skillpack-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skillpack-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a successful task into a reusable SkillPack. Extract the stable workflow, decide what belongs in a local skill versus pack-level prompts, generate the pack structure, and package it only after the workflow is explicit and repeatable.
Reduce the finished task into a clean execution spec:
Ask for missing stable facts or infer only the low-risk pieces.
skills/): reusable procedural knowledge. Keep scripts minimal unless reproducibility depends on exact file generation or repetitive shell steps.scripts/): repeated shell or file-generation logic where reliability matters.references/): detailed schemas, API notes, or conventions that should not bloat SKILL.md.skillpack.json): 1–3 pack-level starter inputs for the UI — not a DAG or state machine. See references/skillpack-format.md for exact pack semantics.Before writing files, define the pack spec. Prefer one local orchestrator skill plus a small number of external skills. Example minimal manifest:
{
"name": "company-research",
"description": "Research a company and produce a summary report",
"version": "1.0.0",
"prompts": ["Research {company} and create a report with financials and competitors"],
"skills": [
{ "name": "research-orchestrator", "source": "./skills/research-orchestrator", "description": "Orchestrate company research across multiple sources" }
]
}Create skills/<skill-name>/SKILL.md with frontmatter and imperative workflow instructions:
---
name: research-orchestrator
description: "Orchestrate multi-source company research. Use when the user wants a structured company report covering financials, competitors, and market position."
---scripts/ only for fragile or repeated operations; add references/ only for detailed information.Use scripts/scaffold_skillpack.py when you have the pack spec:
# Basic
python3 skills/skillpack-creator/scripts/scaffold_skillpack.py \
--manifest /tmp/skillpack.json \
--output /absolute/path/to/output-pack
# With zip
python3 skills/skillpack-creator/scripts/scaffold_skillpack.py \
--manifest /tmp/skillpack.json \
--output /absolute/path/to/output-pack \
--zipThe script validates the manifest, writes skillpack.json, creates skills/, copies start.sh/start.bat from templates/, and optionally runs npx -y @cremini/skillpack zip.
Before handing the pack back, confirm:
name, source, and descriptionskills/Produce:
skillpack.json.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.