migrate-to-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited migrate-to-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Convert Cursor rules ("Applied intelligently") and slash commands to Agent Skills format.
Copy each body verbatim — byte for byte, whitespace and typos included. The content is the user's, and an exact copy is what makes the migration reversible.
| Level | Source | Destination |
|---|---|---|
| Project | {workspaceFolder}/**/.cursor/rules/*.mdc, {workspaceFolder}/.cursor/commands/*.md | |
| User | ~/.cursor/commands/*.md |
Notes:
**/.cursor/rules/*.mdc from the workspace root so none are missed.Rules: Migrate if rule has a description but NO globs and NO alwaysApply: true.
Commands: Migrate all - they're plain markdown without frontmatter.
# Before: .cursor/rules/my-rule.mdc
---
description: What this rule does
globs:
alwaysApply: false
---
# Title
Body content...# After: .cursor/skills/my-rule/SKILL.md
---
name: my-rule
description: What this rule does
---
# Title
Body content...Changes: Add name field, remove globs/alwaysApply, keep body exactly.
# Before: .cursor/commands/commit.md
# Commit current work
Instructions here...# After: .cursor/skills/commit/SKILL.md
---
name: commit
description: Commit current work with standardized message format
disable-model-invocation: true
---
# Commit current work
Instructions here...Changes: Add frontmatter with name (from filename), description (infer from content), and disable-model-invocation: true, keep body exactly.
Note: disable-model-invocation: true keeps the model from invoking the skill on its own and keeps its description out of the always-on skill roster that every request pays for. Slash commands are user-triggered from the / menu, so migrated commands carry it.
name must be lowercase with hyphens onlydescription is critical for skill discoverydescription from the frontmatter--- of the frontmatter).cursor/skills/{skill-name}/ (skill name = filename without .mdc)SKILL.md with new frontmatter (name and description) + the EXACT original body content (preserve all whitespace, formatting, code blocks verbatim)# prefix).cursor/skills/{skill-name}/ (skill name = filename without .md)SKILL.md with new frontmatter (name, description, and disable-model-invocation: true) + blank line + the EXACT original file content (preserve all whitespace, formatting, code blocks verbatim)Use the read, edit, and delete tools for these files rather than the terminal: they preserve bytes exactly and keep every change undoable.
If you have the Task tool available, delegate the file work so the main context stays free of file contents. Dispatch three general-purpose subagents in parallel (not Explore — it is read-only), one each for project rules ({workspaceFolder}/**/.cursor/rules/*.mdc), user commands (~/.cursor/commands/*.md), and project commands ({workspaceFolder}/**/.cursor/commands/*.md). The work is mechanical; low effort is enough. Each subagent: I. [ ] Finds files to migrate in its pattern II. [ ] For rules, keeps only "applied intelligently" rules (has description, no globs, no alwaysApply: true). Commands are always migrated. III. [ ] Lists the files to migrate. If empty, done. IV. [ ] For each file, reads it, then writes the new skill file with the body verbatim. V. [ ] Deletes the original file. VI. [ ] Returns the migrated skill paths with their original paths.
.cursor/skills/ for project, ~/.cursor/skills/ for user)If you don't have the Task tool available, do step 1, then I–V yourself across both project (.cursor/) and user (~/.cursor/) directories, then steps 3–4.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.