prompt-engineering — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited prompt-engineering (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CRITICAL: Check existing project conventions before inventing new ones. Read CLAUDE.md, .claude/rules/, and existing skills to align with what's already established.
Before asking questions, analyze what you already know:
Use structured questions. Don't over-ask for simple processes.
Round 1 — High-Level Confirmation
Round 2 — Details
.claude/skills/<name>/SKILL.md) — project-specific workflows~/.claude/skills/<name>/SKILL.md) — follows you across reposRound 3 — Per-Step Breakdown For each major step, if not obvious:
Round 4 — Final
Use this template:
---
name: {{skill-name}}
description: {{one-line description}}
allowed-tools:
{{list of tool permission patterns}}
when_to_use: {{detailed invocation triggers with example phrases}}
argument-hint: "{{hint showing argument placeholders}}"
arguments:
{{list of argument names}}
context: {{inline or fork — omit for inline}}
---
# {{Skill Title}}
Description of skill
## Inputs
- `$arg_name`: Description of this input
## Goal
Clearly stated goal with defined artifacts or completion criteria.
## Steps
### 1. Step Name
What to do. Be specific and actionable. Include commands when appropriate.
**Success criteria**: What proves this step is done.Direct (default), Task agent (subagent), or [human] (user does it)security-review patterns for checklists.[human] in the titleallowed-tools: Minimum permissions needed — least privilege. Use patterns like Bash(gh:*), not blanket Bash. Grant only what the skill actually requires.context: Only set context: fork for self-contained skillswhen_to_use: CRITICAL — this tells the model when to auto-invoke. Start with "Use when..." and include trigger phrasesuser-invocable: true for skills the user triggers explicitlydisable-model-invocation: true for sensitive skills that shouldn't auto-triggerShow the complete SKILL.md to the user for review before writing. After saving, tell them:
/{{skill-name}} [arguments]When designing a standalone agent (not a skill):
Identify the fundamental purpose, responsibilities, and success criteria. Check CLAUDE.md for project-specific context the agent should align with.
Create an identity with domain knowledge relevant to the task. Written in second person ("You are...", "You will...").
The system prompt should:
{
"identifier": "descriptive-agent-name",
"whenToUse": "Use this agent when... (include example triggers)",
"systemPrompt": "Complete operational manual for the agent"
}When a skill or agent needs structured output, define the contract explicitly:
<analysis>, <summary>, <result> for machine-parseable sectionsForced structured output (guaranteed schema with tool_choice or JSON mode) eliminates format drift at zero ongoing prompt cost.
CRITICAL REMINDER: Check existing conventions first. Interview before authoring. Every skill needs when_to_use and per-step success criteria. Show the result for review before saving.
codebase-exploration and code-verification as sub-workflows.task-orchestration patterns inform how multi-step skills coordinate work.safe-autonomous-mode risk classification informs allowed-tools scoping.If user-config.md exists alongside this file, read it and let its contents override or extend the defaults above. Common customizations:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.