static-forge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited static-forge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Codifies the procedure used to add comparison_table / /spreadsheet-statics to the ExampleBrand render-engine (2026-06-02). Every template in that engine (strikethrough, listicle, annotated_callout, pov_overlay, caption_overlay, comparison_table) was built on the identical scaffold; this mechanizes the boilerplate so the only work left is the artwork inside compose(). It also prevents the recurring footgun where a new skill is created but never symlinked into .claude/skills/, so /<skill> silently doesn't resolve.
Engine: scripts/static_forge.py (stdlib only). Default is dry-run; `--apply` mutates.
Creates engine/templates/<name>.py with a working stub compose(), registers it, writes an example spec, scaffolds the skill, symlinks it, and runs a smoke-render that passes immediately. You then replace the stub artwork.
caption_overlay template (NO engine edit) — scaffolds only the skill + slideshow example spec + symlink. Use when the new format is a copy formula, not new draw code.
# preview (writes nothing)
python3 ~/Desktop/GLOBAL/AllSkills/static-forge/scripts/static_forge.py \
--name comparison_table --skill spreadsheet-statics --title "Spreadsheet Statics" --date 2026-06-02
# build it for real, and run the smoke-render
python3 ~/Desktop/GLOBAL/AllSkills/static-forge/scripts/static_forge.py \
--name comparison_table --skill spreadsheet-statics --title "Spreadsheet Statics" \
--date 2026-06-02 --apply --renderArgs: --name (snake_case engine template module, required) · --skill (kebab slug, default = name with _→-) · --kind static|slideshow · --title · --desc (skill frontmatter description) · --engine (default ~/Desktop/ECOMMERCE/ExampleBrand/Creative/Skills/render-engine) · --date YYYY-MM-DD (stamped into scaffolded files — pass it, the script can't read the clock) · --apply · --render (run the smoke-render after apply, static only).
engine/templates/<name>.py — stub compose() (bg + logo + subhead + headline + proof) that renders cleanly out of the box, with TODO markers for the real layout.engine/registry.py — adds the import + TEMPLATES entry (idempotent; skips if already present).specs/<skill>-example.json — stub content matching the stub schema.Creative/Skills/<skill>/SKILL.md (+ reference/ + examples/) — sibling-shaped skill doc with the render command pre-filled and TODOs for the format-specific bits.<project>/.claude/skills/<skill> → ../../Creative/Skills/<skill> — the registration symlink.--render runs) the smoke-render across square_only.--apply.engine/registry.py isn't found at --engine.The scaffold is the start, not the finish. Tell the user to:
compose() in engine/templates/<name>.py with the real artwork (study the reference creative; reuse render.py primitives + the two-pass auto-fit from comparison_table.py).TODOs in the new SKILL.md (description, content schema, format notes).reference/ and verified renders into examples/./<skill> resolves.This skill builds the scaffold and smoke-tests it; it does NOT design the creative or run a real batch (that's the follow-up task).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.