Skip to content
Back to skills

Scaffold

ASecurity

Create the app skeleton: Express API, SQLite through node:sqlite, a Vue screen, and the test harness, following the layout the later checks rely on.

  • 234 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 28, 2026
ai-agentstypescriptrustsqlvuenodeexpressgitapidatabase

Works with

  • cli
  • api

Security analysis

A100/100

Scanned October 2, 2026

npx -y skills add receptron/mulmoterminal --skill scaffold --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Scaffold?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Scaffold
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/receptron-scaffold-mulmoterminal/badge)](https://www.skillsdirectory.com/skills/receptron-scaffold-mulmoterminal)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: blueprint-local-scaffold
description: "Create the app skeleton: Express API, SQLite through node:sqlite, a Vue screen, and the test harness, following the layout the later checks rely on."
---

# App skeleton

One folder, one `package.json`, TypeScript throughout, `yarn`. The later checks rely on this layout exactly:

```
server/index.ts      Express app; listens on PORT (default 3000) and HOST (default 127.0.0.1)
server/db.ts         opens data/app.db with node:sqlite (DatabaseSync); runs migrations on start
server/migrations/   numbered .sql files, applied in order, recorded in a schema_migrations table
client/              Vite + Vue 3 app (index.html has <div id="app">)
test/                vitest; one file per area: data.test.ts, api.test.ts, ui.test.ts, auth.test.ts
data/                the database file lives here; data/*.db is in .gitignore
```

- `typescript@^6`, not 7: a later check reads the test files through TypeScript's compiler API, which TypeScript 7
  does not ship.
- Scripts: `dev` (server + vite together), `build` (vite build to dist/client and the server with tsc or tsup to
  dist/server), `start` (runs the BUILT server: `node dist/server/index.js`), `test` (`vitest run`).
- Under `yarn dev`, Vite forwards `/api` to the server. Write the proxy as an object with `changeOrigin: false`
  (`"/api": { target: "http://127.0.0.1:3000", changeOrigin: false }`), never as a plain string: a string makes Vite
  rewrite the `Host` to the server's port, and the API, which refuses a change whose `Origin` is not its own `Host`,
  then refuses every change made in development. The check loads the Vite config and says so.
- `GET /api/health` answers `{ "ok": true }`. In production the server serves `dist/client` and falls back to
  `index.html` for screen routes.
- The server exports a function that builds the app for a given database path, so tests run against a
  temporary database, never `data/app.db`.
- Add one trivial passing test in `test/` so the harness is proven.

Done when the check passes: the layout exists, `yarn build` and `yarn test` succeed.

## Always

- Read `.blueprint/spec.md` first. It is the agreed specification; do not widen it.
- When you need a decision, ask it through the blueprint question tool and stop. Do not guess.
- Do not run `git init`: a new repository loses the folder's trust and the next unattended step stops at Claude
  Code's trust prompt. The user adds git themselves after the build if they want it.
- Say you are done by stopping; the executor runs the check. Do not claim success yourself.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.