macOS menu bar app to curate cc skills
SaferSkills independently audited skillbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Native macOS menu bar toolbox for AI coding agents: shared skills, provider usage for Claude Code, Codex, and Grok, and Claude Code memory, hooks, and env vars.
<img width="433" height="520" alt="skillbox_screenshot" src="https://github.com/user-attachments/assets/42d95c04-6555-4df7-b944-0b16d847b358" />
Provider marks come from Lobe Icons (MIT, see Sources/Skillbox/Resources/ProviderLogos).
Skillbox treats ~/.agents/skills as the canonical skill source of truth. Claude Code still reads ~/.claude/skills, so Skillbox maintains that directory as a compatibility mount of symlinks:
~/.agents/skills/<skill>/... # real files
~/.claude/skills/<skill> # symlink -> ~/.agents/skills/<skill>Installs, deletes, remote sync, and backup tooling operate on .agents; .claude/skills is the Claude-facing mount.
Requires macOS 26+ and Swift 6.2. Command Line Tools is enough. Build from source:
git clone https://github.com/mmurakaru/skillbox.git
cd skillbox
make run # builds and opens Skillbox.app
make install # builds and copies to /Applicationsmake bundle creates an ad-hoc signed Skillbox.app. Run tests with swift test.
make format # swift-format, blank-line padding, then SwiftLint autofix
make lint # the same checks CI runsswift format comes with the Swift toolchain and reads .swift-format. SwiftLint is a pinned, checksum-verified binary that make downloads into .build/tools, so nothing is installed system-wide. .swiftlint.yml holds the type-safety rules: no force casts, tries, or unwraps without a SAFETY: reason, no Any parameters, returns, or aliases, and untyped JSON dictionaries only in files that state they parse external JSON. Tools/StatementPadding adds blank lines around if statements, after declaration groups, and before return.
swift test # unit and integration tests
make test-ui # native Usage UI harness, needs a logged-in desktop~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.