hive.writing-hive-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hive.writing-hive-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Hive agents discover skills by scanning several roots, in precedence order:
<project>/.hive/skills/ — project, Hive-specific<project>/.agents/skills/ — project, cross-client~/.hive/skills/ — user, Hive-specific~/.agents/skills/ — user, cross-clientcore/framework/skills/_default_skills/Each skill is a directory containing a SKILL.md. At startup, only the frontmatter name + description of every skill is loaded; the body is loaded only when the agent activates the skill. Design for that.
~/.hive/skills/ or <project>/.hive/skills/ yourself. Those roots are SHARED and every colony on the machine will see it. Instead, pass the skill content INLINE to the create_colony tool (skill_name, skill_description, skill_body, optional skill_files). The tool materializes the folder under ~/.hive/colonies/<colony_name>/.hive/skills/<skill-name>/ where it is discovered as project scope by only that colony's workers. See the subsection below.<project>/.hive/skills/ when the skill is tied to that codebase's APIs, conventions, or infra and multiple agents in the project should share it.~/.hive/skills/ when the skill is reusable across projects for this machine/user and all agents should see it.core/framework/skills/_default_skills/ AND register in framework/skills/defaults.py::SKILL_REGISTRY only when the skill is a universal operational protocol shipped with Hive. Default skills use the hive.<name> naming convention and include type: default-skill in metadata.create_colonyA colony-scoped skill is one that belongs to exactly ONE colony — e.g. it encodes the HoneyComb staging API the honeycomb_research colony polls, or the LinkedIn outbound flow the linkedin_outbound_campaign colony runs. Writing such a skill at ~/.hive/skills/ or <project>/.hive/skills/ leaks it to every other colony, which will then see it at selection time.
Do not reach for `write_file` to create the folder. The create_colony tool takes the skill content INLINE and places it for you:
create_colony(
colony_name="honeycomb_research",
task="Build a daily honeycomb market report…",
skill_name="honeycomb-api-protocol",
skill_description="How to query the HoneyComb staging API…",
skill_body="## Operational Protocol\n\nAuth: …",
skill_files=[{"path": "scripts/fetch_tickers.py", "content": "…"}], # optional
)The tool writes ~/.hive/colonies/honeycomb_research/.hive/skills/honeycomb-api-protocol/SKILL.md (plus any skill_files), which SkillDiscovery picks up as project scope when that colony's workers start — and ONLY that colony's workers. No cross-colony leakage.
Do not write colony-bound skill folders by hand under ~/.hive/skills/. A skill placed there is user-scoped and becomes visible to every colony on the machine — defeating the isolation you wanted.
<skill-name>/
├── SKILL.md # Required
├── scripts/ # Optional — executable helpers
├── references/ # Optional — on-demand docs
└── assets/ # Optional — templates, data, imagesRules:
name frontmatter field (for framework defaults, the directory is the unprefixed name, e.g. note-taking/ for hive.note-taking).SKILL.md under ~500 lines. Move long reference material into references/.scripts/foo.py, references/API.md). Keep references one level deep.Required fields:
| Field | Constraints |
|---|---|
name | 1–64 chars, [a-z0-9-], no leading/trailing/consecutive hyphens. Must match the directory name. Framework defaults prefix with hive. |
description | 1–1024 chars. Must describe what the skill does and when to use it. Include trigger keywords the user is likely to say. |
Optional fields:
| Field | Notes |
|---|---|
license | License name or reference to a bundled file |
compatibility | ≤500 chars. Only include if env requirements are non-trivial (network, tools, runtime) |
metadata | Free-form string→string map. Namespace keys to avoid collisions. Default skills set type: default-skill. |
allowed-tools | Experimental. Space-separated pre-approved tools, e.g. Bash(curl:*) Bash(jq:*) Read |
Minimal template:
---
name: my-skill
description: One sentence on what it does. One sentence on when to use it, with concrete trigger words the agent will see in user requests.
---
# My Skill
<body>descriptionThis is the single most important field — it's the only thing the agent sees at skill-selection time.
Helps with trading.Buy and sell shares on the HoneyComb exchange. Handles auth, slippage-protected orders, idempotent retries, and AMM output estimation. Use when placing trades or interacting with the AMM.Include verbs the user is likely to say (buy, sell, place trade) and proper nouns (HoneyComb, AMM).
Structure the body for the agent, not a human reader:
Recommended sections (adapt to the domain):
Three tiers of context cost:
name + description. Keep tight.SKILL.md.scripts/, references/, assets/. The agent reads these only when the body points to them.If a section is long and only needed sometimes (e.g., a full schema dump, rarely-used edge cases), move it to references/SOMETHING.md and link to it from the body: See [the error catalog](references/ERRORS.md) for the full list.
Put executable helpers in scripts/. They should:
Reference them from the body by relative path:
Estimate buy output with `scripts/estimate_buy.py --v-hc 1000000 --v-shares 1000000 --hc 500`.For Python scripts in a Hive project, prefer uv run scripts/foo.py ....
<skill-name> (lowercase-hyphenated).create_colony — STOP here, do not hand-author the folder), project (<project>/.hive/skills/), user (~/.hive/skills/), or framework default (core/framework/skills/_default_skills/ + registry entry).SKILL.md with frontmatter + body.scripts/, references/, assets/ only if needed. uv run hive skill validate <path-to-skill-dir>
uv run hive skill doctoruv run hive skill list.When adding a skill as a shipped default:
core/framework/skills/_default_skills/<unprefixed-name>/.name: hive.<unprefixed-name> and metadata.type: default-skill.SKILL_REGISTRY in core/framework/skills/defaults.py: SKILL_REGISTRY: dict[str, str] = {
...
"hive.<unprefixed-name>": "<unprefixed-name>",
}{{placeholder}} substitution, add defaults to _SKILL_DEFAULTS in the same file.DATA_BUFFER_KEYS.SKILL.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.