sciagent-skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sciagent-skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Repo-local scaffolder for skills/ entries. Mechanizes the boilerplate from CLAUDE.md Steps 1, 2, 4, 5, 6 so authoring effort stays on content (When to Use, Workflow, Recipes, References) and not on field plumbing.
/sciagent-skill-creator directlyregistry.yaml and create a skills/<cat>/<name>/SKILL.md from scratch — use this insteadDo not invoke for:
CLAUDE.md "Migrating from Existing Entries" first — the scaffolder generates a skeleton, but migration requires content judgment)registry.yaml only (use a normal edit)Before calling the scaffold script, gather these — in conversation, not via flags hidden from the user:
pipeline | toolkit | database | guide. Use the decision rule from CLAUDE.md Step 1b. If unsure, ask the user.CLAUDE.md Step 2 if the user is unsure.{tool-name}-{purpose} (e.g., pydeseq2-differential-expression). Confirm with the user.CC-BY-4.0 for original prose-only content.scientific-writing, tag with ["databases", "literature"]).Before calling the scaffold script, search the registry and legacy/ for similar names:
grep -i "<topic-keyword>" registry.yaml
ls legacy/ | grep -i "<topic-keyword>"If a near-duplicate exists, surface it to the user before continuing. Authoring a parallel entry usually means the existing one needs updating, not duplication.
Call scripts/scaffold.py with explicit arguments. The script is non-interactive — the agent provides all values:
python .claude/skills/sciagent-skill-creator/scripts/scaffold.py \
--sub-type pipeline \
--category genomics-bioinformatics \
--name my-tool-purpose \
--description "MyTool short-form description starting with the tool name. Brief on inputs, outputs, when to pick this over alternatives." \
--license MIT \
--tags databases,literature # optional, comma-separatedBehavior:
registry.yaml, not in legacy/)skills/validate_description.py (length + first-120-char keyword lead)skills/{category}/{name}/SKILL.md from the matching template, substituting frontmatter fieldsregistry.yaml with date_added = today (UTC)pixi run validate to confirm the registry is still well-formedOn any validation failure, the script aborts without writing anything. Fix the offending value and re-run.
The generated SKILL.md is a skeleton with placeholders. The agent's remaining job:
Overview, When to Use, Prerequisites, Workflow / Core API / Key Concepts, Common Recipes, Troubleshooting, Referencespixi run test — full suite, not just validate — to catch sub-type-specific structural failures (code block counts, table row counts, section presence)The scaffold script does not pretend to write content. Content stays with the agent and the source material.
Skills document a tool's analysis surface, not the consumer's house style. A SKILL.md is read by many agents for many downstream tasks — visual choices that fit one analysis brief leak into every future invocation. Strip the following before committing:
#08306b), no LinearSegmentedColormap.from_list(...), no ListedColormap([...]), no prescribed cmap= arguments unless the cmap is the tool's API (e.g., a tool that ships its own palette). Let matplotlib pick defaults; the consumer overrides downstream.colors = {"rep1": "#1f77b4", ...}. Matplotlib auto-cycles colors.figsize=(8, 4) for a routine line plot is fine; figsize=(12, 4) chosen to fit a slide deck is not."figures/", "results/", f"{pdb_id}_protein.pdb" are fine as illustrative outputs; "/Users/me/proj42/output" is not.What to keep: the analysis logic, the data shape, the units, the parameter semantics, the expected output structure (columns, axes, units), and any visual choice the tool itself enforces.
Rule of thumb: if a downstream consumer would override the choice, don't ship the choice in the skill.
A SKILL.md is reference material for agents, not a tutorial. Token cost matters — every line is paid for on every retrieval. Write like documentation, not like a walkthrough:
# load the trajectory above traj = md.load(...) is noise).Target density: a reader scanning the file should reach the next code block within ~5 lines of prose. If a section's prose is longer than its code, tighten the prose.
SKILL.md — this file (when/how/what)scripts/scaffold.py — non-interactive scaffolder (create files, append registry, run validate)scripts/validate_description.py — description linter (length + first-120-char keyword rule). Reused by scaffold.py and standalone.Use, A, An, The, Query) → rewrite leading with the tool namepixi run validate fails after scaffold → the registry is in an inconsistent state, abort and revert the partial write (the script does this automatically; report the validator output verbatim)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.