skill-debrief — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-debrief (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Capture lessons from a session into the skill that drove it. The default shape is listen → propose → align → apply → re-install.
Trigger when the user wants to debrief an existing SKILL.md based on what happened in the session. Examples:
Do NOT use this skill for:
agr init to scaffold a SKILL.md anddefer the body content to the user — or to a dedicated authoring skill such as anthropics/skills/skill-creator (agr add anthropics/skills/skill-creator).
agr CLI work(agr add, agr sync, agr upgrade, agr remove).
Ask which skill is being improved if it isn't obvious from context. Then locate the source:
agr list # see installed deps and short names
ls skills/ # in-repo source if present
cat agr.toml # see whether the dep is local-path or remoteTwo cases — they have different update paths:
| Case | Source location | Update path |
|---|---|---|
In-repo ({path = "./skills/<name>", type = "skill"} in agr.toml) | skills/<name>/ | Edit source → commit → agr upgrade <name> |
Remote ({handle = "user/repo/<name>", …}) | Upstream GitHub repo | Cannot edit directly — see Step 5 |
If the skill isn't installed at all but the user wants to improve it, ask whether to add it first (and which case applies).
Listen. The user invoked this skill because they have something to say — let them say it. Do not interrogate. Do not run a checklist of questions at them. Take in whatever they offer, in whatever shape they offer it.
Only ask a clarifying question if you genuinely cannot proceed without one (e.g. the user named a skill that doesn't exist, or two skills share the name and you need to disambiguate). Even then, ask the minimum.
Be dynamic. The user may surface things in any shape — a single sentence ("the description should also fire on X"), a structured list, or a ramble that you need to distill. They may also surface things outside the standard buckets below (rename a section, restructure references/, change output format, drop a deprecated workflow, fix a typo). Apply whatever the user actually says.
The buckets below are a mental map for you when distilling what you heard, not a checklist to recite at the user:
references/<topic>.mdSummarize what you heard, then propose specific edits. Format:
Proposed changes to `skills/<name>/SKILL.md` (and any references):
>
1. Description — add trigger phrase "…" (because: …) 2. Boundaries — add: never X (because: discovered this in session) 3. New section "Y" — describes the workflow that was missing
>
Want me to apply these, revise, or add more?
For small edits, show the exact diff inline. For larger changes, summarize first and apply section by section.
Wait for explicit user approval before editing. "yes" / "go ahead" / similar. If the user revises, loop back to Step 2 or 3.
Edit the source file(s) under skills/<name>/. Then:
git status # confirm only the intended files changed
git add skills/<name>/
git commit -m "skill(<name>): <one-line summary>"
agr upgrade <name> # re-installs into all configured tools, refreshes agr.lock
git add agr.lock
git commit --amend --no-edit # or commit separately; match the repo's styleDo not push. Stop after the commit and let the user push when ready.
Use a conventional-commits-style scope:
skill(<name>): <imperative summary>Examples:
skill(agr-cli): clarify upgrade vs sync for local paths
skill(agr-cli): add gotcha for same-repo siblings
skill(code-review): drop outdated linter pre-checkIf the repo's commit style differs (check git log --oneline -20), match it.
agr upgrade and not agr sync?agr sync only installs missing deps — it does NOT re-copy a local-path skill that's already installed. agr upgrade <name> re-copies it and refreshes agr.lock. Use agr upgrade.
(Equivalent: agr add ./skills/<name> --overwrite. Pick upgrade for consistency — it's the same verb used to refresh remote skills.)
If the skill is a remote dep, the change cannot be applied directly. Ask the user which path they want:
ghBest when the change benefits everyone (a real bug or universal improvement in someone else's published skill).
Resolve the upstream repo from the handle:
anthropics/skills/pdf → --repo anthropics/skillsuser/myrepo/skill → --repo user/myrepoConfirm the title and body with the user, then:
gh issue create \
--repo <owner>/<repo> \
--title "[<skill-name>] <short summary>" \
--body "$(cat <<'EOF'
## What I observed
<concrete scenario from the session>
## Suggested change
<proposed wording or workflow>
## Why
<reasoning>
EOF
)"gh issue create posts publicly — treat it the same as any other shared- state action. Always confirm before running.
If the user has push access and a local clone, also offer to open a PR instead of (or alongside) the issue.
Best when the change is project-specific or unlikely to be accepted upstream. Copies the skill into skills/<name>/ so future retros work the in-repo way.
Suggested flow:
# 1. Find the upstream commit (agr.lock has it)
agr list
# 2. Sparse-checkout or full clone, then copy the folder:
mkdir -p skills
cp -r /tmp/upstream-clone/<skill-folder> skills/<name>
# 3. Swap the dep
agr remove anthropics/skills/<name>
agr add ./skills/<name>Tell the user this forks the skill — they're now responsible for keeping it current with upstream. Then continue from Step 3 with the in-repo flow.
Offer Option A first when the change is generally useful. Offer Option B when upstream is unlikely to accept, or when the user wants the change now without waiting on upstream.
After re-installing (in-repo case):
agr list # status should be `installed`
diff skills/<name>/SKILL.md .claude/skills/<name>/SKILL.md # should be emptyFor remote case (issue filed): confirm the issue URL with the user.
Tell the user what's done and what's pending (commit done, push pending; or issue filed, awaiting response).
changes.** Skills are user-owned content — never silently revise.
the user first. gh issue create is publicly visible — treat it as shared-state.
agr upgrade regenerates it.user asked to fix one gotcha, don't also restructure the file.
anthropics/skills/skill-creator — canonical greenfield skill authoring(install with agr add anthropics/skills/skill-creator if needed)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.