create-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Choose the location based on scope — in order of priority:
| Priority | Condition | Path |
|---|---|---|
| 1 | User explicitly provided a path | Use that path |
| 2 | Skill is tied to a specific component | .ai/Component/{Name}/skills/{skill-name}/SKILL.md |
| 3 | Skill is tied to a specific domain | .ai/Domain/{Name}/skills/{skill-name}/SKILL.md |
| 4 | Cross-cutting (spans multiple domains/components) | .ai/skills/{skill-name}/SKILL.md |
After writing the file:
## Skills section (or entry) to the corresponding CONTEXT.md — root .ai/CONTEXT.md for cross-cutting skills, or .ai/Component/{Name}/CONTEXT.md / .ai/Domain/{Name}/CONTEXT.md for scoped skills. This is the agnostic discovery mechanism for all non-Claude tools..claude/skills/ pointing to the skill directory (not the file). The path must be relative. This enables Claude Code auto-discovery. cd .claude/skills && ln -s ../../<skill-dir-path-from-repo-root> <skill-name>CONTEXT.md owns conventions (rules, patterns, constraints — the "why" and "what"). SKILL.md owns procedures (steps, code templates, checklists — the "how"). Content must live in exactly one place.
| CONTEXT.md | SKILL.md | |
|---|---|---|
| Contains | Conventions, rules, patterns | Procedures, step-by-step instructions, code templates |
| Audience | Any AI tool or human | An AI agent executing a specific task |
| Duplication | Authoritative source — never restated elsewhere | References CONTEXT.md conventions, never restates them |
For every rule or convention you're about to write in a skill, apply this decision:
#[AsCommandHandler]" → CONTEXT.mdSee [Component/CONTEXT.md](../../CONTEXT.md#section) for X convention. Do not copy the rule text into the skillCheck the skill's ## Rules section and any inline convention statements:
Not everything belongs in CONTEXT.md either. Skip:
grep or glob can answer.ai/CONTEXT.md (project-wide coding standards, testing framework)The ## Related section in CONTEXT.md files links to other contexts. Use it sparingly — every link is a potential cascade where an AI agent follows A → B → C and ends up loading all contexts, which defeats the purpose of splitting them.
Only link when the relationship is non-obvious (architectural surprise, coexistence gotcha). Do not link for obvious usage relationships ("Controller uses CQRS") or just to mention a class name that's greppable. When in doubt, omit the link.
--- markers)| Field | Required | Description |
|---|---|---|
name | No (defaults to dir name) | Lowercase, hyphens, max 64 chars |
description | Required | What it does + trigger phrases. Max ~250 chars before truncation — front-load the key use case. If the skill requires arguments, describe them here. Do not include "Read Component/X/CONTEXT.md for conventions" in the description — that pointer belongs in the skill body, not the description. See STRUCTURE.md → SKILL.md project conventions. |
argument-hint | No | Shown in autocomplete, e.g. [domain-name] |
allowed-tools | No | Tools usable without permission prompt, e.g. Read, Grep, Glob |
disable-model-invocation | No | true = I cannot auto-invoke; only explicit /name call works |
user-invocable | No | false = hidden from / menu; I can still invoke automatically |
paths | No | Glob patterns that scope auto-activation, e.g. src/**/*.php |
effort | No | low / medium / high / max |
context | No | Omit for inline execution (default). fork = run as isolated subagent |
agent | No | Subagent type when context: fork — Explore, Plan, general-purpose |
model | No | Override model for this skill |
This project uses four custom frontmatter fields on top of the standard ones: needs, produces, conditional, subagent. They are not interpreted by Claude Code but document the skill's place in larger workflows and serve as machine-readable hints for orchestrators.
See STRUCTURE.md → SKILL.md project conventions for the full definition of these fields, the top-down dependency rule, and the standalone rule. Do not duplicate that documentation here.
Arguments: If a skill requires arguments that the user must provide, describe them in the description field. At runtime, if a required argument is missing, use AskUserQuestion to prompt the user.
Plain markdown. No required sections — write whatever instructions I need to follow.
Useful substitutions in body:
$ARGUMENTS — full argument string passed after the skill name$0, $1, … — individual arguments by position !command ` — runs a shell command before I see the content; output is inlineddisable-model-invocation | user-invocable | Result |
|---|---|---|
| false (default) | true (default) | You can call it; I can auto-invoke it |
| true | true | You can call it; I cannot auto-invoke |
| false | false | Hidden from menu; I auto-invoke only |
---
name: my-skill
description: >
One sentence what it does. Trigger phrases: "do X", "create Y", "add Z".
allowed-tools: Read, Grep
---
# My Skill
## Purpose
What this skill accomplishes.
## Steps
1. …
2. …
## Output
Where to write the result.The canonical Anthropic skill creator (may contain updates not yet reflected here): https://github.com/anthropics/skills/blob/main/skills/skill-creator/SKILL.md
If that file has evolved, reconcile any new fields or patterns with the project-specific placement rules above before applying them.
SKILL.md created at the correct scoped path (component, domain, or cross-cutting)description front-loads the use case and lists trigger phrasesdescription does not restate "Read Component/X/CONTEXT.md…" — that line belongs in the body onlyRead @.ai/Component/{Component}/CONTEXT.md for ... referenceneeds, produces, conditional, subagent) follow STRUCTURE.md conventions — top-down dependencies, standalone-usablesubagent: recommended or subagent: optional (see STRUCTURE.md). Absence is the default — leave the field off if the skill is small, interactive, or cross-references siblingsCONTEXT.md updated with a ## Skills entry (agnostic discovery).claude/skills/ pointing to the skill directory (Claude Code discovery)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.