A meta-skill for Claude Code that routes requests to the right installed skill — suggest mode or silent auto-routing
SaferSkills independently audited skill-router (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scan all installed skills once, build a lightweight in-session index, then route subsequent requests to the most relevant skill — but only when a skill would materially improve the response. No overhead on conversational or trivial requests.
Two modes:
*(via skill-name)* to routed responses/skill-router on — suggest mode (default)/skill-router on --auto — auto modeBoth run the same activation steps:
find ~/.claude/skills -name "SKILL.md" | sortFor each file found, extract the following fields (in order of preference):
name: from YAML frontmatterdescription: from YAML frontmattertriggers: or trigger: from YAML frontmatter (if present)Skip skill-router itself. Skip files that cannot be read.
Construct an in-memory table (session-only, never written to disk):
SKILL INDEX
-----------
<skill-name> | <trigger keywords, comma-separated> | <one-line description>
...Also initialize an in-memory session usage counter:
SESSION_USAGE = {} ← empty dict, incremented each time a skill is invokedExample row:
geo-audit | geo, seo, audit, AI search | Full website GEO+SEO audit with parallel subagent delegation.Rules:
trigger, triggers, or tags frontmatter fieldsgeo-* skills = "GEO/SEO domain")The router reads only frontmatter + first 20 lines of each SKILL.md at activation time — NOT the full content. Full SKILL.md content is only loaded when a skill is actually selected for routing. This means routing quality depends directly on the quality of each installed skill's frontmatter.
The fields that matter most:
description: — most important. Use verb-first phrasing with concrete keywords.tags: — explicit keyword list for matching.trigger: / triggers: — alternative keyword sources.Good frontmatter example:
description: "Run a full GEO audit on a website — crawlability, schema, content quality, AI citability"
tags: [geo, seo, audit, AI search]Bad frontmatter example:
description: "A useful skill for various tasks"Tip: if an expected skill is not triggering, check its frontmatter first.
If the scan returns zero SKILL.md files, reply:
Skill Router: no skills found at ~/.claude/skills. Install skills first.and do not activate routing.
Otherwise, reply with exactly one line:
Skill Router active [suggest | auto] — <N> skills indexed (<domain1>, <domain2>, ...).Examples of domains: GEO/SEO, Testing, Deployment, Git, Security, Code Review, AI Delegation. List at most 5 domain labels. Nothing else.
/skill-router offReply with exactly one line: Skill Router off. All subsequent requests are answered directly — no routing until /skill-router on is run again.
Lifecycle note: routing state lives in conversation context. In very long sessions, context compression may truncate earlier turns and silently deactivate routing. If you notice routing has stopped, re-run /skill-router on to re-activate.For every subsequent user input, first apply the gate check:
1. Is the request conversational, a simple question, or under ~10 words?
→ Answer directly. Do NOT load any skill.
2. Is it a substantive task (feature, audit, workflow, architecture, etc.)?
→ Scan the index. Identify all skills with HIGH confidence match.
→ Branch based on active mode (see below).
3. No HIGH confidence match?
→ Answer directly from your own knowledge. Do NOT mention any skill.HIGH confidence = clear keyword overlap, not just tangential similarity.
✅ "run a GEO audit on plume.africa" → geo-audit (exact domain + action match)
✅ "write a Dockerfile for this Node app" → docker-patterns (explicit tool + task)
❌ "fix this bug in my app" → no match (too generic, no skill keyword overlap)
❌ "how do I structure my API?" → no match (tangential, answerable directly)When one or more skills match with HIGH confidence, before answering, show:
Suggested skills for this request:
1. <skill-name> — <one-line reason why it matches>
2. <skill-name> — <one-line reason why it matches> ← if a second skill also matches
Use skill 1, 2, or answer directly? (1/2/no)1 or 2 → load that skill's SKILL.md fully, apply its rules, then record usage (see Usage Tracking)no or anything else → answer directly without loading any skillWhen one skill matches with HIGH confidence:
*(via skill-name)*(e.g. geo-schema beats geo for a schema-only question)
skill-router on itself/skill-router statusnot just because keywords overlap
Every time a skill is invoked (user confirms in suggest mode, or auto-routes), do two things:
1. Update in-memory session counter:
SESSION_USAGE[skill-name] += 12. Persist to `~/.claude/skill-usage.json` by running this Bash command (replace SKILL_NAME and TODAY):
python3 -c "
import json, os
f = os.path.expanduser('~/.claude/skill-usage.json')
d = json.load(open(f)) if os.path.exists(f) else {}
s = 'SKILL_NAME'
d.setdefault(s, {'total': 0, 'last_used': None})
d[s]['total'] += 1
d[s]['last_used'] = 'TODAY'
json.dump(d, open(f, 'w'), indent=2)
"Where TODAY = current date in YYYY-MM-DD format ($(date +%Y-%m-%d)).
Run this silently — no output to user.
/skill-router statsRead the persistent usage file, merge with the session counter, and display:
python3 -c "
import json, os
f = os.path.expanduser('~/.claude/skill-usage.json')
print(json.dumps(json.load(open(f)), indent=2) if os.path.exists(f) else '{}')
"Then display a table sorted by total descending, with session column overlaid from SESSION_USAGE:
Skill Usage Stats
-----------------
Skill | Total | Session | Last Used
--------------------+-------+---------+----------
geo-audit | 12 | 2 | 2026-05-15
vibe | 8 | 1 | 2026-05-18
docker-patterns | 3 | 0 | 2026-05-01
geo-schema | 0 | 0 | neverRules:
total = 0 appear at the bottom with never as last used datetotal, then alphabetically within tiesTotal invocations this session: <sum of SESSION_USAGE values>/skill-router statusShow exactly this, nothing more:
Skill Router status
-------------------
Mode: suggest | auto | off
Skills indexed: <N>
Index:
<skill-name> | <trigger domains> | <one-line description>
...
Last skill used: <skill-name> | none this sessionIf the router was never activated this session:
Skill Router not active. Type `/skill-router on` (suggest) or `/skill-router on --auto` to activate.~/.claude/skill-usage.json (usage tracking only)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.