skill-repo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-repo (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 --> <!-- SPDX-FileCopyrightText: Netresearch DTT GmbH -->
A Claude Code skill for standardizing Netresearch skill repository layout, distribution channels, packaging, and validation.
Netresearch maintains many agent skills; without a shared layout, packaging and CI drift across repositories. This skill defines one standard repo shape, reusable workflows, split licensing, and validation scripts so new and existing skills stay consistent and shippable via marketplace, Composer, npm, and releases.
It extends Anthropic-style single-file skills with repository-level conventions (not a replacement for Anthropic’s skill-creator — see comparison below).
ai-agent-skill) and executable scripts/validators (validate-skill.sh, checkpoints.yaml).LICENSE, no plugin.json, composer.json without the ai-agent-skill type — that fails validate-skill.sh and org CI.validate_skill_repo_structure and readme_requirements in skills/skill-repo/evals/evals.json.This is an Agent Skill following the open standard originally developed by Anthropic and released for cross-platform use. The repository is also packaged as an Agent Plugins 1.0.0 plugin: the root plugin.json plus skills/ layout is what any conformant client loads.
Supported platforms:
Skills are portable packages of procedural knowledge that work across any AI agent supporting the Agent Skills specification.
composer.json, plugin.json / .claude-plugin/plugin.json, or release workflowsnetresearch/skill-repo-skillvalidate-skill.sh or marketplace packagingLICENSE-MIT + LICENSE-CC-BY-SA-4.0)SKILL.md, licenses, composer.json, plugin.jsonbash 4.3+ and python3 (3.11+) on PATH when running validate-skill.sh (JSON checks use Python, not jq)ai-agent-skillvalidate.yml, release.yml, …)"Scaffold a new Netresearch skill repository from the templates in skill-repo-skill."
"Why does validate-skill.sh fail on my SKILL.md frontmatter?"
"Add composer.json and plugin.json for our new skill repo matching netresearch conventions."
"Wire our repo to use netresearch/skill-repo-skill validate.yml on every PR."
"Migrate this repo from a single LICENSE file to LICENSE-MIT and LICENSE-CC-BY-SA-4.0."agent-rules-skill — AGENTS.md and agent onboarding patternsagent-harness-skill — harness verification and docs layoutAdd the Netresearch marketplace once, then install this plugin from it:
/plugin marketplace add netresearch/claude-code-marketplace
/plugin install skill-repo@netresearch-claude-code-marketplaceDo not run/plugin marketplace add netresearch/skill-repo-skill.marketplace addneeds a.claude-plugin/marketplace.jsoncatalog; this repo ships a.claude-plugin/plugin.jsonplugin manifest, so that fails withMarketplace file not found.
mkdir -p ~/.claude/skills
git clone https://github.com/netresearch/skill-repo-skill.git \
~/.claude/skills/skill-repoLoads as skill-repo@skills-dir on the next session. Update with git -C ~/.claude/skills/skill-repo pull and start a new session; remove by deleting the directory.
Install with any Agent Skills-compatible agent:
npx skills add https://github.com/netresearch/skill-repo-skill --skill skill-repoLimitation:npx skillsinstallsSKILL.md-based skills only. It reads.claude-plugin/plugin.jsonto locate skills, not to register a plugin, sohooks/,agents/,commands/,bin/and.mcp.jsonare left out. Use the marketplace or the skills directory when a repo ships any of those.
Download the latest release and extract to your agent’s skills directory.
composer require netresearch/skill-repo-skillRequires netresearch/composer-agent-skill-plugin.
npm install --save-dev \
@netresearch/agent-skill-coordinator \
github:netresearch/skill-repo-skillRequires @netresearch/agent-skill-coordinator, which discovers the skill in node_modules and registers it in AGENTS.md via a postinstall hook. For pnpm, allowlist the coordinator’s postinstall:
{
"pnpm": {
"onlyBuiltDependencies": ["@netresearch/agent-skill-coordinator"]
}
}The layout for a Netresearch skill repository (one or more skills per repo):
{name}-skill/
├── AGENTS.md # Agent rules / harness index
├── README.md # Human documentation
├── LICENSE-MIT # Code license (MIT)
├── LICENSE-CC-BY-SA-4.0 # Content license (CC-BY-SA-4.0)
├── composer.json # PHP distribution
├── package.json # Node distribution (optional)
├── renovate.json # Dependency automation
├── .claude-plugin/
│ └── plugin.json # Marketplace metadata
├── .github/workflows/ # CI (typically calls reusable workflows)
├── Build/ # Build scripts and git hooks
├── docs/ # Architecture, ADRs, dashboards
├── scripts/ # Repo-level automation
└── skills/
└── {skill-name}/
├── SKILL.md # AI instructions
├── checkpoints.yaml # Assessment checkpoints (optional)
├── evals/ # Skill evaluations
├── references/ # Extended docs
├── scripts/ # Skill automation
└── templates/ # Bootstrap templates/plugin marketplace add netresearch/claude-code-marketplace, then /plugin install <plugin-name>@netresearch-claude-code-marketplace~/.claude/skills/<plugin-name>/; loads as <plugin-name>@skills-dir, no marketplace (Claude Code 2.1.157+)npx skills add <repo-url> --skill <name> (skills only: drops hooks, agents, commands, bin/)composer require netresearch/<repo-name> (PHP projects)github:<org>/<repo> (Node projects)"type": "ai-agent-skill""require": {"netresearch/composer-agent-skill-plugin": "*"}"extra": {"ai-agent-skill": "skills/{skill-name}/SKILL.md"}skill-repo-skill)This repo dogfoods the layout and hosts reusable CI workflows for other Netresearch skill repos:
skill-repo-skill/
├── AGENTS.md
├── README.md
├── LICENSE-MIT
├── LICENSE-CC-BY-SA-4.0
├── SECURITY-AUDIT.md
├── composer.json
├── package.json
├── renovate.json
├── plugin.json # Agent Plugins 1.0.0 manifest (source of truth)
├── .claude-plugin/plugin.json # Claude Code manifest (generated)
├── .github/workflows/ # validate, release, pr-quality,
│ # harness-verify, eval-validate,
│ # validate-agents, dependency-audit,
│ # npm-pack-smoke, ci-python
│ # (auto-merge delegates to netresearch/.github)
├── Build/
│ ├── Scripts/check-plugin-version.sh
│ └── hooks/
├── docs/
│ ├── ARCHITECTURE.md
│ ├── SECURITY-ASSURANCE.md
│ └── dashboard/
├── scripts/
├── tests/
│ └── agent-evidence.py # Evidence contract regressions
└── skills/skill-repo/
├── SKILL.md
├── checkpoints.yaml
├── evals/evals.json
├── references/
│ └── agent-evidence.md # Captured-run contract and trust boundaries
├── scripts/
│ └── validate-agent-evidence.py # Validate ATIF / Claude run evidence
└── templates/See docs/ARCHITECTURE.md for component responsibilities.
This skill extends (not replaces) Anthropic’s skill-creator:
| Aspect | Anthropic's skill-creator | This skill adds |
|---|---|---|
| Focus | SKILL.md content | Repository structure |
| Scope | Single file | Full repo layout |
| Distribution | Claude Code native | + Marketplace, Composer |
| Audience | AI instructions | + Human README |
Contributions welcome. Please open PRs for:
The suite lives in tests/: Bash and Python scripts per area. It needs Bash 4.3+, Python 3.11+ (standard library), Git and jq. tests/validate-skill.sh also runs the PyYAML path of the validator when python3 can import yaml or uv is installed, and skips it with a notice otherwise; tests/fleet-release.sh skips its manifest cases without gh. No test calls a model: tests/run-ab-evals.sh puts a stub claude on PATH. The only download is PyYAML through uv, for that optional path. Run everything the way CI does:
rc=0
for t in tests/*.sh; do bash "$t" || { echo "FAILED: $t"; rc=1; }; done
for t in tests/*.py; do python3 "$t" || { echo "FAILED: $t"; rc=1; }; done
(exit "$rc")validate-skill.sh, validate-skill-architecture.sh, portable-manifest.sh, mechanical-coverage.sh: the validator's verdicts (frontmatter parsing on both parser paths, multi-skill discovery, size budgets, dangling paths, allowed-tools, README install lines, release path, script-test lookup, plugin.json) and sync-plugin-manifest.sh, bump-version.sh, check-version-parity.sh.agent-evidence.py: captured ATIF/Claude evidence, completion and failure paths, Unicode, artifact integrity and path confinement.validate-evals.sh, run-ab-evals.sh: the eval validator on the three eval formats, and the A/B runner's provenance, sampling, gates and argument handling.fleet-release.sh, roll-changelog.sh, migrate-licensing.sh, release-archive-layout.sh: the fleet release driver offline, the changelog roll, the licensing migration on throwaway repositories, and the archive layout release.yml builds.usage-text.sh, audit-skills.sh, renovate-custom-manager.py: --help output of the shipped scripts, scripts/audit-skills.sh, and the Renovate regex manager in renovate.json.Each file prints a FAIL line naming each check that did not hold, ends with a summary line (except audit-skills.sh, whose failure output is its FAIL lines), and exits non-zero on any failure. The loop above runs every file and returns non-zero if any of them failed. Some files also print a line for each passing check (ok, PASS or [OK]).
In CI, every push to main and every pull request runs Skill Tests (tests-caller.yml calls the local tests.yml, which runs tests/**/*.sh and tests/**/*.py, each in its own log group) and Self-test (self-test.yml: the validator and manifest tests, this repository validated with the validator from the pull request, version parity, and the full Skill Validation job at ShellCheck severity style).
Test policy: a pull request that adds or changes behaviour of a script under skills/skill-repo/scripts/ or scripts/, or of a check in a reusable workflow, adds or updates a test in tests/ that fails without the change. Passing the existing suite is not enough for new functionality.
composer.json requires netresearch/composer-agent-skill-plugin, which registers the skill in a PHP project; package.json declares @netresearch/agent-skill-coordinator as a peer dependency for the same job in Node projects. Neither has a lock file: a skill package pins nothing for its consumers (see AGENTS.md).jq; PyYAML is optional for validate-skill.sh; the fleet driver needs gh; scripts/run-ab-evals.sh needs the claude CLI. None is installed by this repository.validate.yml downloads ShellCheck 0.11.0 and checks its SHA-256, and runs ruff 0.17.1 and pyyaml 6.0.3 through uv. bandit and pip-audit are installed with --require-hashes from .github/requirements/*.txt, generated with uv pip compile --generate-hashes. Pre-commit hooks are pinned by rev: in .pre-commit-config.yaml. ab-evals-schedule.yml installs @anthropic-ai/claude-code at a fixed version.renovate.json: config:recommended, pre-commit hooks enabled, and a regex manager for the uvx …@version and uv run --with …==version pins in workflows, tested by tests/renovate-custom-manager.py) opens update pull requests; auto-merge-deps.yml hands them to the organisation's auto-merge workflow, which merges them after their checks pass. The ShellCheck version and checksum, the pyyaml and claude-code pins and the files in .github/requirements/ have no Renovate rule and are updated by hand.This repository follows the Netresearch organisation policies:
The security assurance case for this repository (threat model, trust boundaries, countermeasures and limits) is in docs/SECURITY-ASSURANCE.md.
Checks that run on every pull request in this repository: Skill Validation (lint.yml, the reusable validate.yml from main: skill structure, plugin manifest sync, markdownlint, yamllint, actionlint, JSON syntax, Composer schema (composer validate), ShellCheck, ruff, checkpoint schemas), Self-test, Skill Tests, Eval Validation, npm Pack Smoke, the template drift check, and Security (security.yml, for pull requests against main or master): Betterleaks secret scanning, zizmor on the workflows, dependency review, Composer Audit with an Opengrep SAST scan, and CodeQL. SonarCloud and the DCO check also report on pull requests; they are configured in the repository settings, not in this repository.
This project uses split licensing:
See the individual license files for full terms.
Developed and maintained by Netresearch DTT GmbH.
Made with ❤️ for Open Source by [Netresearch](https://www.netresearch.de/)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.