skill-authoring — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-authoring (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill provides guidance for writing Agent Skills that comply with the agentskills.io specification.
name: 1-64 chars, lowercase + hyphens, match directorydescription: 1-1024 chars, ≤60 words, explain WHAT and WHENWHEN: with quoted trigger phrases (preferred over USE FOR:)DO NOT USE FOR: unless the skill has trigger overlap with a broader skill (see frontmatter guidelines)>- folded scalars)SKILL.md (required) - Instructionsreferences/ (optional) - Detailed docsscripts/ (optional) - Executable codeFrontmatter: name (lowercase-hyphens), description (WHAT + WHEN)
Metadata (~100 tokens) loads at startup. SKILL.md (<5000 tokens) loads on activation. References load only when explicitly linked (not on activation). Keep SKILL.md lean.
References are JIT (just-in-time) loaded:
[text](references/file.md) load[Recipes](references/recipes/README.md) not [Recipes](references/recipes/)See REFERENCE-LOADING.md for details.
# Run from the scripts directory
cd scripts
npm run references # Validate all skill links
npm run tokens -- check # Check token limitsWhen reviewing or authoring skills, verify:
See Validation for detailed procedures.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.