my-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited my-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
These two fields are the only ones required. name must be lowercase with hyphens, max 64 characters, and match the parent directory name. description is what Claude reads at startup to decide when the skill is relevant (max 1024 characters).
Add any of these to the --- block above to customise behaviour:
| Field | Example | Purpose |
|---|---|---|
argument-hint | [issue-number] | Hint shown during autocomplete to indicate expected arguments |
disable-model-invocation | true | Prevent Claude from auto-loading. User must type /name explicitly. Use for deploys, sends, destructive ops |
user-invocable | false | Hide from the / menu. Claude can still load it automatically. Use for background knowledge |
allowed-tools | Read, Grep, Bash(npm *) | Tools Claude can use without asking permission. Space-delimited, supports patterns |
model | claude-sonnet-4-6 | Override the model when this skill is active. Useful for cost control |
context | fork | Run in an [isolated subagent](^A separate Claude instance with its own context. The skill content becomes the subagent's system prompt). Skill content becomes the subagent's prompt |
agent | Explore | Which subagent runs when context: fork. Built-in: Explore, Plan, general-purpose, or custom from .claude/agents/ |
license | Apache-2.0 | License name or reference to a bundled LICENSE file |
compatibility | Requires git, docker | Environment requirements (max 500 chars) |
metadata | key-value pairs | Arbitrary metadata (author, version, etc.) |
Everything below the frontmatter is the instruction body. Claude reads this when the skill is activated. Write whatever helps Claude perform the task. There are no format restrictions.
Good body content includes:
[Placeholders](^Variables in your SKILL.md that get replaced with real values before Claude sees the content) are replaced with real values before Claude sees the content:
| Placeholder | Resolves To |
|---|---|
$ARGUMENTS | Everything the user typed after the skill name |
$ARGUMENTS[N] or $N | A specific argument by index (0-based) |
${CLAUDE_SESSION_ID} | The current session ID |
${CLAUDE_SKILL_DIR} | Path to this skill's directory |
Example: /my-skill SearchBar React Vue gives $0 = "SearchBar", $1 = "React", $2 = "Vue".
If $ARGUMENTS is not present in the content, arguments are appended as ARGUMENTS: <value>.
The ! backtick syntax runs shell commands before the content reaches Claude. Output replaces the placeholder:
!gh pr diff ` !cat package.json | jq .dependencies ` !git diff --name-only `This is [preprocessing](^The commands run at skill load time, not during conversation. Claude only sees the final output, not the commands themselves). Claude only sees the final output, not the commands.
Keep SKILL.md under 500 lines. Move detailed material to separate files and reference them from the body:
Use relative paths from SKILL.md. Keep references one level deep. Navigate into these folders to learn more about each.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.