Claude source discovery

Use this checklist to distinguish project-owned Claude sources that can be migrated from user-owned, installed, or cached content that must remain untouched.

Eligible sources

• Project-local skills at .claude/skills/<skill-name>/SKILL.md, including non-sensitive supporting files contained in that skill directory.
• Claude plugins whose source lives inside the current repository and is owned by the project.
• Non-sensitive skill resources referenced by the source instructions when those resources also live inside the repository.

Excluded sources

• Global skills under ~/.claude/skills/.
• Installed plugins, marketplace checkouts, and caches under ~/.claude/.
• Marketplace plugin entries in project or user settings.
• Git submodules, including repository paths listed in .gitmodules.
• Nested Git repositories unless their selected files are tracked by the parent repository and project ownership is explicitly confirmed.
• Symlinks whose resolved target is outside the repository.
• Generated dependencies, vendored content, and files not owned by the project.
• Credentials, private keys, tokens, .env files, personal data, and other sensitive material.

Do not copy, edit, or remove excluded sources. When a selected skill requires the shape or intent of a sensitive resource, create a sanitized replacement containing placeholders instead of migrating the original.

Discovery process

1. Resolve the repository root and its real path.
2. Inspect .gitmodules, the current submodule list, and nested .git files or directories before classifying any nested repository.
3. Enumerate .claude/skills/*/SKILL.md.
4. For each skill, inspect the complete skill directory and record its instructions, references, scripts, templates, and other supporting files.
5. Enumerate Claude plugin manifests inside the repository. Classify a plugin as repo-owned only when its source is part of the repository and is not an installed marketplace copy, cache, submodule, or external symlink. For a nested Git repository, also confirm that its selected files are tracked by the parent repository and owned by the project.
6. Record every candidate's source path, source type, eligibility, and reason for inclusion or exclusion.
7. Scan every selected source and supporting file for credentials, private keys, tokens, .env content, personal data, and other sensitive material. Exclude sensitive files and plan sanitized replacements when required.
8. Repeat the sensitive-material scan immediately before packaging.
9. Verify that every selected skill and every required non-sensitive or sanitized supporting file is present before creating a migration plan.

Keep discovery read-only. Do not inspect or change user-home content beyond identifying paths that are explicitly excluded.