Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Documentation Fundamentals

ASecurity

Auto-invoke when reviewing README files, JSDoc comments, or inline documentation. Enforces "WHY not WHAT" principle.

416 stars
0 votes
0 copies
2 views
Added 2/7/2026
developmenttypescriptgoreactgitapibackenddocumentation

Works with

cliapimcp

Security Analysis

A96/100
mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned 2/12/2026

$npx -y skills add aiskillstore/marketplace --skill documentation-fundamentals --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Documentation Fundamentals?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Documentation Fundamentals
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/aiskillstore-documentation-fundamentals/badge)](https://www.skillsdirectory.com/skills/aiskillstore-documentation-fundamentals)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
name: documentation-fundamentals
description: Auto-invoke when reviewing README files, JSDoc comments, or inline documentation. Enforces "WHY not WHAT" principle.
---

# Documentation Fundamentals Review

> "Code tells you HOW, comments tell you WHY. If you only explain what the code does, you're wasting everyone's time."

## When to Apply

Activate this skill when:
- Reviewing or creating README files
- Writing JSDoc/docstring comments
- Inline code comments
- API documentation
- Architecture decision records

---

## The Golden Rule: WHY, Not WHAT

```typescript
// ❌ BAD: Explains what (code already says this)
// Increment counter by 1
counter++;

// ✅ GOOD: Explains why (context the code can't provide)
// Counter must be incremented before validation runs
// to account for the edge case where initial value is 0
counter++;
```

---

## README Structure (The 5 Essentials)

Every README must answer these questions:

### 1. What Is This? (1 sentence)

> "What problem does this solve in one sentence?"

```markdown
## What

A CLI tool that converts Figma designs to React components.
```

### 2. Why Does It Exist?

> "What pain point motivated this project?"

```markdown
## Why

Manually converting designs to code takes hours and introduces inconsistencies.
This tool automates the process, ensuring pixel-perfect components.
```

### 3. How to Install

> "Copy-paste instructions that work."

```markdown
## Installation

npm install your-package
```

### 4. How to Use

> "The simplest possible example that works."

```markdown
## Quick Start

npx your-tool --input design.fig --output ./components
```

### 5. How to Contribute (Optional)

> "For open source projects."

```markdown
## Contributing

1. Fork the repo
2. Create your feature branch
3. Submit a pull request
```

---

## Comment Types & When to Use Them

### Function/Method Documentation (JSDoc)

```typescript
/**
 * Validates email format and checks domain against blocklist.
 *
 * @param email - The email address to validate
 * @returns ValidationResult with success status and error message
 *
 * @example
 * const result = validateEmail('user@example.com');
 * if (!result.success) {
 *   showError(result.error);
 * }
 *
 * Note: This uses the RFC 5322 regex pattern, which is intentionally
 * strict to prevent disposable email addresses.
 */
function validateEmail(email: string): ValidationResult {
  // Implementation
}
```

### Inline Comments (Only for WHY)

```typescript
// Rate limit is 100/min but we use 80 to leave headroom for retries
const RATE_LIMIT = 80;

// Sort descending because newest items should appear first
// (business requirement from PM - see ticket #1234)
items.sort((a, b) => b.date - a.date);

// HACK: API returns dates as strings, need to parse manually
// TODO: Remove after backend migration (Q2 2026)
const date = new Date(response.dateString);
```

### Block Comments (Complex Logic)

```typescript
/*
 * Authentication Flow:
 * 1. Check local token cache
 * 2. If expired, attempt silent refresh
 * 3. If refresh fails, redirect to login
 *
 * We use refresh tokens instead of re-authentication to avoid
 * disrupting the user experience during long sessions.
 */
```

---

## Common Mistakes (Anti-Patterns)

### 1. Commenting the Obvious

```typescript
// ❌ BAD: Useless comment
// Set name to "John"
const name = "John";

// Get the user's age
const age = user.age;

// Loop through items
for (const item of items) { ... }

// ✅ GOOD: No comment needed (code is self-explanatory)
const name = "John";
```

### 2. Outdated Comments

```typescript
// ❌ BAD: Comment doesn't match code (dangerous!)
// Filter out inactive users
const users = data.filter(u => u.role === 'admin');

// ✅ GOOD: Comment matches reality
// Only show admin users in management view
const users = data.filter(u => u.role === 'admin');
```

### 3. No Context on Magic Numbers

```typescript
// ❌ BAD: What is 86400?
const expiresIn = 86400;

// ✅ GOOD: Explains the magic
const SECONDS_PER_DAY = 86400;
const expiresIn = SECONDS_PER_DAY; // Tokens expire after 24 hours
```

### 4. Commented-Out Code

```typescript
// ❌ BAD: Dead code polluting the file
// const oldImplementation = () => { ... };
// function deprecatedHelper() { ... }

// ✅ GOOD: Delete it! Git remembers everything
```

### 5. Empty README

```markdown
<!-- ❌ BAD: Auto-generated, never updated -->
# my-project

This project was bootstrapped with Create React App.
```

---

## Socratic Questions

Ask these instead of giving answers:

1. **WHY not WHAT**: "Does this comment tell me something the code doesn't?"
2. **Audience**: "Would a developer joining tomorrow understand this?"
3. **Maintenance**: "If you change the code, would you remember to update this comment?"
4. **README**: "Can someone run this project with just the README instructions?"
5. **JSDoc**: "What would a developer need to know to use this function correctly?"
6. **Necessity**: "If you delete this comment, is anything lost?"

---

## README Template

```markdown
# Project Name

One-sentence description of what this does.

## Why

The problem this solves and why it matters.

## Installation

npm install project-name

## Quick Start

Minimal code example that works.

## API

### functionName(param)

Description of what it does.

**Parameters:**
- `param` (string): What this parameter is for

**Returns:** What gets returned

**Example:**
```js
// Usage example
```

## Configuration

Available options and their defaults.

## Contributing

How to contribute (if applicable).

## License

MIT (or your license)
```

---

## JSDoc Essentials

```typescript
/**
 * Brief description of what this function does.
 *
 * @param paramName - Description of parameter
 * @returns Description of return value
 * @throws {ErrorType} When this error occurs
 * @example
 * // Show how to use it
 * const result = myFunction('input');
 *
 * @see RelatedFunction for similar functionality
 * @deprecated Use newFunction instead (v2.0+)
 */
```

---

## Red Flags to Call Out

| Flag | Question |
|------|----------|
| Empty README | "Can a new developer run this project right now?" |
| `// Set x to 5` | "Does this comment add value? The code already says this." |
| Outdated comments | "Does this comment still match what the code does?" |
| No JSDoc on exports | "How would someone know how to use this function?" |
| Commented-out code | "Why is this here? Git has history if you need it back." |
| Magic numbers | "What does 3600 mean? Why this number?" |

---

## Interview Connection

> "I maintain comprehensive documentation including READMEs, JSDoc comments, and architecture decision records, ensuring code is maintainable by the entire team."

Documentation habits demonstrate:
- Communication skills
- Long-term thinking
- Team player mentality
- Senior-level maturity

---

## MCP Usage

### Context7 - Framework Docs
```
Fetch: JSDoc documentation
Fetch: Markdown best practices
```

### Octocode - Real Examples
```
Search: README.md patterns in popular repos
Search: JSDoc examples in TypeScript projects
```

Attribution

aiskillstoreaiskillstore
View sourceSee grades on GitHubMore from aiskillstore →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Clean Code

Pragmatic coding standards - concise, direct, no over-engineering, no unnecessary comments

304955 votes

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

285172 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2222 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Tanstack Start

Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 + Cloudflare Workers app with file-based routing and server functions — even if they don't name TanStack Start specifically. No template repo — Claude generates every file fresh per ...

10341 votes
View all in development →