macOS menu bar app to curate cc skills
SaferSkills independently audited skillbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Native macOS menu bar app for Claude Code: skills, auto-memory, hooks, and env vars.
See PRD.md for the spec.
~/.claude/skills/.~/.claude/projects/<project>/memory/*.md) per project, with type badges and edit/delete.~/.claude/settings.json and per-project .claude/settings.json / settings.local.json, with scope filter and edit/delete.~/.claude/skillbox-env-stash.json); add new vars with autocomplete from a built-in catalog of well-known Claude Code env vars.claude -p "/insights" headlessly in the background, footer shows a spinner during the run, then opens the resulting HTML report (the skill's own ~/.claude/usage-data/report.html if it produced one, otherwise a markdown-rendered fallback at ~/Library/Caches/Skillbox/) in your default browser.Grab the latest Skillbox-vX.Y.Z.zip from Releases, unzip, and drag Skillbox.app to /Applications.
The app is ad-hoc signed, not notarized. On first launch macOS Gatekeeper will refuse to open it. Either right-click → Open and confirm, or strip the quarantine attribute:
xattr -dr com.apple.quarantine /Applications/Skillbox.appRequires macOS 14+, Swift 6 toolchain (Command Line Tools is enough).
make bundle # produces ./Skillbox.app, ad-hoc signed
make run # builds and opens
make install # copies to /Applications
make cleanRun tests with swift test.
The app has three layers under Sources/Skillbox/:
Skill, Memory, Hook, EnvVar. FileBackedItemStore<Item> is the generic single-root store powering SkillStore and MemoryStore; HookStore and EnvVarStore are bespoke because they aggregate from multiple settings.json files across scopes (and EnvVarStore also manages a private stash file for disabled values).SkillScanner, SkillsCLI, SkillRegistry, EditorLauncher, DirectoryWatcher) and one deep module: RemoteSkillService owns the install / update / check-for-updates lifecycle behind a small interface. Ports.swift defines the protocols views talk to so tests can substitute in-memory adapters.PopoverView is the menu-bar entry point; sheets like InstallFromURLSheet and RegistryView route through a SkillsTabRoute enum.For the quickest tour of what the app does, read Tests/SkillboxTests/AppTourTest.swift.
Bump CFBundleShortVersionString in Sources/Skillbox/Resources/Info.plist.template, then:
VERSION=v0.1.0-beta.2 # adjust
make clean bundle
ditto -c -k --keepParent Skillbox.app Skillbox-$VERSION.zip
git tag -a $VERSION -m "$VERSION"
git push origin $VERSION
gh release create $VERSION --prerelease --title "$VERSION" --notes "..." Skillbox-$VERSION.zip
rm -f Skillbox-$VERSION.zipDrop --prerelease once you tag a stable vX.Y.Z (no -beta/-rc suffix).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.