cli-with-claude-skill-7677c0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cli-with-claude-skill-7677c0 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Boss runs many projects where a CLI binary embeds and installs its own Claude Code skill into ~/.claude/skills/<tool>/SKILL.md. The same five mistakes recur across projects:
os.Args / process.argv / sys.argv instead of using a real arg-parser.install-claude-skill command by default — Boss has to ask for it every time.version: field, so the CLI cannot detect outdated installs and cannot auto-update.SKILL.md (the source-of-truth in the repo) is not updated in the same change. Shipped skill drifts from reality.~/.claude/skills/<tool>/SKILL.md (the installed copy) instead of the source file in the CLI repo. Next install-claude-skill overwrites the edits and the work is lost.This skill enforces the rules that prevent each one. Violating the letter of the rules is violating the spirit of the rules.
muveectl in the muvee repo is the canonical example. Mirror its structure for new CLIs:
internal/skill/skill.md + internal/skill/skill.go (//go:embed).cmd/muveectl/main.go (functions claudeSkillPath, parseSkillVersion, shouldShowSkillOutdatedNotice, checkSkillNotice, cmdInstallClaudeSkill).cmd/muveectl/login.go (look for the install-claude-skill cobra.Command).The skill ships templates for Go, Rust, Node/TS, and Python under ~/.claude/skills/cli-with-claude-skill/template/. Pick the one matching your CLI's language.
Shared (language-agnostic):
| Template file | Drop into | Edits needed |
|---|---|---|
template/skill.md | internal/skill/skill.md (Go) / src/skill.md (Rust, Node) / <pkg>/skill.md (Python) | Replace REPLACE_WITH_TOOL_NAME; write the description per skill-description-cso; document subcommands. |
Go + cobra:
| Template file | Drop into | Edits needed |
|---|---|---|
template/go/skill.go | internal/skill/skill.go | None — verbatim. |
template/go/skill_install.go | cmd/<tool>/skill_install.go | Set const toolName; set the <your-module> import path; wire installClaudeSkillCmd into rootCmd.AddCommand and call checkSkillNotice() from PersistentPreRun. |
Rust + clap (derive):
| Template file | Drop into | Edits needed |
|---|---|---|
template/rust/skill_install.rs | src/skill_install.rs | Set pub const TOOL_NAME; add mod skill_install; to main.rs; add InstallClaudeSkill to your Subcommand enum and dispatch to skill_install::install(); call skill_install::check_notice() at the top of main(). Cargo dep: dirs = "5". |
Node / TypeScript + commander:
| Template file | Drop into | Edits needed |
|---|---|---|
template/node/skillInstall.ts | src/skillInstall.ts | Set TOOL_NAME; in your entry: registerSkillCommand(program) and program.hook("preAction", () => checkSkillNotice()). Bundler must keep skill.md next to the bundle (or use a build-time inline plugin and assign EMBEDDED from that). |
Python + click:
| Template file | Drop into | Edits needed |
|---|---|---|
template/python/skill_install.py | <pkg>/skill_install.py | Set TOOL_NAME; in your CLI group: cli.add_command(install_claude_skill_cmd) and call check_skill_notice() from the group callback. Ensure skill.md ships as package data (force-include in pyproject.toml). |
| Language | Library |
|---|---|
| Go | github.com/spf13/cobra |
| Rust | clap (derive) |
| Node / TS | commander |
| Python | click or typer |
No exceptions:
switch os.Args[1] {…} dispatcher "just for now".install-claude-skill from day one.The first commit of a new CLI MUST include all of:
internal/skill/skill.md (embedded via //go:embed).src/skill.md (via include_str!).src/skill.md (bundled or read at install time).<pkg>/skill.md (read via importlib.resources).<tool> install-claude-skill subcommand that writes the embedded content to ~/.claude/skills/<tool>/SKILL.md (creating the directory).PersistentPreRun hook (or equivalent):install-claude-skill.version: older than embedded version: → auto-run install-claude-skill and print Notice: Claude skill is outdated. Auto-updating....Do not invent your own naming. The subcommand name is exactly install-claude-skill. The install path is exactly ~/.claude/skills/<tool>/SKILL.md.
version: field.---
name: <tool>
version: 1
description: Use when ...
---When you add, rename, remove, or change the flags / behavior / defaults of a subcommand:
internal/skill/skill.md or equivalent).version: in that file.Non-negotiable. A change that touches CLI surface but not the embedded SKILL.md is incomplete. Before reporting the task done, grep the embedded SKILL.md for the old command/flag name and confirm the doc is in sync. Run <tool> --help and skim — every subcommand listed there should also be documented in SKILL.md.
If unsure whether SKILL.md needs an update: read the diff. Any user-visible change (new flag, new subcommand, renamed argument, changed default, removed feature, changed output format) requires an update.
When Boss says "update the skill", "the skill is out of date", or "the skill is wrong", you will be tempted to Edit ~/.claude/skills/<tool>/SKILL.md directly. Do not. That file is rendered output. Editing it:
<tool> install-claude-skill invocation (which the CLI may auto-run on every startup per Rule 2). Your edits vanish silently.Procedure when asked to update an installed skill:
name: is the binary name. which <name> if installed locally; otherwise the surrounding conversation will name the project.internal/skill/skill.mdcmd/<tool>/skill.mdsrc/skill.mdgrep -rl "install-claude-skill\|claudeSkillPath\|embeddedSkill" . then follow the embed directive.version:.<tool> install-claude-skill (or rebuild + invoke) to refresh the installed copy locally — do not run it yourself unless Boss approves, because rebuilding may not be free.Red flags — STOP and re-evaluate if you catch yourself about to:
Edit / Write on any path under ~/.claude/skills/<tool>/ while you are working inside that tool's source repo.~/.claude/skills/<tool>/SKILL.md and also the repo's internal/skill/skill.md "to keep them in sync" — only the repo file is authoritative; the installed copy is generated.The installed copy at ~/.claude/skills/<tool>/SKILL.md is read-only from this skill's perspective. The only writer is the CLI's own install-claude-skill command.
| You hear yourself thinking… | What's actually true |
|---|---|
| "Hand-parsing is fine, only two subcommands." | Project will grow. Rule 1 is unconditional. |
"I'll add install-claude-skill later, the user didn't ask." | Boss has asked for it on every prior project. Add it now. |
| "Version field is just bureaucracy." | The auto-update check parses it. No version = the user keeps getting stale skills forever. |
| "The CLI change is small, the skill is still mostly right." | "Mostly right" docs mislead future agents. Update it now while the diff is fresh. |
"Boss said update the skill — ~/.claude/skills/<tool>/SKILL.md is right there." | That's the rendered output. Find the source in the repo (Rule 5 procedure). |
| "I'll edit both copies to be safe." | No. Editing the installed copy is wasted work; it gets overwritten. Edit the source only. |
name, version: 1, and a CSO-compliant description (see skill-description-cso).install-claude-skill subcommand implemented.PersistentPreRun or equivalent.--version flag implemented.SKILL.md source updated (subcommand description, flags, one usage example).version: bumped in the embedded skill.<tool> install-claude-skill locally and grep <new-command> ~/.claude/skills/<tool>/SKILL.md to confirm the new section made it through.skill-tdd-and-persuasion, skill-description-cso). Those live at their installed path and are edited there directly.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.