create-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-skill (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a new skill in .agents/skills/<skill-name>/ following the workflow defined in .agents/skills/README.md.
Before creating anything, ask the user:
gh-create-pr, prepare-release).claude/skills/ for shared use? (default: no, private only)If the user provides partial info (e.g., just a name), proceed with reasonable defaults and ask to confirm.
Always read .agents/skills/README.md before creating a new skill to ensure compliance with the current workflow.
Create the following directory structure:
.agents/skills/<skill-name>/
└── SKILL.mdSKILL.md template:
---
name: <skill-name>
description: <description>
---
# <Skill Name>
[Instructions for the skill]Frontmatter fields:
name: Skill identifier (lowercase, digits, hyphens)description: When to trigger (what the skill does + specific contexts)If the user wants a public skill, before validation:
.agents/skills/public-skills.txt (one per line, no inline comments) pnpm skills:syncThis creates a symlink at .claude/skills/<skill-name>/ pointing to .agents/skills/<skill-name>/.
Note: pnpm skills:check primarily validates public skills (those in public-skills.txt) and also verifies related governance files, so you must sync first before validating.
Run the validation command:
pnpm skills:checkIf there are issues, fix them and re-run.
Present the user with:
gh-create-pr)| Type | Location | Sync | Requires |
|---|---|---|---|
| Private | .agents/skills/ | No | Just create the folder |
| Public | Both | Yes | Add to public-skills.txt + run pnpm skills:sync |
# Validate skill structure
pnpm skills:check
# Sync public skills to Claude
pnpm skills:sync.agents/skills/<skill-name>/pnpm skills:check before completingpublic-skills.txt AND running pnpm skills:sync~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.