command-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited command-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create Claude Code custom slash commands with proper structure and best practices.
Claude Code commands are Markdown files with YAML frontmatter that define reusable workflows invoked via /command-name. They live in specific locations depending on scope:
.claude/commands/ in the project root (shared via git)~/.claude/commands/ (personal, available everywhere)gh/review-pr.md becomes /gh:review-pr)Before writing anything, understand:
gh for GitHub, cc for Claude Code meta-commands)Every command file follows this structure:
---
description: Brief description shown in command list
argument-hint: [expected-arguments]
allowed-tools: Tool1, Tool2, Bash(prefix:*)
---
# Command Name
What this command does and when to use it.
## Process:
Step-by-step instructions for the agent to follow.
## Your Task:
Act on "$ARGUMENTS" following these guidelines.#### Frontmatter fields
| Field | Required | Purpose |
|---|---|---|
description | Yes | Short description shown when listing commands |
argument-hint | No | Hint for expected arguments (shown in autocomplete) |
allowed-tools | No | Restrict which tools the command can use |
#### Key conventions
Read, Write), or prefix globs for Bash (Bash(git:*), Bash(npm:*)).| Scope | Path | When to use |
|---|---|---|
| Project (shared) | .claude/commands/ | Team workflows, project-specific tasks |
| Project (categorized) | .claude/commands/<category>/ | Grouped commands (e.g., gh/, db/) |
| User (personal) | ~/.claude/commands/ | Personal productivity, cross-project tools |
After creating the command file:
$ARGUMENTS is referenced if the command accepts inputallowed-tools includes everything the command needs---
description: Review a pull request with detailed analysis
argument-hint: [PR-number-or-URL]
allowed-tools: Bash(gh:*), Read, Grep, Glob
---
# Review PR
Perform a thorough code review of a GitHub pull request.
## Process:
1. Fetch PR details and diff using `gh pr view` and `gh pr diff`
2. Read changed files for full context
3. Analyze changes for:
- Correctness and potential bugs
- Code style consistency
- Missing tests or edge cases
- Security concerns
4. Provide a structured review summary
## Your Task:
Review PR "$ARGUMENTS" following these guidelines. If no PR number is given,
use `gh pr list` to show recent PRs and ask which one to review.fix-issue.md not fi.md)$ARGUMENTS is emptyallowed-toolsCreate a new command based on "$ARGUMENTS":
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.