managing-library — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited managing-library (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A library is a repo created with adept init --as-library. It exists to publish skills to other repos. It has two skill locations — keep them straight:
| location | source in adept skill list | published to consumers? | purpose |
|---|---|---|---|
skills/<id>/ (repo root) | published | yes | the library's product |
.adeptability/skills/<id>/ | private | no | dev-only helpers, rendered to your harness |
config.json carries "layout": "library". Consumers add the repo with adept library add <name> --from <git-url> and only ever see the published skills/.
In a library, adept skill add defaults to private (it's the safe default — nothing is published by accident). Use --publish for skills that ship to consumers:
adept skill add my-helper # → .adeptability/skills/my-helper/ (private, dev-only)
adept skill add pr-review --publish # → skills/pr-review/ (published)
adept skill list # SOURCE column shows published | private | library:<name>edit and remove take a bare <id> and find it in either location (published wins on a name clash):
adept skill edit pr-review
adept skill remove my-helperPrivate skills render to your enabled harnesses so they assist you while you author the library, without shipping:
adept harness add claude-code # once
adept sync # renders published + private → .claude/skills/, …
echo ".claude/" >> .gitignore # rendered output is not sourceadept init --as-library seeds this skill and the authoring helpers (using-adept, authoring-adept-skills) straight into .adeptability/skills/ for you.
Commit and push. Only skills/ (published) reaches consumers; .adeptability/skills/ and the gitignored .claude/ stay local.
git add skills .adeptability && git commit -m "add <skill>" && git pushRules of thumb:
skills/<id>/SKILL.md or .adeptability/skills/<id>/SKILL.md), thenadept sync. Never hand-edit rendered harness files — run adept sync-from to adopt those.
adept status / adept diff before and after a sync to see what changed.adept --help and adept skill --help are the source of truth for flags.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.