skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the task is about authoring or improving another skill, including:
SKILL.mdIf the task is not skill-authoring related, do not activate this skill.
Use this checklist for skill creation and major edits:
Skill Authoring Progress:
- [ ] Step 1: Confirm scope and skill name
- [ ] Step 2: Scaffold or inspect existing files
- [ ] Step 3: Draft concise SKILL.md
- [ ] Step 4: Add resource directories only if needed
- [ ] Step 5: Validate and fix issuesa-z, 0-9, -).name are identical.Skills always live under the absolute path /home/user/skills/<skill-name>/ — NEVER relative to your current working directory. Your cwd is typically the per-interaction dir, NOT /home/user/, so a path="skills/foo" argument would write to the wrong place. Always pass the absolute /home/user/skills/<skill-name>/... path to sandbox_file, sandbox_python, and any shell command.
For new skills, scaffold first:
python3 /home/user/skills/.tools/init_skill.py my-skill-nameAdd --scripts, --references, or --assets only when the skill needs them.
For existing skills, read:
sandbox_file(action="read", path="/home/user/skills/my-skill-name/SKILL.md")Write only what changes behavior. Assume the model already understands basics.
Frontmatter requirements:
name: required, hyphen-case, <=64 charsdescription: required, non-empty, <=1024 chars, no angle bracketsicon, color, related_server_idsrelated_server_ids: array of actual server IDs from server discovery (e.g. [apollo, gbigquery]) when the skill is specific to one or more integrations. Enables server-scoped skill discovery. Omit this field if you are not sure which exact server IDs apply.Description should state both:
Most skills only need a SKILL.md. Only create resource directories when there's a concrete reason:
scripts/: deterministic code that would otherwise be rewritten each timereferences/: large docs that would bloat SKILL.md past ~500 linesassets/: static files used in skill output (templates, images)If you do add references, keep them one level deep from SKILL.md.
Run validation:
python3 /home/user/skills/.tools/quick_validate.py my-skill-nameIf validation fails:
Choose the right degree of specificity:
Default to one recommended method, then document exceptions only when needed.
When asked to create/update a skill, produce:
SKILL.md with valid frontmatterscripts/, references/, or assets/quick_validate.pyIf the user asks for multiple changes, apply them directly and re-validate.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.