skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read your credentials from ~/.gooseworks/credentials.json:
export GOOSEWORKS_API_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json'))['api_key'])")
export GOOSEWORKS_API_BASE=$(python3 -c "import json;print(json.load(open('$HOME/.gooseworks/credentials.json')).get('api_base','https://api.gooseworks.ai'))")If ~/.gooseworks/credentials.json does not exist, tell the user to run: npx gooseworks login
All endpoints use Bearer auth: -H "Authorization: Bearer $GOOSEWORKS_API_KEY"
Create modular, self-contained skill packages that extend agent capabilities.
The context window is shared. Only add what the agent doesn't already know. Challenge every paragraph: "Does this justify its token cost?" Prefer concise examples over verbose explanations.
skill-name/
├── SKILL.md # Required: frontmatter + instructions
├── scripts/ # Optional: executable code (deterministic tasks)
├── references/ # Optional: docs loaded on-demand
└── assets/ # Optional: files used in output (templates, images)---
name: skill-name
description: What it does + when to use it. This is the trigger mechanism.
---
# Skill Name
[Instructions for using the skill]name: lowercase, hyphens, under 64 chars (e.g., pdf-editor, gh-review-pr)description: Include BOTH what it does AND when to trigger. The body isn't loaded until after triggering, so all "when to use" info must be here.Match specificity to task fragility:
| Freedom | Use When | Format |
|---|---|---|
| High | Multiple valid approaches | Text instructions |
| Medium | Preferred pattern exists | Pseudocode, parameterized scripts |
| Low | Fragile/error-prone ops | Specific scripts, few params |
orth skills init <name>orth skills submit <path># Create new skill
orth skills init my-skill
# Or with path
orth skills init my-skill --path ~/.openclaw/skills
# Submit to Orthogonal
orth skills submit ./my-skill
# Update existing skill
orth skills update <slug> ./my-skillKeep SKILL.md under 500 lines. Split into reference files when approaching this limit.
Pattern: High-level guide with references
## Quick start
[Core workflow here]
## Advanced
- **Complex feature**: See references/feature.md
- **API details**: See references/api.mdPattern: Domain organization
bigquery-skill/
├── SKILL.md (overview + navigation)
└── references/
├── finance.md
├── sales.md
└── product.mdAgent loads only the relevant reference file.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.