toolkit-skill-author — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited toolkit-skill-author (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
!test -f CONTRIBUTING.md || (echo "CONTRIBUTING.md missing — run from repo root." && exit 1)Verify `skill-creator` is callable in this session. Scan the available-skills list for a skill named skill-creator (bare or namespaced, e.g. skill-creator:skill-creator). If absent, abort with exactly this message:
skill-creatorplugin is required. Run/plugin install skill-creator@claude-plugins-official, enable it, then restart this session and re-run/toolkit-skill-author.
Do not fall back to manually scaffolding SKILL.md — the handoff is core to the workflow.
Load authoritative context:
!cat CONTRIBUTING.md
!bash .claude/skills/toolkit-skill-author/scripts/find-peers.sh skillsFrom the contributor's initial prompt, extract (without asking yet):
extend, new, or unknown.Apply the gates below before any survey question. Each gate halts when it fires.
If bucket is Agent-routing (or a synonym like "agent routing", "routing skill"), refuse:
Agent-routing skills are owned by the toolkit core team perCONTRIBUTING § Capability buckets— not authored via/toolkit-skill-author. Halting.
Do not proceed. If bucket is unstated, this gate re-applies after Q1.
If action is new and target_name is given, lowercase both target_name and each existing skill directory name, then check:
- into token lists. Fire if either (a) the two lists share any token, or (b) any token in one list is a substring of any token in the other list. Example: monitor-advisor ↔ monitoring-advisor fires via (a) shared advisor and (b) monitor ⊂ monitoring. When fired, surface the overlap and ask: "`<target_name>` overlaps with existing `<existing>`. Did you mean to extend `<existing>`, or proceed with a new name?" Wait for an answer before continuing.If action is extend and target_name names an existing skill:
target_name is one of the agent-routing skills (context-detection, incident-response, proactive-monitoring), fire Gate A's refusal — those are owned by the core team and cannot be extended via /toolkit-skill-author either.Otherwise, continue to Phase 1. New-skill requests always run the decision tree — the gate against hidden collisions is the tree itself.
Ask these four questions one at a time, waiting for each answer.
Agent-routing, fire Gate A and halt.Apply the 4-step test from decision-rules.md against the peers dumped by find-peers.sh. The dump shows every skill's name + description + when_to_use; reason directly about which skills could plausibly activate on the Q4 prompts.
Filter agent-routing skills out of the candidate set — contributors can't author those, so they can't be extension targets. Current list: context-detection, incident-response, proactive-monitoring. If the toolkit adds new routing skills, update both this list and Gate C's list to match.
Present the verdict:
EXTEND <peer> or NEW SKILL.If the user overrides, capture their reason verbatim — it becomes part of the PR description per CONTRIBUTING.
Invoke skill-creator via the Skill tool in improve-existing mode, passing the handoff preamble from references/handoff-preamble.md with MODE=IMPROVE_EXISTING, PEER_NAME=<peer>, and the survey answers (or the initial prompt for the fast-path case).
skill-creator runs its full loop; if the contributor wants a lighter-touch edit, they can tell it mid-flow to skip iteration.
When skill-creator returns:
!rm -rf skills/<peer>/evals/ skills/<peer>-workspace/
!python3 .claude/skills/toolkit-skill-author/scripts/lint-skill.py <peer>Scratch-artifact cleanup removes skill-creator's iteration files (they drove the loop but aren't the repo's eval format). Lint surfaces any frontmatter violations.
Walk the partial checklist from references/registration-checklist.md via TodoWrite:
/mc catalog update — only if user-facing surface changed.Continue to the shared version-bump step.
Suggest 2–3 kebab-case directory names. Short is better. Re-run Gate B against each candidate:
Only present candidates that survive Gate B. Wait for the contributor to pick one. Before handoff, re-verify skills/<chosen>/ does not exist.
Note the two-level naming: the directory is skills/<chosen>/, but the name field inside the generated SKILL.md frontmatter should be monte-carlo-<chosen> — the canonical prefixed form. The handoff preamble passes both, and lint-skill.py verifies them after scaffold.
skill-creatorInvoke via the Skill tool with the handoff preamble from references/handoff-preamble.md, MODE=NEW_SKILL, and all survey answers.
When skill-creator returns:
!rm -rf skills/<name>/evals/ skills/<name>-workspace/
!python3 .claude/skills/toolkit-skill-author/scripts/lint-skill.py <name>If lint prints ERROR lines, surface them and wait for the contributor to fix (manually or via a regenerate pass) before proceeding.
Walk the full checklist from references/registration-checklist.md via TodoWrite, one item per step:
Edit, or create new files with Write.If Q1 = Setup, confirm: "Setup skills are exempt from signal-definitions and `/mc` catalog registration per CONTRIBUTING. Skip those two steps? [Y/n]" — default Y.
Both phases converge here.
CONTRIBUTING § Version bumping.description or when_to_use) → minor.patch, minor, major. !./scripts/bump-version.sh <level>The script opens $EDITOR for the changelog, then updates all 6 plugin configs and all 6 CHANGELOG.md files.
Tell the contributor:
All changes are staged. Review withgit status/git diff --staged, then commit and run/shipto open the PR.
Do not auto-commit or push.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.