skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill is a folder that teaches Claude how to handle a specific task or workflow. Skills are an open standard — the same skill folder works across Claude.ai, Claude Code, and the Messages API (via container.skills).
Two types (claude-code-setup harness convention):
/skill-name (e.g. /deploy-staging)standards-python loads for Python projects)Thetype/applies_to/file_extensionsfields are harness extensions specific toclaude-code-setup. For pure Anthropic-spec skills (Claude.ai or API upload), seereferences/02-frontmatter.md→ "Harness-specific fields".
This skill walks the user through an 8-step interactive flow for creating a new skill. It is also useful for reviewing an existing skill (see references/07-troubleshooting.md → "Escalation path") or fixing one that doesn't trigger properly.
By default, created skills save to ~/.claude/custom/skills/<name>/, survive claude-code-setup upgrades, and are discovered by the harness. For Claude.ai or API distribution, see references/09-distribution.md.
SKILL.md — exact filename, case-sensitive. skill.md, SKILL.MD, etc. all fail.claude or anthropic prefix (both reserved).< or >) — security restriction.references/.Full rules and frontmatter schema: references/02-frontmatter.md.
Use conversational interaction — ask one question at a time, wait for the answer before moving on.
Ask:
Give me 2–3 specific, concrete scenarios where you want this skill to kick in. Format: "I say X" → "Claude does Y".
The quality of the skill is capped by the quality of the use cases. Vague cases ("help with projects") produce unusable skills. Specific cases ("onboard a new PayFlow customer: create account → setup payment → activate subscription") produce skills that trigger reliably and behave consistently.
If the user gives only one scenario, push for at least two more — paraphrased versions of the same task, or related edge cases.
Map the use cases to a type:
If ambiguous, present both options and let the user pick:
Command skill — invoked as /skill-name
Example: /deploy-staging, /generate-report
Pro: deterministic invocation
Con: user must remember the command
Context skill — auto-loaded by tech stack or file extension
Example: standards-python, api-conventions
Pro: always applied, no user effort
Con: consumes context tokens on every matching projectMinimal frontmatter for each type (harness-specific fields — see references/02-frontmatter.md):
# Command skill
type: command# Context skill
type: context
applies_to: [python, fastapi]Propose a kebab-case name based on the use cases. The folder name, frontmatter name, and directory must all match.
Write the description in this structure:
[What it does] + [When to use it, with trigger phrases] + (optional) [Key capabilities]
Good and bad examples, plus the full test ("would Claude know to pick this skill when the user says X?"): references/03-writing-descriptions.md.
Before picking a pattern, decide which framing fits:
This framing points directly at the right pattern.
Most skills fit one of 5 patterns. Identify which fits before writing instructions.
| # | Pattern | When |
|---|---|---|
| 1 | Sequential workflow orchestration | Multi-step process, steps in a specific order |
| 2 | Multi-MCP coordination | Workflow spans multiple MCP servers |
| 3 | Iterative refinement | Output quality improves through repeat passes |
| 4 | Context-aware tool selection | Same outcome, different tools depending on context |
| 5 | Domain-specific intelligence | Specialized expertise beyond tool access |
Full descriptions with ready-to-copy structures — plus the "Skills + MCP" story for skills that wrap an MCP server: references/05-patterns.md.
Most skills need only `SKILL.md`. Add folders only when justified.
<skill-name>/
├── SKILL.md required
├── references/ optional — detailed docs loaded on demand
├── assets/ optional — templates the skill produces
└── scripts/ optional — executable code (Python, Bash, etc.)See references/01-progressive-disclosure.md for the full three-level model.
Write SKILL.md using the pattern from Step 4. Apply the rules in references/04-writing-instructions.md:
references/ the moment SKILL.md threatens to bloatIf the user asked to provide instructions themselves, review their draft against these rules and suggest concrete edits.
Three checks before calling the skill done:
To measure a baseline, temporarily disable the skill. Simplest: rename the folder to <name>.disabled before running the same prompts, then rename back.
Full method and example test matrix: references/06-testing.md.
~/.claude/custom/skills/<name>/. ./install.sh --refresh-customor equivalently: run /claude-code-setup and pick "Upgrade custom".
/<name><applies-to value>"For sharing outside claude-code-setup (Claude.ai upload, API via container.skills, GitHub distribution), see references/09-distribution.md.
Full diagnosis: references/07-troubleshooting.md.
| Symptom | First suspect |
|---|---|
| Skill never triggers | Description too vague — add trigger phrases ("Use when user says …") |
| Skill triggers on unrelated queries | Description too broad — add negative triggers ("Do NOT use for …") |
| Instructions not followed | SKILL.md too long or key points buried — tighten, add ## CRITICAL headers |
| "Could not find SKILL.md" | Filename not exact SKILL.md (case-sensitive) |
| "Invalid frontmatter" | Missing --- delimiters, unclosed quotes, or XML brackets in a field |
references/NN-*.md.scripts/.Internal (bundled, read on demand):
references/01-progressive-disclosure.md — 3-level system; when to use references/assets/scriptsreferences/02-frontmatter.md — all YAML fields, security rules, reserved namesreferences/03-writing-descriptions.md — trigger phrases, what+when structure, good/bad examplesreferences/04-writing-instructions.md — specificity, structure, error handling, when to use scriptsreferences/05-patterns.md — the 5 common patterns with full example structuresreferences/06-testing.md — triggering / functional / performance testing methodsreferences/07-troubleshooting.md — upload errors, trigger diagnosis, MCP issues, large-context issuesreferences/08-checklist.md — pre-upload and post-upload checklistsreferences/09-distribution.md — sharing skills via Claude.ai, the Messages API, and GitHubAsset templates (bundled, copy-then-modify):
assets/skill-template.md — minimal SKILL.md starterassets/command-skill-example.md — worked example of a command skill (sequential workflow)assets/context-skill-example.md — worked example of a context skill (coding standards)Official:
All skills created through this flow go to:
~/.claude/custom/skills/<skill-name>/This location is separate from the base installation (~/.claude/skills/) and survives claude-code-setup upgrades.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.