skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Author a new Agent skill that fits this repository's conventions and ships ready for review.
Focus on:
skill-check.config.json limits@rules/php/core-standards.mdc only once it is established that the skill being created targets PHP code work in a PHP project — skip it for a stack-agnostic or non-PHP skill; do not load the PHP standards when the new skill does not touch PHP.@rules/git/general.mdcskills/ for an AI agent workflowBefore generating any file, gather:
skills/rules/**/*.md* files the skill must applyIf running interactively, confirm the inputs with the user. If running autonomously (e.g. invoked by resolve-issue or a scheduled workflow), infer the inputs from the triggering issue / PR description and state the assumptions in the final summary.
skills/ and read any skill whose name overlaps semantically with the request.skills/.skills/<slug>/SKILL.md. Add subfolders (templates/, references/) only when the skill genuinely needs them.Required keys:
---
name: <slug>
description: "Use when <trigger phrase>. <one sentence on scope>."
license: MIT
metadata:
author: "Petr Král (pekral.cz)"
---Rules from skill-check.config.json:
description: 50–1024 chars; should start with "Use when"name: ≤ 64 charsThe repo accepts two body layouts. Pick one and stay consistent within the file.
Layout A — Constraints-first (preferred for new skills):
## Constraints — applied rules and hard limits (one bullet per item)## Use when — concrete triggers## Required approach or ## Execution — numbered steps the agent must follow## Output or ## Output Format — structure of what the skill returns## Done when — verifiable completion criteriaExamples in the repo: refactor-entry-point-to-action, smartest-project-addition, test-driven-development, test-like-human, security-review.
Layout B — Title + Purpose (legacy, still acceptable):
# <Title Case Name>## Purpose — one short paragraph plus a bullet list of focus areas## Constraints## Execution## Output or ## Output Format## Principles — short guiding rules (optional)## Done whenExamples in the repo: code-review, class-refactoring, create-test, analyze-problem.
Omit a section only when it does not apply.
@rules/<area>/<file>.mdc or .md exactly as they exist on disk.@skills/<slug>/SKILL.md.Run before declaring the skill done:
composer skill-check — must report PASS with no warnings on the new fileskill-check flags an auto-fixable warning, run npx skill-check check skills/<slug> --fix --no-security-scan (path-scoped) instead of composer skill-check-fix, which rewrites every skill in the tree and can pollute the diff with unrelated formatting changescomposer build — full project build (must finish without errors)Do not silence checks; fix the SKILL.md content until the report is clean.
After the new SKILL.md passes validation:
CHANGELOG.md entry under [Unreleased] describing the new skill and referencing the issue (e.g. (#432)).README.md:Skip the README update only when the skill is intentionally internal and not part of the public catalog — state this explicitly in the PR description.
skills/<slug>/SKILL.mdCHANGELOG.md and README.md@rules/* and @skills/* reference existsskill-check be the source of truth for SKILL.md qualityskills/<slug>/SKILL.md exists with valid frontmatter and required sectionscomposer skill-check passes with no warnings on the new filecomposer build finishes without errorsCHANGELOG.md and README.md reflect the new skill (or the omission is justified)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.