Skillmeld — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Skillmeld (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Score rose 85 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- A demo GIF of a real /skillmeld run (the Grasshopper conflict beat) is planned as the README hero — see workbook/Plan/repo-presentation.md and roadmap.md. -->
<!-- On PyPI publish, add:
-->
Describe what you want to do, point skillmeld at your repo, and it finds existing community skills for the job, security-scans them, and merges the best two or three into one coherent skill set tailored to your project — instead of writing one from scratch.
It runs on your own Claude in Claude Code, grounds in your repo, and shows you what it pulled, what it found, and why before anything is installed. It builds on the existing skills ecosystem (the open standard, community marketplaces, and registries) rather than replacing it.
skillmeld composes; it does not generate. Every line in a merged skill traces byte-for-byte back to a source skill — a deterministic verifier enforces this, so the tool can never invent an instruction. The hard, mechanical work (parsing, security scanning, deduplicating, conflict detection, packaging) runs as deterministic Python that makes zero model calls. Your Claude supplies the judgment; the engine supplies the guarantees.
A Claude Code skill drives a bundled Python engine through one pipeline:
intake -> ground -> discover -> select (<=3) -> security gate -> merge -> eval -> emitPROVENANCE.md recording where every part came from.skillmeld runs in Claude Code and needs uv. Clone it and check it runs:
git clone https://github.com/ifylab/skillmeld && cd skillmeld
uv run skillmeld --helpA PyPI release for one-line install (uv tool install skillmeld / pipx install skillmeld) is planned.
As a skill, add the marketplace, install the plugin, and invoke it with your use case:
/plugin marketplace add ./skillmeld
/plugin install skillmeld@ifylab
/skillmeld I get IFC models from architects and need a quantity takeoff plus validationOr exercise the engine directly from the CLI (each command prints JSON):
uv run skillmeld ground . # scan a repo into a profile
uv run skillmeld scan path/to/skill --license # security- and license-scan a bundle
uv run skillmeld merge --bundles a/ b/ --profile profile.jsonskillmeld stands on the open Agent Skills ecosystem — the skill format, the community marketplaces, and the registries that publish and share skills. It composes that work; it does not replace it. Security scanning leans on bandit, with optional semgrep and gitleaks when present.
In active development, built in the open one piece at a time. The discovery, security, merge, evaluation, and packaging stages are implemented and tested; the hosted catalog and the curated AEC corpus are coming next. See the changelog.
Python 3.12, managed with uv. Ruff for lint and format, ty for type-checking, pytest for tests.
uv run ruff check . && uv run ty check && uv run pytestIssues and pull requests are welcome — see CONTRIBUTING.md. Contributions are accepted under the project's Apache 2.0 license (inbound = outbound); no separate contributor agreement is required.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.