new-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited new-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creates a public skill under skills/<name>/ and stress-tests it through the full RED → GREEN → REFACTOR → adversarial-review → validate cycle before declaring it done.
Before writing a single line of skill content, run /skill-tester to establish the baseline. Use its checklist to have a subagent run without the new skill loaded and record every rationalization the agent uses to skip the rule you are encoding. Document those rationalizations — every one must be countered in the skill body.
dep-auditor). skills/<name>/SKILL.md ---
name: <name>
description: Use when <specific triggering conditions — no workflow summary, ≤500 chars>
---## Overview — one paragraph: what it does, hostile framing, single-shot behaviour## When to Use — bullet list of triggering conditions and situations## Process — numbered steps (find → ask → fix → re-validate)## Findings Format — findings grouped by severity: Critical / High / Medium / Low / Advisory; Fixed and Invalid sections group entries under ### Pass N — YYYY-MM-DD h3 headers; output path docs/audit/<name>-findings.md. (Non-audit skills that write only to stdout may use ## Output Format instead.)## Fix Strategy — what may be auto-applied, what requires user approval## Common Mistakes — what the skill must NOT doa Common Mistakes entry for each one. "Rationalisation" and "rationalization" refer to the same thing; use "rationalization" (US spelling) consistently throughout.
Run /skill-tester again, this time with the skill loaded. Confirm the agent complies with every rule. If the agent finds a new loophole, add an explicit counter and re-run until no loopholes remain.
With the GREEN phase clean, refactor the skill body for clarity and hostile precision:
unconditional
RED phase
/skill-tester after refactoring to confirm no regression — all GREENscenarios must still pass
Run /adversarial-reviewer against the new skills/<name>/SKILL.md file. Treat the skill body as code under review — hunt for ambiguous rules, missing edge-case coverage, hedged language, and instructions that permit rationalization. Fix every HIGH or CRITICAL finding. Re-run until adversarial-reviewer reports no findings at HIGH or above.
CLAUDE.md..claude/skills/skills/SKILL.md — this is the launcher skill users invoke to discover and route to public skills. Keep it in sync..github/copilot-instructions.md.Also update README.md — it always contains a mirrored skills table.
.claude/skills/README.md (the wiring guide). Update the Quick Reference Input/Output table as needed.
uv run scripts/validate-skill.py skills/<name>/SKILL.md/validate-skills to confirm all skills remain consistent./pr-reviewer on the staged diff. Fix all findings at HIGH or above.Re-run until pr-reviewer reports no findings at HIGH or above.
feat: add <name> skill — this triggers a minor version bump.A skill is not done until all of these pass:
uv run scripts/validate-skill.py skills/<name>/SKILL.md exits 0 with no errors/validate-skills exits clean~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.