foundation Skill. LLM Firewall + 2025 Security + Cross-Skill Coordination. Use for ALL code output - prevents hallucinations, enforces security, ensures quality. It is listed under AI & ML on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.