skill-authoring-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-authoring-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create or update PM skills without chaos. This workflow turns rough notes, workshop content, or half-baked prompt dumps into compliant skills/<skill-name>/SKILL.md assets that actually pass validation and belong in this repo.
Use it when you want to ship a new skill without "looks good to me" roulette.
Use repo-native tools and standards before inventing a custom process:
scripts/find-a-skill.shscripts/add-a-skill.shscripts/build-a-skill.shscripts/test-a-skill.shscripts/check-skill-metadata.pyA skill is done only when:
name, description, intent, type)name <= 64 chars, description <= 200 chars)When running this workflow as a guided conversation, use workshop-facilitation as the interaction protocol.
It defines:
Other (specify) when useful)This file defines the workflow sequence and domain-specific outputs. If there is a conflict, follow this file's workflow logic.
./scripts/find-a-skill.sh --keyword "<topic>"If you have source material:
./scripts/add-a-skill.sh research/your-framework.mdIf you want guided prompts:
./scripts/build-a-skill.shManually review for:
Run strict checks before thinking about commit:
./scripts/test-a-skill.sh --skill <skill-name> --smoke
python3 scripts/check-skill-metadata.py skills/<skill-name>/SKILL.md
python3 scripts/check-skill-triggers.py skills/<skill-name>/SKILL.md --show-casesIf this is a new skill:
If targeting Claude custom skill upload:
./scripts/zip-a-skill.sh --skill <skill-name>
# or zip one category:
./scripts/zip-a-skill.sh --type component --output dist/skill-zips
# or use a curated starter preset:
./scripts/zip-a-skill.sh --preset core-pm --output dist/skill-zipsInput: research/pricing-workshop-notes.md Goal: new interactive advisor
./scripts/add-a-skill.sh research/pricing-workshop-notes.md
./scripts/test-a-skill.sh --skill <new-skill-name> --smoke
python3 scripts/check-skill-metadata.py skills/<new-skill-name>/SKILL.mdExpected result:
"We wrote a cool skill, skipped validation, forgot README counts, and shipped anyway."
Result:
workflow when the task is really a component template.intent become a substitute for a weak trigger description.README.mdAGENTS.mdCLAUDE.mddocs/Building PM Skills.mddocs/Add-a-Skill Utility Guide.mdscripts/add-a-skill.shscripts/build-a-skill.shscripts/find-a-skill.shscripts/test-a-skill.shscripts/check-skill-metadata.pyscripts/check-skill-triggers.pyscripts/zip-a-skill.sh~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.