fuse-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fuse-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create one fused skill that keeps the useful behavior from all source skills, removes overlap, and stays cheap to load.
skills.sh skillsskills are part of the input
wanted
it
The user must provide all source skills to combine.
Allowed source-specification levels:
exact remote owner/repo plus skill name(s)
owner/repo, but the user hasnot yet pinned the skill name(s) inside that package
backend-*, ui-*, or "the development-contract skills" where the user is explicitly asking to fuse local skills from this repo and the family can be resolved by inspecting local folders only
Do not accept open-ended discovery beyond those bounds. If the user has not identified either a specific local skill/family, a specific remote skill, or a specific package to inspect, stop and ask for that missing scope.
For each source, identify whether it is:
skill names before fusion
skills.sh skill from a named owner/repo packageDo not expand scope beyond the provided sources or explicitly named packages.
For remote sources, capture both:
owner/repo formIf the user provides a GitHub URL instead of owner/repo, normalize it to owner/repo before continuing.
If the user provided only a package-specified remote source, you may inspect that package only to resolve the intended skill name(s). Do not broaden into general package discovery or substitute a different package.
existing skill-generation guidance.
skills.sh skill, orinline content. If the user named a bounded local family, inspect only matching local folders, resolve the exact skill names, and report that resolution before continuing. Read local sources immediately. For remote sources, proceed to step 3.
that succeeds for each source.
Tier 1 — local copies. Check skills-lock.json and npx skills list --json for already-installed copies of the requested skills. If found, read them directly. This is the preferred path because it avoids repo mutations.
Tier 2 — CLI fetch. If not installed locally:
npx skills --help. If the CLI ismissing or Node/npm is unavailable, skip to Tier 3.
owner/repo.If the user provided a GitHub URL, normalize it to owner/repo first.
npx skills add <owner/repo> -lonly to list that package's skills so you can resolve the exact skill name(s). Once resolved, continue with explicit names.
npx skills add <owner/repo> --skill <skill-names> to fetch onlythe named skills.
installation only when read-only local inspection is unavailable. Do not use --global unless the user explicitly asked for it.
skills find or broad package discovery unless the user askedfor discovery rather than fusion.
worktree is already dirty. After fetching, isolate or clearly report any files added or changed as acquisition artifacts, and do not fold them into the final deliverable unless the user asked for that.
Tier 3 — user-provided content. If both Tier 1 and Tier 2 fail (no local copy, CLI unavailable, network blocked, policy constraints), ask the user to provide the skill content inline or as file paths. Do not proceed with incomplete sources.
installer-specific metadata, broad stack assumptions, or helper scripts whose value does not survive the fusion
and another says "never use for X," flag the conflict.
another needs web search with no overlap in workflow, note the mismatch.
domain skill (how to deploy containers) rarely fuse well.
fusion: a fused core for the compatible subset, plus a companion skill for the rest. Do not proceed to the matrix with incompatible sources unless the user explicitly overrides.
compatibility is clear (no conflicts, same abstraction level, overlapping triggers), use the compact fusion matrix path:
source → keep / merge / drop + reason
scope split appears during drafting
structure:
| Source | Element type | Content summary | Verdict |
|---|---|---|---|
| skill-a | trigger | "use when merging…" | keep — broadest scope |
| skill-a | workflow-step | "load sources" | merge with skill-b step 1 |
| skill-b | decision-rule | "prefer local naming" | keep — unique |
| skill-b | reference | "checklist.md" | drop — subsumed by fused review |
Element types: trigger, workflow-step, decision-rule, reference, example, anti-pattern.
Verdicts: keep (into fused core), merge (combine with another row), move-to-ref (demote to references), drop (with reason: duplicate / weaker / stale / out-of-scope).
After filling the matrix, confirm:
keep or merge verdictdrop has an explicit reasonheuristics closer to the local repo when that produces a better local result
execution quality
SKILL.md.agents/skills/<skill-name>/the user clearly asked to replace or extend that skill. Otherwise choose a new narrow name and say why.
references/ only when detailed audit or variant-specific materialwould bloat the main file
scripts/ only when deterministic fetching or transformation ismeaningfully better than prose
local style:
merged-*, combined-*, or fused-* prefixes unless theuser asked for them
it narrowly
shipped skill package unless it materially improves repeatable execution
inspection, remove those artifacts before finalizing unless the user explicitly asked to keep the fetched skill itself
references/fusion-review-checklist.md. The checklist includes simulation validation and precision-density tightening as final quality gates. Do not skip them — they catch execution-path bugs and bloat that static review misses. If any check fails, revise before finalizing.
behavior in at least one realistic scenario. Cut generic filler, repeated best-practice text, and examples that do not teach anything new.
up after reading the actual skill contents.
while dropping bulky catalogs, datasets, helper scripts, or stack-specific assumptions unless they materially improve repeatable execution in the fused result.
install artifacts, remove them unless the user asked to keep them.
until it has one voice and one workflow.
(step 5) was not run or was overridden, re-check here: if sources cover genuinely different jobs, recommend separate skills or partial fusion instead of forcing a bad merge.
Review the fused result like a senior agent-skill designer.
When local guidance exists, use it during review, especially:
.agents/skills/agent-skill-generator/SKILL.md.agents/skills/agent-skill-generator/references/skill-design-checklist.md.agents/skills/agent-skill-generator/references/token-optimization.mdskills-lock.json when remote package identity or installed skill namingneeds a local cross-check
If those files are unavailable, apply the bundled review checklist and the same standards: strong triggers, explicit workflow, portability, no important loss, and high precision density.
The fused skill should include:
name and descriptionuse it
SKILL.md that another agent can execute without guessingThe final response should also summarize:
skills install, newpackage fetch, or user-provided content
User request: Fuse these local skill folders into one new skill and remove overlap.
Expected behavior:
User request: Combine this local skill with these two skills.sh skills into one portable skill.
Expected behavior:
fetch, then ask the user for content.
fit the local repo.
User request: Fuse this local skill with the right skill from owner/repo that handles release docs.
Expected behavior:
owner/repo as in scope, but do not inspect unrelated packages.User request: Which two existing skills should I load together for this task?
Expected behavior:
fuse-skills.merged skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.