agent-skill-author — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-skill-author (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are helping a user author or improve an Agent Skill. Skills are markdown files an agent loads to handle domain-specific work it would otherwise get wrong. A skill is worth writing only when the failure is consistent, subtle, and not fixable with a better prompt.
Follow the five-stage process below. Do not skip stages.
Before designing anything, find out what the agent actually gets wrong.
code or output.
fails: missing functions, wrong superclass names, swallowed errors, wrong default arguments, hallucinated APIs.
knowledge-gap.
Only knowledge-gap failures justify a skill. If a better prompt fixes it, use a better prompt.
Group the failures from Stage 1 by root cause. Common categories:
same idiom exists in Python or Java (the blog's example: an ormdelete() that doesn't exist in MATLAB).
(database.orm.Mappable vs. database.orm.mixin.Mappable).
nargin == 0 guard for objects an ORM creates empty).
documentation doesn't make obvious.
the one the user actually has.
For each category, write down the specific rule the skill needs to teach. One rule per failure.
Apply these structural rules. The agent may not read your whole skill, so structure matters.
when to invoke the skill, with concrete trigger phrases the agent will match on. The agent reads this to decide whether to load you. Avoid : (colon followed by space) inside the description value — strict YAML parsers will read it as a nested mapping and fail to load the skill. Use an em dash or comma instead.
top of the body. Don't bury the load-bearing rule.
variant APIs in later sections or in references/.
##) per topic. Consistent section orderacross your skill family makes it predictable for the agent.
example with the failing pattern and the corrected pattern side by side.
handles addComponent correctly, don't document addComponent. Skills are compensators for failure, not API reference.
for known gotchas the user might hit even with the skill loaded.
Suggested section order:
## When this skill applies (1-2 paragraphs)
## Core rules (the load-bearing rules, in priority order)
## API patterns (code examples per category)
## Common pitfalls (gotchas, including known limitations)
## See also (links to references/ and related skills)Use the template at templates/SKILL-template.md as a starting point.
Run the same Stage 1 prompts with the skill loaded and the failures should drop.
documented pitfall), or escalate (the failure isn't a skill problem).
that works for one model can be ignored by another.
Keep a short test log: prompt, model, pre-skill result, post-skill result. The log is the evidence that the skill works; without it, you're guessing.
Skills aren't done. Models change, APIs change, and yesterday's failure becomes today's strength (and vice versa).
ships, or when users report fresh failures.
attention budget.
references/ and link fromthe main body.
running the agent.
with no domain-specific content.
prevents the bug.
writing examples; run them.
When the user asks for help, follow this order:
Stage 1 before discussing design.
with them now.
the current SKILL.md, then identify which rules are load-bearing, which are dead weight, and which are missing.
user has a concrete rule list.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.