[joris-sevenlab]

Folds the few generic, stack-correct lines from a set of retired always-on skills into the scaffolded Claude Code rules. The source is a skills audit: https://claude.ai/artifact/FWspXMUnSyi2rKLsLuojzV

Folded

Rule file	Change	From
global.md	Added pnpm run typecheck to the "before considering work complete" line. essentials wires it as nuxi typecheck and CI runs it.	quality-gate
global.md (same line)	Never get checks green with @ts-ignore, as any, eslint-disable, a skipped or deleted test, or git commit --no-verify.	quality-gate
security.md	Nothing secret goes under runtimeConfig.public, because it is serialized into every page.	nuxt-modules
security.md	Never render user-controlled content with v-html. No sanitizer ships and xssValidator is off.	secure-coding

shared:ai-tool-config 1.2.0 → 1.2.1 (pnpm bump). Changelog entry added under Unreleased. collectDocs is unchanged, so no writer feature needs a bump.

Deliberately not folded

• quality-gate, Prettier/npx/npm commands: the stack uses pnpm, and lint is ESLint.
• quality-gate, build step: the generated project has a build script. It stays out of the always-loaded gate because it is slow, and CI and Docker already run it.
• quality-gate, vue-tsc vs tsc pitfall: nuxi typecheck already runs vue-tsc.
• search-first, whole skill: it is a decision framework (process). "Check existing code and deps first" is default behaviour, and the shipped brainstorming/task-arbiter skills already cover it.
• secure-coding, SQL example: it is Supabase-based. Drizzle parameterization is already in security.md.
• secure-coding, Zod .string().email(): that is Zod 3. The rules use Zod 4 z.email().
• secure-coding, hand-rolled CSRF middleware: server/middleware/01.origin-check.ts already covers it.
• secure-coding, security headers via routeRules: nuxt-security owns the headers, and that is documented in AGENTS.md, which CLAUDE.md imports.
• secure-coding, rate limiting: the nuxt-security rateLimiter is on by default.
• secure-coding, npm audit: CI runs the package manager audit.
• secure-coding, logging, localStorage sessions, CORS, .env handling: already in security.md.
• nuxt-composables, nuxt-pages, nuxt-server: generic Nuxt documentation the model already knows. The runtimeConfig/env mapping is already in global.md.
• nuxt-modules, the rest: generic, and it contains Nuxt 3 / non-stack advice (buildModules, @nuxtjs/tailwindcss, Bearer tokens in a store).

Tests

• pnpm exec vitest run packages/preset-nuxt4/test/claude-rules.test.ts: 2/2 pass.
• pnpm test: 101 files, 1088 passed, 1 skipped. The first, cold run (177 s) reported 3 failures in 1 file. Two reruns were fully green (~10 s), so it looks like a timeout flake unrelated to this change.
• pnpm tsc: clean.
• pnpm bump:check origin/main: OK.
• pnpm changelog:check: no base ref locally; CI will check it on the PR.