skillify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skillify (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are capturing this session's repeatable process as a reusable skill.
You have the full conversation history available to you. Analyze it directly to understand what process was performed, what tools were used, and how the user steered you.
If a description was provided: The user described this process as: "$description"
Before asking any questions, analyze the conversation history to identify:
You will use AskUserQuestion to understand what the user wants to automate. Important notes:
Round 1: High level confirmation
Round 2: More details
.claude/skills/<name>/SKILL.md) -- for workflows specific to this project~/.claude/skills/<name>/SKILL.md) -- follows you across all reposRound 3: Breaking down each step For each major step, if it's not glaringly obvious, ask:
You may do multiple rounds of AskUserQuestion here, one round per step, especially if there are more than 3 steps or many clarification questions. Iterate as much as needed.
IMPORTANT: Pay special attention to places where the user corrected you during the session, to help inform your design.
Round 4: Final questions
Stop interviewing once you have enough information. IMPORTANT: Don't over-ask for simple processes!
Create the skill directory and file at the location the user chose in Round 2.
Use this format:
---
name: {{skill-name}}
description: {{one-line description}}
allowed-tools:
{{list of tool permission patterns observed during session}}
when_to_use: {{detailed description of when Claude should automatically invoke this skill, including trigger phrases and example user messages}}
argument-hint: "{{hint showing argument placeholders}}"
arguments:
{{list of argument names}}
context: {{inline or fork -- omit for inline}}
---
# {{Skill Title}}
Description of skill
## Inputs
- `$arg_name`: Description of this input
## Goal
Clearly stated goal for this workflow. Best if you have clearly defined artifacts or criteria for completion.
## Steps
### 1. Step Name
What to do in this step. Be specific and actionable. Include commands when appropriate.
**Success criteria**: ALWAYS include this! This shows that the step is done and we can move on. Can be a list.
IMPORTANT: see the next section below for the per-step annotations you can optionally include for each step.
...Per-step annotations:
Direct (default), Task agent (straightforward subagents), Teammate (agent with true parallelism and inter-agent communication), or [human] (user does it). Only needs specifying if not Direct.Step structure tips:
[human] in the titleFrontmatter rules:
allowed-tools: Minimum permissions needed (use patterns like Bash(gh:*) not Bash)context: Only set context: fork for self-contained skills that don't need mid-process user input.when_to_use is CRITICAL -- tells the model when to auto-invoke. Start with "Use when..." and include trigger phrases. Example: "Use when the user wants to cherry-pick a PR to a release branch. Examples: 'cherry-pick to release', 'CP this PR', 'hotfix'."arguments and argument-hint: Only include if the skill takes parameters. Use $name in the body for substitution.Before writing the file, output the complete SKILL.md content as a yaml code block in your response so the user can review it with proper syntax highlighting. Then ask for confirmation using AskUserQuestion with a simple question like "Does this SKILL.md look good to save?" -- do NOT use the body field, keep the question concise.
After writing, tell the user:
/{{skill-name}} [arguments]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.