agent-skill-generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-skill-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create skills that are generic first, portable by default, repo-bound only when the task requires it, easy to trigger correctly, and cheap to load.
Do not skip steps 2-7 unless the user explicitly narrows scope.
Start by identifying one of these modes:
new skill: create a skill from a rough problem or repeated workflowrevise skill: improve an existing skill folder in placeaudit skill: inspect one or more skills for trigger quality, portability, and token waste before proposing editsvalidate skill: pressure-test an existing skill with realistic prompts before changing itoptimize trigger: tighten the frontmatter description so the skill activates more reliably without over-triggeringQuick selector:
| If the user asks to... | Use mode |
|---|---|
| build a skill from an idea or repeated workflow | new skill |
| improve an existing skill in place | revise skill |
| inspect skills for drift, bloat, or weak triggers before editing | audit skill |
| pressure-test a skill with realistic prompts | validate skill |
| narrow or strengthen the frontmatter description specifically | optimize trigger |
Require the user to provide at least one of:
If the user gives a vague idea, extract a provisional summary in one or two sentences before moving on.
Also capture:
Do not use this skill for:
AGENTS.mdBefore asking questions, inspect the repo or working directory for facts that reduce ambiguity.
Look for:
Prefer targeted search over broad reading. Search likely directories first, then open only the most relevant files.
Use the repo investigation to answer discoverable questions such as:
Also inspect the conversation itself for concrete examples. If the user says "turn this into a skill" or is iterating on a workflow already demonstrated in chat, extract:
If the repo is thin or unrelated, state that and proceed with a generic skill design.
Do not create a new skill or make broad workflow rewrites until the spec is decision-complete. For small wording fixes, report-only audits, or clearly bounded revisions, continue with labeled assumptions instead of blocking on questions.
Ask only questions that materially affect the generated skill. Prefer concise, direct questions. Push until these are clear:
SKILL.md or also references/, scripts/, or assets/If a choice remains open and the user does not care, pick a sensible default and record it as an explicit assumption in the final skill package.
Know what counts as complete before you edit.
new skill: the package is created, the trigger surface is clear, the workflow is actionable, and validation risk is addressedrevise skill: the intended problems are fixed, the repo conventions are preserved, and the delta is summarizedaudit skill: the findings are explicit, prioritized, and actionable, even if no edits are made; for multi-skill audits, group cross-cutting issues before per-skill detailsvalidate skill: representative positive and negative prompts were reviewed, outcomes were summarized, and residual risk is statedoptimize trigger: the description is tighter, easier to match, checked against adjacent negatives, and no longer carries workflow detailFor multi-skill audits, prefer this order:
For this repository's current high-risk trigger families, use references/inventory-trigger-evals.md as a lightweight prompt-routing check before or after trigger edits.
Create a skill folder with the minimum set of files that makes the workflow repeatable.
Default package:
SKILL.mdreferences/ only when details would otherwise bloat SKILL.mdscripts/ only when deterministic execution or validation is meaningfully better than proseassets/ only when the skill depends on templates, icons, or other bundled artifactsBy default, keep the skill generic and portable. Do not add product-specific metadata files unless the user explicitly requests them.
Use progressive disclosure deliberately:
SKILL.mdreferences/scripts/assets/Do not duplicate the same guidance across SKILL.md and references.
SKILL.mdname and description in YAML frontmattername kebab-casedescription optimize activation, not teach the workflowdescription state the job and when to use it in the language a user or agent would actually sayreferences/SKILL.mdKeep AGENTS-level policy out of the skill unless it is truly task-specific. Put always-loaded repo guardrails in AGENTS.md; use skills for on-demand workflows, domain knowledge, templates, or deeper procedures.
When in doubt between AGENTS.md and a skill:
AGENTS.mdExample split:
AGENTS.md: Use repo-local path helpers instead of hardcoded temp paths.Negative split examples:
Always run targeted repo searches before asking naming questions. in AGENTS.md if that is a universal repo rulePrefer kebab-case folder namesUse this structure unless the target skill needs a sharper format:
Validate before finalizing whenever the skill is reusable, high-risk, or easy to test objectively.
Minimum standard:
Decision rule:
For the detailed prompt-writing and review workflow, use references/skill-validation.md.
Before finalizing, aggressively remove waste.
Check for:
references/Optimize in this order:
references/.If you slim the package, preserve behavior. The goal is lower token cost without losing trigger quality or execution reliability.
Use references/token-optimization.md as the final audit checklist.
The finished skill should:
SKILL.md is cheap to loadUse references/skill-design-checklist.md before finalizing.
User request: Create a skill for handling database migration planning in this repo.
Expected behavior:
references/ if they make the main file too long.User request: This skill triggers too often and is too verbose. Tighten it.
Expected behavior:
references/.User request: Pressure-test this skill before we publish it.
Expected behavior:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.