create-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a new skill that fits this repository's conventions and earns its place: one clear job, a description that triggers reliably, a lean SKILL.md, and any heavy detail pushed into companion files. Then regenerate the derived files and validate.
This repo's source layout is skills/<category>/<name>/SKILL.md. The category is the folder, so there is no category field. Everything else (per-skill registry.json, the root registry.json, the README catalog) is generated by pnpm gen from the folder location plus the frontmatter. Never hand-edit generated files.
pnpm gen. Editing them by hand guarantees drift..claude/skills/<name>/, so two skills can't share a name even across categories.Pin down before writing a line:
skills/ so you extend rather than duplicate.If the purpose is fuzzy or sounds like two things, sharpen or split it now.
engineering, productivity, security, version-control. Recategorising later is just a git mv.skills/<category>/<name>/.Frontmatter is what Claude reads to decide whether to load the skill, so it's load-bearing. Required: name, description. Optional: title (defaults to title-cased name), argument-hint.
Full field reference and good/bad examples: reference/frontmatter.md.
Start from templates/SKILL.template.md and adapt. The established shape across this repo:
Write in the second person to the agent, imperative and direct. Voice details, do/don't, and structural patterns: reference/voice-and-structure.md.
Keep SKILL.md as the orchestrator. Move into companion files anything that is long, optional, or only needed mid-task: reference tables, format specs, fill-in templates, worked examples. Reference them with relative links so the agent loads them on demand:
skills/<category>/<name>/
├── SKILL.md
├── reference/<topic>.md
└── templates/<thing>.template.mdpnpm gen bundles every file in the folder automatically (except registry.json) and installs it under .claude/skills/<name>/<relpath>. Link from SKILL.md like [label](./reference/topic.md). When to split vs. inline: reference/voice-and-structure.md.
From the repo root:
pnpm gen # writes per-skill registry.json, root registry.json, README catalog
pnpm validate # checks frontmatter + layout, then shadcn registry validatepnpm gen is the only thing that should ever touch the generated files. If pnpm validate fails, fix the frontmatter/layout it points at and rerun; don't patch the generated output.
Before calling it done:
SKILL.md is lean; depth lives in companion files.pnpm validate passes and the README catalog shows the new row under the right category.Report the skill's path, category, what it does, any companion files created, and the validation result. Leave committing to the user.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.