skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Skills are reusable workflows that encode expert processes into repeatable instructions. A well-crafted skill transforms inconsistent ad-hoc work into systematic, verifiable outcomes across any AI tool.
Core principle: A skill must change behavior. If an AI assistant produces the same output with and without the skill loaded, the skill has failed.
Iron Law:
EVERY SKILL MUST HAVE A MEASURABLE "DID BEHAVIOR CHANGE?" TEST
No eval = no confidence. Ship nothing you haven't measured.| Mode | Purpose | Input | Output |
|---|---|---|---|
| Create | Build a new skill from scratch | Intent or problem statement | SKILL.md + scaffold |
| Eval | Test skill effectiveness | Skill + test cases | Graded scorecard |
| Improve | Refine based on eval results | Skill + eval data | Improved SKILL.md |
| Benchmark | Compare performance metrics | Skill + baseline | Performance report |
.ai-rules/skills/rule-authoring skill)agent-design skill)Trigger: skill-creator create <skill-name>
Answer before writing anything:
1. What SPECIFIC problem does this skill solve?
Bad: "helps with testing"
Good: "enforces Red-Green-Refactor TDD cycle with mandatory verification"
2. What behavior change should loading this skill cause?
Without: "AI writes implementation first, tests after"
With: "AI writes failing test first, verifies failure, then implements"
3. Who consumes this skill?
Which AI tools? (Claude Code, Cursor, Codex, Q, Kiro)
What user skill level?
4. What is the boundary?
What it handles vs. what it delegates to other skills
Name 2-3 skills it does NOT overlap withCollect the expertise the skill will encode:
For each major workflow step:
1. What is the step?
2. What is the expected input/output?
3. What are the most common mistakes?
4. How do you verify correctness?
5. What red flags should halt progress?Sources to consult:
Required structure:
---
name: skill-name
description: "Use when... (max 500 chars)"
[optional frontmatter fields]
---
# Skill Title
## Overview
2-3 sentences. Core principle. Iron Law.
## When to Use
Bullet list of trigger scenarios.
## When NOT to Use (if applicable)
## Process / Phases
The actual workflow steps.
## Verification Checklist
## Red Flags — STOP
Table of rationalizations vs. reality.Writing rules:
| Rule | Why |
|---|---|
| Imperative mood ("Write the test") | Direct instructions produce consistent behavior |
| Concrete examples over abstractions | AI tools follow examples more reliably than rules |
| Good/Bad comparisons for ambiguous steps | Eliminates interpretation variance across tools |
| One responsibility per phase | Multi-purpose phases get half-completed |
| Max 500 lines total | Longer skills get truncated or ignored |
mkdir -p packages/rules/.ai-rules/skills/<skill-name>
# Write SKILL.md (from Phase 3)
# Optional supporting references:
# <skill-name>/reference-guide.md
# <skill-name>/examples.mdFrontmatter field reference:
| Field | Required | Description |
|---|---|---|
name | Yes | ^[a-z0-9-]+$, matches directory name |
description | Yes | 1-500 chars, start with "Use when..." |
disable-model-invocation | No | true if skill handles its own execution flow |
argument-hint | No | Usage hint shown in skill listings |
allowed-tools | No | Restrict available tools during execution |
context | No | fork to run in isolated context |
agent | No | Agent to activate with the skill |
- [ ] Frontmatter validates (name matches directory, description <= 500 chars)
- [ ] Skill loads without error in target tool (list_skills / get_skill)
- [ ] Following the skill produces different behavior than without it
- [ ] Every phase has a verifiable output
- [ ] Red flags table covers top 3 rationalizations for skipping
- [ ] No overlap with existing skills (check skills/README.md)
- [ ] Multi-tool compatible (no tool-specific syntax in core workflow)Trigger: skill-creator eval <skill-name>
Measure whether a skill produces the intended behavior change.
Create scenarios exercising the skill's key behaviors:
Scenario: [descriptive name]
Given: [initial state / context]
When: [skill is applied with this input]
Then: [expected behavior / output]
Anti-pattern: [what happens WITHOUT the skill]Minimum scenarios:
Run each scenario against the skill:
For each scenario:
1. Load the skill content
2. Present the scenario input
3. Capture the AI's response
4. Save response for gradingExecution options:
Grade each response:
PASS: Response follows skill workflow
PARTIAL: Some steps followed, others skipped
FAIL: Skill ignored or wrong behavior producedNote which specific steps were followed/skipped.
| Severity | Definition | Action |
|---|---|---|
| Critical | Skill completely ignored | Must fix before shipping |
| High | Key phase skipped or verification missing | Must fix before shipping |
| Medium | Minor step deviation, output still usable | Fix in next iteration |
| Low | Style/formatting difference, behavior correct | Optional fix |
Skill: [name]
Scenarios: [total] | Pass: [n] | Partial: [n] | Fail: [n]
Critical: [count] High: [count] Medium: [count] Low: [count]
Verdict:
SHIP = Critical=0 AND High=0
ITERATE = Critical=0, High>0
REWRITE = Critical>0## Eval Report: [skill-name]
### Summary
[Aggregate from Phase 5]
### Scenario Results
| Scenario | Result | Issues |
|----------|--------|--------|
| ... | PASS/PARTIAL/FAIL | ... |
### Recommendations
1. [Fix for highest-severity issue]
2. [Next fix]Trigger: skill-creator improve <skill-name>
Refine an existing skill based on eval data or observed behavior gaps.
1. Read the current SKILL.md
2. Read eval results (if available)
3. Identify the gap:
- Which phases are being skipped?
- Which instructions are ambiguous?
- Where does behavior diverge across AI tools?Look for systemic issues:
- Same step skipped across scenarios → Step is unclear or seems optional
- Different behavior per AI tool → Instructions use tool-specific syntax
- Partial compliance → Steps too large, need decomposition
- Complete skip → Trigger conditions don't match use case| Issue Type | Fix Strategy |
|---|---|
| Step skipped | Add "MANDATORY" marker + red flag for skipping |
| Ambiguous instruction | Replace with concrete Good/Bad example |
| Tool-specific behavior | Remove tool-specific syntax, use universal patterns |
| Steps too large | Decompose into sub-steps with verification |
| Missing edge case | Add scenario to When to Use section |
Rules for changes:
Run the same eval scenarios against the modified skill:
Compare original vs. improved:
- Did the targeted fix resolve the issue?
- Did the fix introduce new issues?
- Is overall pass rate higher?| Metric | Before | After | Delta |
|--------|--------|-------|-------|
| Pass rate | X% | Y% | +/-Z% |
| Critical issues | N | M | +/-D |
| High issues | N | M | +/-D |
| Avg. steps followed | X/Y | X/Y | +/-D |1. Which fix strategy was most effective?
2. Which issues persisted despite changes?
3. Are there structural problems requiring a rewrite?
4. What patterns should inform future skill authoring?Trigger: skill-creator benchmark <skill-name>
Measure skill performance across dimensions and optimize weak spots.
Design a comprehensive test suite:
Dimensions:
1. Compliance: Does the AI follow every step?
2. Consistency: Same input → same behavior across runs?
3. Portability: Works across Claude Code, Cursor, Codex, Q, Kiro?
4. Robustness: Handles edge cases without breaking?
5. Efficiency: Does the skill add unnecessary overhead?For each dimension:
Score: [0-100]
Weakest case: [description]
Root cause: [why this dimension scored low]| Score | Meaning |
|---|---|
| 90-100 | Excellent — production-ready |
| 70-89 | Good — minor improvements needed |
| 50-69 | Fair — significant gaps in at least one dimension |
| 0-49 | Poor — needs major rework |
Focus on the lowest-scoring dimension first:
For each dimension scoring < 70:
1. Identify the specific instruction causing the gap
2. Apply the appropriate fix from Improve Mode Phase 3
3. Re-run that dimension's cases only
4. Verify improvement without regression in other dimensions1. Update SKILL.md with optimized content
2. Update skills/README.md if category or description changed
3. Record benchmark baseline:
Benchmark: [skill-name] @ [date]
Compliance: [score]
Consistency: [score]
Portability: [score]
Robustness: [score]
Efficiency: [score]
Overall: [weighted average]| Skill | Relationship |
|---|---|
rule-authoring | Rules constrain behavior; skills define workflows. Complementary. |
agent-design | Agents are personas; skills are processes. Non-overlapping. |
prompt-engineering | Prompt techniques apply within skill instructions. Supporting. |
writing-plans | Plans are one-time; skills are reusable. Different lifecycle. |
| Agent | When to Involve |
|---|---|
| Code Quality Specialist | Reviewing skill structure and clarity |
| Test Engineer | Designing eval scenarios |
| Architecture Specialist | Skill decomposition and boundary design |
Skills must work across all supported AI tools:
| Tool | How Skills Load | Key Consideration |
|---|---|---|
| Claude Code | get_skill MCP tool | Full markdown + frontmatter parsed |
| Cursor | @file reference | Inline loading, no frontmatter processing |
| Codex / Copilot | cat file content | Plain text only, examples critical |
| Amazon Q | .q/rules/ reference | Rule-style integration |
| Kiro | .kiro/ reference | Spec-based integration |
Portability rules:
| Thought | Reality |
|---|---|
| "This skill is obvious, no need to eval" | Obvious skills still get ignored. Eval proves they work. |
| "I'll test it manually later" | Manual tests are forgotten. Eval now. |
| "One scenario is enough" | One is anecdote. Three is pattern. |
| "It works in Claude Code, ship it" | Cursor/Codex may ignore the same instructions. Test portability. |
| "Small change, no need to re-eval" | Small changes cause cascading behavior shifts. Re-eval. |
| "The skill is too long but everything is needed" | Max 500 lines. Cut or decompose into reference files. |
| "I'll add examples later" | Skills without examples produce inconsistent behavior. Add now. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.