skill-authoring-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-authoring-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create or update PM skills without chaos. This workflow turns rough notes, workshop content, or half-baked prompt dumps into compliant skills/<skill-name>/SKILL.md assets that actually pass validation and belong in this repo.
Use it when you want to ship a new skill without "looks good to me" roulette.
Bring the raw material and the intent — rough is fine; the workflow exists to get it the rest of the way:
If you supply this inline with your request (e.g., "turn research/pricing-workshop-notes.md into an interactive advisor"), the workflow starts at Phase 1 with that context — it won't re-ask for what you already gave. If you provide nothing, it opens by asking what content you want to turn into a skill and offers the entry modes from the facilitation protocol.
Example: Use skill-authoring-workflow: convert research/pricing-workshop-notes.md into an interactive pricing advisor.
Use repo-native tools and standards before inventing a custom process:
scripts/find-a-skill.shscripts/add-a-skill.shscripts/build-a-skill.shscripts/test-a-skill.shscripts/check-skill-metadata.pyA skill is done only when:
name, description, intent, type)name <= 64 chars, description <= 200 chars)$ARGUMENTS (rationale: CONTRIBUTING.md, "Why We Don't Use $ARGUMENTS")When running this workflow as a guided conversation, use workshop-facilitation as the interaction protocol.
It defines:
Other (specify) when useful)This file defines the workflow sequence and domain-specific outputs. If there is a conflict, follow this file's workflow logic.
./scripts/find-a-skill.sh --keyword "<topic>"If you have source material:
./scripts/add-a-skill.sh research/your-framework.mdIf you want guided prompts:
./scripts/build-a-skill.shManually review for:
sample-industrial.md)template.md when the skill produces an artifact — the output schema as a copy/paste fill-in with quality checksRun strict checks before thinking about commit:
./scripts/test-a-skill.sh --skill <skill-name> --smoke
python3 scripts/check-skill-metadata.py skills/<skill-name>/SKILL.md
python3 scripts/check-skill-triggers.py skills/<skill-name>/SKILL.md --show-casesIf this is a new skill:
If targeting Claude custom skill upload:
./scripts/zip-a-skill.sh --skill <skill-name>
# or zip one category:
./scripts/zip-a-skill.sh --type component --output dist/skill-zips
# or use a curated starter preset:
./scripts/zip-a-skill.sh --preset core-pm --output dist/skill-zipsInput: research/pricing-workshop-notes.md Goal: new interactive advisor
./scripts/add-a-skill.sh research/pricing-workshop-notes.md
./scripts/test-a-skill.sh --skill <new-skill-name> --smoke
python3 scripts/check-skill-metadata.py skills/<new-skill-name>/SKILL.mdExpected result:
"We wrote a cool skill, skipped validation, forgot README counts, and shipped anyway."
Result:
workflow when the task is really a component template.intent become a substitute for a weak trigger description.README.mdAGENTS.mdCLAUDE.mddocs/Building PM Skills.mddocs/Add-a-Skill Utility Guide.mdscripts/add-a-skill.shscripts/build-a-skill.shscripts/find-a-skill.shscripts/test-a-skill.shscripts/check-skill-metadata.pyscripts/check-skill-triggers.pyscripts/zip-a-skill.sh~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.