skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create new Claude Code skills interactively, following all conventions from SKILLS_GUIDE.md and the learning/configurability/feedback patterns proven in the best existing skills.
_On startup, use the Read tool to load ~/.claude/skills/skill-creator/preferences.md. If missing, treat as "no preferences set"._
Before starting:
Glob tool to discover existing skills at ~/.claude/skills/*/SKILL.md (so you don't reinvent or collide with a name).~/.claude/skills/SKILLS_GUIDE.md once at Step 3 — it's the canonical manifest.svg-art, should-i-buy, and step-through as the gold-standard reference for learning + feedback patterns.Check $ARGUMENTS:
~/.claude/skills/skill-creator/preferences.md, confirm, stopSkill Creator — Creates Claude Code skills, manifest-compliant by default
Usage:
/skill-creator Interactive skill creation
/skill-creator <name> Start with a name pre-filled
/skill-creator --from-description "..." Start from a plain-text description
/skill-creator config Set preferences
/skill-creator reset Clear preferences
/skill-creator help This help
Examples:
/skill-creator Full interactive walkthrough
/skill-creator deploy-preview Create a skill named "deploy-preview"
/skill-creator --from-description "A skill that triages PR comments"
Current preferences:
(loaded from ~/.claude/skills/skill-creator/preferences.md)Use AskUserQuestion to collect:
~/.claude/skills/ (standard) or custom pathSKILLS_GUIDE.md after creation: yes/no~/Dev/claude-skills) or "none"learning-on (include feedback + journal + sessions) / learning-off (stateless tool by default) / ask-each-timeSave to ~/.claude/skills/skill-creator/preferences.md.
Delete ~/.claude/skills/skill-creator/preferences.md and confirm: Preferences cleared. Using defaults.
If no preferences file exists:
First time using/skill-creator? Run/skill-creator configto set defaults, or just continue with sensible defaults.
Then proceed.
Every generated SKILL.md must satisfy these — no exceptions unless explicitly justified to the user.
SKILLS_GUIDE.md)name (kebab-case, ≤64 chars), description (third-person, "Use when …" trigger, ≤1024 chars), argument-hint, minimal allowed-tools.allowed-tools — every skill needs it for help/config/reset.help, config, reset, default behaviour.! backtick interpolation for ~/.claude/ paths.reference/ or examples/. # /<skill> preferences
Updated: YYYY-MM-DD
## Defaults
- knob: value
## Profile (optional — edit freely)
- user-editable bias
## Learned
- (populated from feedback over time)/skill feedback collects ratings on the most recent session via AskUserQuestion.Signal: one-liner generalisation.## Learned in preferences.md. Mention once: "Noticed you consistently … Saved as standing default."preferences.md and feedback-journal.md before the main workflow. Continue silently on missing files.Run /<skill> feedback — even one rating helps me sharpen defaults.preferences.md, feedback-journal.md, sessions/, any resume-state.md.DESIGN.md at the skill root. The DESIGN.md is the renderer contract: it specifies aesthetic direction, type system, colour tokens, layout, visualisation principles, anti-patterns to avoid, and accessibility guarantees. Renderers reach for DESIGN.md before generating any markup, and prefer its tokens over hard-coded values.DESIGN.md. Apply its tokens, type system, anti-patterns, and a11y contract to every emitted artefact._"). Treat missing DESIGN.md the same as missing preferences: degrade gracefully with built-in defaults, but never silently ignore it when present. # /<skill> design
## Aesthetic direction
The committed point of view. References, tone, what this is NOT.
## Type system
Display font + body font + mono font, with fallbacks. Scale, weights, letter-spacing.
## Colour tokens
CSS custom properties. AA-compliant for any token used as text. Dark-mode mirrors.
## Layout
Max widths, spatial moments, grid/asymmetry rules.
## Visualisation principles
How charts encode data. Density binning, sparse-data fallback, redundancy beyond colour.
## Anti-patterns to avoid
Project-specific don'ts, plus the universal slop list.
## Renderer contract
Hard guarantees: ARIA on every SVG; contrast ≥4.5:1 for text; no color-only encoding; no
`title`-only tooltips; pre-computed colour-mix fallbacks; anonymisation rules; etc.
## Component patterns
The reusable HTML/JSX/SVG snippets — each shown inline, using tokens not hex values.preferences.md is the user's runtime configuration (per-machine, edited freely). When they conflict, user preferences win for runtime knobs (e.g. tone, depth, framework); DESIGN.md wins for renderer guarantees (e.g. a11y contract, anti-patterns). Encode this priority in the workflow: load DESIGN.md, then preferences, and only let preferences override DESIGN.md tokens flagged as user-tunable.[[from skill-creator]] link):title="" only (need focusable + visible alternatives)font-feature-settings: "ss01", "cv11" applied to non-Inter fallback fonts (dead code)-webkit-font-smoothing: antialiased (harms low-vision users)Learned rules./publish-note --from-template=raw-idea "<idea>"), expose it as a template file inside the skill directory. Each template is a YAML-frontmatter + markdown file declaring inputs, tasks, constraints, tools, postProcesses. The skill should support --from-template=<name> routing in addition to its standard flow. See ~/.claude/skills/publish-note/templates/raw-idea.md for the canonical example. Templates are how a skill compresses an entire conversational workflow ("I want X, with these constraints, ending in Y") into a single command.Skip only if all of the following are true:
aws-mfa writes a credential file — there's nothing to thumbs-up).If skipping, document it in the SKILL.md's Principles section: Stateless by design — no feedback loop because [reason].
If $ARGUMENTS contains --from-description, use that text. If $ARGUMENTS is a bare name, pre-fill the name and ask the rest. Otherwise, ask:
What should this skill do? Describe the workflow in a sentence or two.
Extract:
Confirm with the user: I'll call this /skill-name — a skill that [one-liner]. Sound right?
Use AskUserQuestion with 3 questions in one batch:
Q1 — Side effects: Does this skill create, modify, push, or post anything?
Yes → disable-model-invocation: trueNo (read-only) → omit disable-model-invocationQ2 — Context needs: Does this skill need the current conversation history?
Yes (builds on what we've discussed) → no context fieldNo (self-contained, works from its own inputs) → context: forkQ3 — Learning posture: Should this skill learn from per-session feedback?
Yes — full learning tier (preferences + journal + sessions + feedback subcommand) — pre-select for any skill with discrete outputs, decisions, or judgement callsNo — stateless tool — pre-select only for purely procedural skills (e.g. credential refresh, fixed pipeline runners)Yes, items 12–20 of the manifest reference are now mandatory.Read ~/.claude/skills/SKILLS_GUIDE.md to confirm conventions.
Use AskUserQuestion (multiSelect):
Which capabilities does this skill need?
Read, Glob, GrepWrite, EditBash (use Bash(git *) / Bash(gh *) glob patterns when scoping)AskUserQuestion (always include — auto-add even if not picked)WebSearch, WebFetchmcp__claude_ai_Linear__* (NOT mcp__linear-server__*):list_issues, get_issue, list_comments, list_projects, get_project, list_teamscreate_issue, update_issue, create_commentAlways include AskUserQuestion. Always keep the list minimal — granting Write/Edit to a read-only skill is a bug.
Apply the manifest reference. Draft a numbered workflow that includes (in order, when learning tier is on):
/<skill> feedback)For stateless skills, drop steps 0 and N.
Identify ≥3 configurability knobs (depth, verbosity, format, source, confirmation policy, …). Identify the 1–3 decision points that get an AskUserQuestion. Identify what the feedback subcommand will rate (per-severity defaults? per-output style? per-source pace?).
Present the outline:
Here's the workflow: 1. Load learning context 2. … N. Invite feedback
>
Configurability knobs: [list]. Feedback dimensions: [list]. Want to adjust?
Propose:
--filter, --start, --from, --dry-run, --verbose (only those that fit)feedback, resume (if applicable)Confirm via AskUserQuestion or inline.
If Step 2 / 3 / 4 surfaced that the skill emits user-facing UI (HTML files, React components, SVG artefacts, slide decks, posters, structured-visual markdown), ask once via AskUserQuestion:
This skill renders UI. Scaffold a `DESIGN.md` design contract? - Yes — canonical structure _(recommended)_ — addsDESIGN.mdwith the eight standard sections (aesthetic direction, type system, colour tokens, layout, visualisation principles, anti-patterns, renderer contract, component patterns). Workflow gets a "_Load DESIGN.md before rendering_" step. Renderer references tokens, not hex values. - Yes — minimal stub —DESIGN.mdis created with section headings only; user fills in. - No — skip. (Acceptable only if the skill emits raw text / data, no styling decisions.)
If Yes:
~/.claude/skills/<skill-name>/DESIGN.md with the canonical structure (see manifest item 28 and the example at ~/.claude/skills/emotional-recap/DESIGN.md).## Context section: _On startup, use the Read tool to load DESIGN.md. Apply its tokens, type system, anti-patterns, and renderer contract to every emitted artefact. If missing, fall back to built-in defaults but flag once._### Step N — Load DESIGN.md.DESIGN.md is the skill's renderer contract: aesthetic + accessibility + token guarantees, versioned in the skill repo. It is distinct from preferences.md (which is per-user runtime configuration). When they conflict, DESIGN.md wins for renderer guarantees (a11y, anti-patterns); preferences wins for user-tunable knobs (tone, depth, framework choice).
Ask once via AskUserQuestion:
Will this skill have parameterized preset workflows (templates)? - Yes — I expect users to invoke this with a recurring pattern of inputs/constraints (e.g. "raw idea → finished output with these tools and constraints"). Addtemplates/<name>.mddirectory +--from-template=<name>routing. - No — single workflow only. - Maybe later — leave the directory off; can be added later via/skill-templates(planned skill).
If Yes:
~/.claude/skills/<skill-name>/templates/ directory.templates/<name>.md with the canonical frontmatter: ---
name: <template-name>
description: >-
<one-liner — what this template does, what it skips, what it adds>
inputs:
<input>:
type: string | list
required: true | false
default: <value> # if not required
tasks: [<ordered list of step keywords>]
constraints: [<rules the run must respect>]
tools: [<preferred tools>]
postProcesses: [<actions after main work>]
---
# Template: <name>
## When to use
<trigger scenario>
## Flow (default tasks)
1. **<task>** — <how to execute>
...
## Default constraints (why each one)
- **<constraint>** — <reason>
## Examples (from prior runs)
- <date>: <what happened>templates and --from-template=<name> routes to the skill's Command routing block.## Templates section in the SKILL.md explaining the convention and how the skill loads/parses templates.Reference: ~/.claude/skills/publish-note/templates/raw-idea.md is the canonical example.
Assemble. Use the structure checklist below. Walk through it top to bottom — every box must be ticked or explicitly justified as "skip" with a Principles note.
Frontmatter
name — kebab-case, matches directorydescription — third-person, includes "Use when …" trigger, ≤1024 chars, mentions learning if applicableargument-hint — reflects positional + flags + subcommandsdisable-model-invocation: true — set if side effects confirmed in Step 2context: fork — set if confirmed self-contained in Step 2allowed-tools — minimal list from Step 3, includes AskUserQuestionTop-level sections
## Preferences — runtime Read instruction for preferences.md + Defaults list## Context — runtime Bash/Read instructions, no ! backticks## Command routing — help / config / reset / feedback (if learning) / resume (if applicable) / default### Help block — CLI format with Current preferences line### Config block — AskUserQuestion + write to preferences.md in three-tier format### Reset block — deletes preferences + journal + sessions + resume-state when learning tier is on## First-time detection — warm one-liner, non-blockingWorkflow
### Step 0 — Load learning context (skip only for stateless)### Step N — Final summary with one follow-up AskUserQuestion### Step N+1 — Invite feedback line (skip only for stateless)Learning tier (when on)
## Feedback & learning section with: feedback subcommand handler, journal append format with Signal:, promotion rule (3+ sessions), drift correction (2 contradictions → demote)AskUserQuestions biased by Learned rulesDESIGN.md (when Step 5.4 = Yes — i.e. skill renders UI)
DESIGN.md exists at skill root with the 8 canonical sections (aesthetic / type / colour / layout / visualisation / anti-patterns / renderer contract / component patterns)title-only tooltips, pre-computed color-mix fallbacks, anonymisation rules (if user content is rendered)## Context of SKILL.md instructs runtime to Read DESIGN.md before any renderTemplates (when Step 5.5 = Yes)
templates/ directory exists with at least one scaffolded templatetemplates/<name>.md has the canonical frontmatter (inputs, tasks, constraints, tools, postProcesses)## Templates section in SKILL.md documents loading + parsingtemplates (list) and --from-template=<name> (run)Closing
## Principles — 5–8 rules. Always include: "Graceful degradation on missing learning state" and "Destructive actions still need confirmation" if any side effectsreference/ if over)Never use ` !... ` backtick interpolation in personal skills. Use runtime instructions:
## Context
_On startup, use Bash to detect: current git branch, git status, repo name. Skip any that fail._# /<skill-name> preferences
Updated: YYYY-MM-DD
## Defaults
- knob: value
- knob: value
## Profile (optional — edit freely)
- user-editable bias lines
## Learned
- (populated from feedback over time)## Feedback & learning
When invoked as `/<skill> feedback`:
1. Find the most recent `sessions/YYYY-MM-DD-HHMM.md`. If none, say `No recent session found.` and stop.
2. Print a one-line summary of that session.
3. Ask via `AskUserQuestion` (3–4 questions in one batch). Tailor questions to the skill's output dimensions.
4. Append to `~/.claude/skills/<skill>/feedback-journal.md`:5. Promotion rule: 3+ sessions same signal → promote to `## Learned` in `preferences.md`. Mention once.
6. Drift correction: 2 contradictions on a Learned rule → demote, log in journal.Include these by default; cull or rewrite as needed:
preferences.md / feedback-journal.md can't be read~/.claude/skills/<skill-name>/.SKILL.md.reference/ files.preferences.md, feedback-journal.md, or sessions/ — those are created on first use.After writing, re-read the generated `SKILL.md` and tick every box in the Structure checklist (Step 6). For each box that is unticked, either:
Stateless by design — no feedback loop because [reason]).Then run a quick line-count check via Bash. If over 500 lines, propose a split into reference/.
Print the audit result to the user:
Manifest audit: 23/24 boxes ticked.
Skipped: feedback subcommand — stateless by design (per Step 2 Q3).
File: ~/.claude/skills/<skill-name>/SKILL.md (LINE_COUNT lines)Present options via AskUserQuestion:
Run /<skill-name> help to verify the help outputRun /<skill-name> config to set initial preferencesSKILLS_GUIDE.md inventory table, add section to README.md. Don't commit.All set! Your new skill is ready at ~/.claude/skills/<skill-name>/Silently update ~/.claude/skills/skill-creator/preferences.md if the user:
Mention once: Noted: you prefer X. Saved for next time.
/feedback subcommand should be the rare case. Bias toward learning-on in Step 2 Q3.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.