find-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited find-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Discover Claude Code skills that are not yet installed and recommend the best matches for a stated need. This is discover-and-recommend only — never install, download, clone, or modify the user's system. End by showing a ranked shortlist with links; the user installs manually.
Extract 2–4 search keywords from the user's need (the topic, the verb, key nouns). If the request is too vague to search (e.g. "find me a useful skill"), ask one clarifying question first.
The whole point is to surface skills the user does not have. Build a set of installed skill names/topics:
ls -d ~/.claude/skills/*/ 2>/dev/null # personal skills
find ~/.claude/plugins -maxdepth 8 -name SKILL.md 2>/dev/null # plugin skillsAlso account for the available-skills list already present in your context. Any candidate that matches something installed must be excluded — or mentioned as "you already have this" — never recommended as new.
Run all three. They are independent; if one fails, continue with the others.
A. Official marketplace — local cache, offline, fast. Always do this first.
jq -r --arg kw "<keyword>" '
.catalog.plugins | to_entries[]
| .key as $id | .value as $p
| ($p.marketplace_entry.name // $id) as $name
| ($p.marketplace_entry.description // "") as $desc
| ([$p.components.skills[]?.name] | join(", ")) as $skills
| select((($name+" "+$desc+" "+$skills)|ascii_downcase) | test($kw|ascii_downcase))
| "\($p.unique_installs // 0)\t\($name)\t\($id)\t\($p.marketplace_entry.homepage // "")\t\($desc)"
' ~/.claude/plugins/plugin-catalog-cache.json | sort -rn | head -10Columns: unique_installs (popularity) · name · install id (name@marketplace) · homepage · description. Install hint for these: /plugin install <id>.
B. GitHub — degradation chain. Use the first rung that works.
gh auth status; if logged in: gh search repos "<kw> claude skill" --limit 20 --stars ">=10" \
--json fullName,description,stargazersCount,pushedAt,url
gh search code "filename:SKILL.md <kw>" --limit 20 \
--json repository,path,url # code search REQUIRES authstars:>=10 qualifier applies the popularity floor server-side: curl -sG "https://api.github.com/search/repositories" \
--data-urlencode "q=<kw> claude skill stars:>=10" --data "sort=stars" --data "per_page=20" \
| jq -r 'if .message then "ERR: \(.message) — fall through to WebSearch" else (.items[]? | "\(.stargazers_count)\t\(.full_name)\t\(.pushed_at[0:7])\t\(.html_url)\t\(.description // "")") end'claude skill <topic> SKILL.md site:github.com, then WebFetch the most promising repos to read their SKILL.md / README and confirm they really are skills. There's no star filter here, so apply the popularity floor yourself when ranking (step 4).Columns from rungs 1–2: stars · repo · last-push month (pushedAt/pushed_at, the true freshness signal — not updatedAt, which bumps on a mere star or description edit) · url · description.
Install hint for GitHub finds: symlink or copy the skill dir, e.g. git clone <url> then point Claude at its SKILL.md.
C. Curated awesome-lists — human-vetted, good signal.
WebSearch awesome claude code skills, then WebFetch the top index (start with github.com/hesreallyhim/awesome-claude-code) and pull entries matching the keywords. Verify a link before recommending it.
<name>" instead of listing it as new.unique_installs is their signal) and curated-list entries (human-vetted) are exempt from this floor. Also downrank repos with no code push in ~6 months (use pushedAt, not updatedAt).SKILL.md: gh search code "filename:SKILL.md repo:<owner/name>" when authed, else WebFetch the repo to check for a SKILL.md (as rung 3 already does). Drop what you can't confirm, or label it unverified. Marketplace and curated-list entries are already known skills — skip this.stargazersCount / unique_installs) and recency (pushedAt).One block per candidate:
**<name>** — <one-line description>
Source: GitHub | Marketplace | List · <★ stars (GitHub) | N installs (Marketplace)> · pushed <YYYY-MM>
Link: <repo url / marketplace id>
Why: <one line: how it fits the stated need>
Get it: <copy-paste hint — `/plugin install …` or `git clone …`> (not run for you)If a source was skipped or degraded, add a one-line footer, e.g. > GitHub searched via WebSearch — run \gh auth login\ for sharper, code-level results.
/plugin to browse the marketplace UI.early-stage (3★), so it never reads as a vetted pick.jq/gh) → note which one, continue with the rest. Never hard-fail the whole search.No installing, cloning, downloading, or any system modification. No general/open web search (GitHub + marketplace + curated lists only). No result caching, no scoring engine — judge relevance yourself.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.