architecture-map/SKILL.md
Generate or update PROJECT_ARCHITECTURE.md - a comprehensive architectural map for AI context. Use this skill when asked to "map the architecture", "document the project structure", "onboard a new AI", "analyze the codebase", "create context for AI", or any time you need to understand a codebase's architecture. This skill is essential for new project onboarding and should trigger automatically when starting work on unfamiliar projects.
npx skillsauth add arielsand/my-opencode-skills architecture-mapInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Generate a comprehensive architectural map that helps AI agents (and humans) quickly understand a codebase.
Create PROJECT_ARCHITECTURE.md in the project root using the write tool. This file should be committed to version control.
Follow these phases in order:
Read configuration files to understand the stack:
package.json, composer.json, pyproject.toml, Cargo.toml, go.modapp.json, expo.json for mobile apps.env.example for environment hintsapp/_layout.tsx, index.ts, main.py, src/main.rsLook for:
Map the directory structure and identify:
Identify conventions used:
Using all gathered information, write PROJECT_ARCHITECTURE.md with these sections:
The output file MUST include these sections:
A 3-5 sentence summary answering:
Create a table:
| Layer | Technology | Version | Purpose | |-------|-----------|---------|---------|
Include: frameworks, key libraries, runtime versions, databases, caching, queues.
Example for a fullstack app:
┌─────────────────┐
│ Mobile App │ (React Native / Expo)
│ Frontend │
└────────┬────────┘
│ HTTP/REST
▼
┌─────────────────┐
│ API Server │ (Laravel / Node / Python)
│ Backend │
└────────┬────────┘
│
┌────┴────┐
▼ ▼
┌───────┐ ┌───────┐
│ DB │ │ Cache │
└───────┘ └───────┘
Adapt the diagram to match the actual architecture.
For each major feature, identify WHERE the logic lives:
Feature: Authentication
├── Backend: app/Services/AuthService.php
├── Controller: app/Http/Controllers/AuthController.php
├── Mobile: context/AuthContext.tsx
└── Hooks: hooks/useAuth.ts
Describe how data moves through the system for key operations:
[User Action] → [Component] → [API Client] → [Backend Controller]
↓
[Service Layer]
↓
[Database]
List the 10-15 most important files to understand the system:
├── app/_layout.tsx # Root navigation
├── app/(auth)/ # Auth flow
├── services/api.ts # API client
├── context/AppContext.tsx # Global state
├── ...etc
After creating PROJECT_ARCHITECTURE.md, verify that AI agents are instructed to use it as context:
AGENTS.md exists in the project rootPROJECT_ARCHITECTURE.md in AGENTS.md## Project Architecture Context
Before making any changes to this codebase, ALWAYS read `PROJECT_ARCHITECTURE.md` in the project root. This file contains:
- Tech stack and versions
- Module/service architecture
- Navigation and routing structure
- Critical business logic locations
- Data flow patterns
- API endpoints and contracts
- Development standards
Use this as your primary context source when onboarding to or working on this project.
Why this matters: AI agents in future sessions will automatically read AGENTS.md but may not discover PROJECT_ARCHITECTURE.md without explicit instruction. This ensures continuity.
After writing the file and updating AGENTS.md, inform the user:
Architecture map saved to PROJECT_ARCHITECTURE.md AGENTS.md updated to reference architecture context.
Suggest they commit both files to version control for future AI sessions.
data-ai
Track work sessions and maintain a WORKLOG.md file. Use this skill at the end of any significant work session, when the user asks to log work, update the worklog, or track time spent. Also use when the user says things like "log this", "update worklog", "track time", "record what we did", or "add to worklog". This skill should be used proactively at natural stopping points like finishing a feature, fixing a bug, or ending a coding session.
development
MUST use whenever the user asks for a security audit, vulnerability assessment, penetration test review, security scan, compliance check (GDPR, SOC2, PCI-DSS), or hardening review of any codebase, API, frontend, or infrastructure. Triggers on phrases like: "audit security", "security review", "check for vulns", "scan for secrets", "assess compliance", "pentest review", "hardening audit", "OWASP check", "CWE audit", "SAST/DAST", "security posture", or any request that involves finding vulnerabilities, misconfigurations, credential leaks, injection flaws, auth weaknesses, or data-exposure risks in code. Use this skill even if the user only mentions a subset (e.g., "check JWT auth") — the skill will scope appropriately.
documentation
Generate or update CODING_STANDARDS.md - a comprehensive coding standards document for a project. Use this skill when asked to "document coding standards", "create style guide", "establish conventions", "generate CODING_STANDARDS.md", or any time you need to define or enforce coding practices for a team. Trigger when starting work on a new project that lacks documented standards.
development
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.