skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill helps you create, refine, and evaluate Agent Skills following the agentskills.io open standard.
A skill is a directory containing a SKILL.md file. Optional directories add more capabilities:
skill-name/
├── SKILL.md # Required: frontmatter + instructions
├── scripts/ # Optional: executable code
├── references/ # Optional: documentation
├── assets/ # Optional: templates, resources
└── evals/ # Optional: test cases
└── evals.json---
name: skill-name
description: A clear description of what this skill does and when to use it.
---Recommended sections:
Place the skill at .agents/skills/<skill-name>/SKILL.md
The most effective skills come from real workflows where the user guided the agent and liked the results. Extract the reusable pattern from this conversation.
Look back at what just happened in the conversation:
Turn specific commands into parameterized instructions:
# Specific (from chat)
Run: python scripts/deploy.py --env production --tag v1.2.3
# Generalized (in skill)
Run: python scripts/deploy.py --env {environment} --tag {version}Remove details specific to the one-off task. Keep the structure that made it work.
Every correction the user gave mid-workflow should become a gotcha:
## Gotchas
- The `users` table uses soft deletes. Always include
`WHERE deleted_at IS NULL`.
- The API key must be set as `X-API-Key` header, not `Authorization`.
- Never run migration step 2 before step 1 completes.---
name: <workflow-name>
description: >
<Describe the task the user just did, including keywords
that would make this trigger again.>
---
## Workflow
<Step-by-step instructions extracted from the conversation>Before finalizing, present the skill to the user:
.agents/skills/<name>/SKILL.md"Run the new skill against a similar task. If the user corrects you again, update the gotchas. If the first run works well, the skill is ready.
The description field determines when the agent triggers your skill. Write it as an instruction to the agent:
description: >
Analyze CSV and tabular data files — compute summary statistics,
add derived columns, generate charts, and clean messy data. Use this
skill when the user has a CSV, TSV, or Excel file and wants to
explore, transform, or visualize the data, even if they don't
explicitly mention "CSV" or "analysis."Guidelines:
Keep SKILL.md under 500 lines / 5000 tokens. Move detailed reference material to references/ files and tell the agent when to load each one.
Reference existing tools directly:
uvx [email protected] check .
npx eslint@9 --fix .Place in scripts/ with inline dependencies:
# /// script
# dependencies = ["beautifulsoup4"]
# ///
from bs4 import BeautifulSoup--help output--dry-run for destructive operationsCreate evals/evals.json:
{
"skill_name": "my-skill",
"evals": [
{
"id": 1,
"prompt": "A realistic user prompt...",
"expected_output": "What success looks like",
"files": ["evals/files/input.csv"],
"assertions": [
"The output includes a chart image",
"Both axes are labeled"
]
}
]
}# Script to test description triggering
# Create eval_queries.json, then:
# - Run each query 3x
# - Check if skill was invoked
# - Compute trigger rate per query
# - Iterate on description~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.