create-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-skill (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill guides you through creating effective Agent Skills for Cursor. Skills are markdown files that teach the agent how to perform specific tasks: reviewing PRs using team standards, generating commit messages in a preferred format, querying database schemas, or any specialized workflow.
Before creating ANY skill, verify:
ls -la ~/.cursor/skills/*/SKILL.md 2>/dev/null
ls -la .cursor/skills/*/SKILL.md 2>/dev/nullgrep -r "description:" ~/.cursor/skills/*/SKILL.md 2>/dev/nullWhy: Avoid skill duplication. Skills should have clear, distinct purposes.
Before creating a skill, gather essential information from the user about:
If you have previous conversation context, infer the skill from what was discussed. You can create skills based on workflows, patterns, or domain knowledge that emerged in the conversation.
If you need clarification, use the AskQuestion tool when available:
Example AskQuestion usage:
- "Where should this skill be stored?" with options like ["Personal (~/.cursor/skills/)", "Project (.cursor/skills/)"]
- "Should this skill include executable scripts?" with options like ["Yes", "No"]If the AskQuestion tool is not available, ask these questions conversationally.
Skills are stored as directories containing a SKILL.md file:
skill-name/
├── SKILL.md # Required - main instructions
├── reference.md # Optional - detailed documentation
├── examples.md # Optional - usage examples
└── scripts/ # Optional - utility scripts
├── validate.py
└── helper.sh| Type | Path | Scope |
|---|---|---|
| Personal | ~/.cursor/skills/skill-name/ | Available across all your projects |
| Project | .cursor/skills/skill-name/ | Shared with anyone using the repository |
IMPORTANT: Never create skills in ~/.cursor/skills-cursor/. This directory is reserved for Cursor's internal built-in skills and is managed automatically by the system.
Every skill requires a SKILL.md file with YAML frontmatter and markdown body:
---
name: your-skill-name
description: Brief description of what this skill does and when to use it
---
# Your Skill Name
## Instructions
Clear, step-by-step guidance for the agent.
## Examples
Concrete examples of using this skill.| Field | Requirements | Purpose |
|---|---|---|
name | Max 64 chars, lowercase letters/numbers/hyphens only | Unique identifier for the skill |
description | Max 1024 chars, non-empty | Helps agent decide when to apply the skill |
The description is critical for skill discovery. The agent uses it to decide when to apply your skill.
# PDF Processing
description: Extract text and tables from PDF files, fill forms, merge documents. Use when working with PDF files or when the user mentions PDFs, forms, or document extraction.
# Excel Analysis
description: Analyze Excel spreadsheets, create pivot tables, generate charts. Use when analyzing Excel files, spreadsheets, tabular data, or .xlsx files.
# Git Commit Helper
description: Generate descriptive commit messages by analyzing git diffs. Use when the user asks for help writing commit messages or reviewing staged changes.
# Code Review
description: Review code for quality, security, and best practices following team standards. Use when reviewing pull requests, code changes, or when the user asks for a code review.The context window is shared with conversation history, other skills, and requests. Every token competes for space.
Default assumption: The agent is already very smart. Only add context it doesn't already have.
Challenge each piece of information:
Good (concise):
## Extract PDF text
Use pdfplumber for text extraction:
\`\`\`python
import pdfplumber
with pdfplumber.open("file.pdf") as pdf:
text = pdf.pages[0].extract_text()
\`\`\`Bad (verbose):
## Extract PDF text
PDF (Portable Document Format) files are a common file format that contains
text, images, and other content. To extract text from a PDF, you'll need to
use a library. There are many libraries available for PDF processing, but we
recommend pdfplumber because it's easy to use and handles most cases well...For optimal performance, the main SKILL.md file should be concise. Use progressive disclosure for detailed content.
Put essential information in SKILL.md; detailed reference material in separate files that the agent reads only when needed.
# PDF Processing
## Quick start
[Essential instructions here]
## Additional resources
- For complete API details, see [reference.md](reference.md)
- For usage examples, see [examples.md](examples.md)Keep references one level deep - link directly from SKILL.md to reference files. Deeply nested references may result in partial reads.
Match specificity to the task's fragility:
| Freedom Level | When to Use | Example |
|---|---|---|
| High (text instructions) | Multiple valid approaches, context-dependent | Code review guidelines |
| Medium (pseudocode/templates) | Preferred pattern with acceptable variation | Report generation |
| Low (specific scripts) | Fragile operations, consistency critical | Database migrations |
SKILL.md + references/ + scripts/ as needednpm run validate:skills; description ≤1024 chars, body <500 lines~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.