skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A guide for creating well-structured, reusable Claude Code skills.
Pay attention to context cues to gauge familiarity. Keep explanations accessible — don't assume deep technical knowledge unless the user demonstrates it.
Understand what the skill should enable. Extract from the current task context:
Proactively think about edge cases, input/output formats, success criteria, and dependencies before writing. If useful libraries or APIs are involved, check what's available in the environment first.
Based on the task requirements, fill in these components:
#### Anatomy of a Skill
skill-name/
├── SKILL.md (required)
│ ├── YAML frontmatter (name, description required)
│ └── Markdown instructions
└── Bundled Resources (optional)
├── scripts/ - Executable code for deterministic/repetitive tasks
├── references/ - Docs loaded into context as needed
└── assets/ - Files used in output (templates, icons, fonts)#### Progressive Disclosure
Skills use a three-level loading system:
Key patterns:
Domain organization — when a skill supports multiple variants, organize by variant:
cloud-deploy/
├── SKILL.md (workflow + selection logic)
└── references/
├── aws.md
├── gcp.md
└── azure.md#### Writing Patterns
Use the imperative form. Explain the why behind instructions — models understand reasoning, not just rules. Avoid heavy-handed ALL-CAPS MUSTs; explain why something matters instead.
Defining output formats:
## Report structure
Use this exact template:
# [Title]
## Executive summary
## Key findings
## RecommendationsExamples pattern:
## Commit message format
Input: Added user authentication with JWT tokens
Output: feat(auth): implement JWT-based authentication#### Principle of Lack of Surprise
Skills must not contain malware, exploit code, or content that could compromise system security. A skill's contents should not surprise the user given its description.
Write a draft, then review with fresh eyes. Generalize from specific examples — don't overfit to one case. Keep skills lean: remove instructions that aren't pulling their weight. Read as if you're the model using this skill for the first time.
After writing a skill, run the quick validator to check structure:
python environment/skills/<skill-name>/scripts/quick_validate.py environment/skills/<skill-name>/Save each skill as SKILL.md inside a named subdirectory under environment/skills/ (relative path from your working directory). Do not write to /root/.claude/skills/ or any other location.
environment/skills/<skill-name>/SKILL.mdEach SKILL.md must begin with the YAML frontmatter block (name + description).
After creating the skills, solve the task using them as reference.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.