creating-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited creating-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill for creating new skills and iteratively improving them.
At a high level, the process of creating a skill goes like this:
eval-viewer/generate_review.py script to show the user the results for them to look at, and also let them look at the quantitative metricsYour job when using this skill is to figure out where the user is in this process and then jump in and help them progress through these stages. So for instance, maybe they're like "I want to make a skill for X". You can help narrow down what they mean, write a draft, write the test cases, figure out how they want to evaluate, run all the prompts, and repeat.
On the other hand, maybe they already have a draft of the skill. In this case you can go straight to the eval/iterate part of the loop.
Of course, you should always be flexible and if the user is like "I don't need to run a bunch of evaluations, just vibe with me", you can do that instead.
Then after the skill is done (but again, the order is flexible), you can also run the skill description improver, which we have a whole separate script for, to optimize the triggering of the skill.
On claude.ai or in Cowork, read references/other-surfaces.md before you start: it changes how you test, review, tune the description, and update an installed skill.
Cool? Cool.
The skill creator is liable to be used by people across a wide range of familiarity with coding jargon. If you haven't heard (and how could you, it's only very recently that it started), there's a trend now where the power of Claude is inspiring plumbers to open up their terminals, parents and grandparents to google "how to install npm". On the other hand, the bulk of users are probably fairly computer-literate.
So please pay attention to context cues to understand how to phrase your communication! In the default case, just to give you some idea:
It's OK to briefly explain terms if you're in doubt, and feel free to clarify terms with a short definition if you're unsure if the user will get it.
Start by understanding the user's intent. The current conversation might already contain a workflow the user wants to capture (e.g., they say "turn this into a skill"). If so, extract answers from the conversation history first: the tools used, the sequence of steps, corrections the user made, input/output formats observed. The user may need to fill the gaps, and should confirm before proceeding to the next step.
Also check that a skill is the right vehicle. A skill suits a procedure: instructions, checklists, multi-step workflows the user keeps re-explaining. A plain fact or preference belongs in CLAUDE.md (or memory) instead. The cost model decides: CLAUDE.md content loads every turn, a skill's body loads only when used, so long procedural material is nearly free as a skill and expensive as CLAUDE.md. If what the user describes is a fact, suggest CLAUDE.md and stop here.
Proactively ask questions about edge cases, input/output formats, example files, success criteria, and dependencies. Wait to write test prompts until you've got this part ironed out.
Check available MCPs - if useful for research (searching docs, finding similar skills, looking up best practices), research in parallel via subagents if available, otherwise inline. Come prepared with context to reduce burden on the user. Canonical sources worth consulting: the Agent Skills open standard at agentskills.io, Anthropic's skill authoring best practices (platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices), and the example skills at github.com/anthropics/skills/tree/b9e19e6f44773509fbdd7001d77ff41a49a486c1.
Based on the user interview, fill in these components:
/command comes from the skill's directory name, not this field (which is a display label), so name the directory with the same care and keep the two identical.references/writing-great-skills.md before you write one: it covers front-loading the leading word, one trigger per branch, and cutting identity the body already holds. Two rules it lacks:description plus when_to_use at 1,536 characters in the skill listing (so the key use case must sit in the first sentence), and claude.ai uploads cap the description at 200 characters.disable-model-invocation, user-invocable, compatibility / dependencies, and Claude Code's further fields): read "Optional frontmatter fields" in references/skill-writing-guide.md before you set one.Before you lay out the skill's files and write its body, read references/skill-writing-guide.md: the anatomy of a skill folder, progressive disclosure (what stays in SKILL.md and what goes behind a pointer), the principle of lack of surprise (no malware, no hardcoded secrets), the writing patterns (output formats, examples, arguments, dynamic context injection, wrapping CLIs and APIs, feedback loops), and the writing style (explain the why, calibrate specificity, match the form of a fix to the failure).
#### Skills in plugin marketplace repos
When the skill lives in a repo that distributes plugins (a marketplace manifest at the repo root, a directory of plugins), writing SKILL.md is only half the job: the skill must be registered in the marketplace manifest, the plugin version bumped, index docs updated, and the repo's checks passed. Discover the host repo's conventions (author, license, commit style, version-tracking files) from its existing plugins rather than inventing values. references/marketplace-integration.md has the discovery checklist, wiring steps, version discipline, and drop-in test scaffolds. A repo may cap file size (pgoell-claude-tools: 5000 tokens, bytes/4). A SKILL.md over the cap moves step detail into references/, loaded by the step that needs it: a deep split, not a cut by line count.
After writing the skill draft, come up with 2-3 realistic test prompts, the kind of thing a real user would actually say. Share them with the user: [you don't have to use this exact language] "Here are a few test cases I'd like to try. Do these look right, or do you want to add more?" Then run them.
For a discipline-enforcing skill, invert the order: run the scenarios as baselines before writing the skill, and capture the agent's rationalizations verbatim. Those observed failures, not your guesses, define what the skill must say. Design the scenarios as forced choices under stacked pressure; references/bulletproofing.md has the method.
Save test cases to evals/evals.json. Don't write assertions yet, just the prompts. You'll draft assertions in the next step while the runs are in progress.
{
"skill_name": "example-skill",
"evals": [
{
"id": 1,
"prompt": "User's task prompt",
"expected_output": "Description of expected result",
"files": []
}
]
}See references/schemas.md for the full schema (the assertions you'll add later live in its expectations field, which is what the grading pipeline and viewer call them).
If you have no subagents (Claude.ai), no browser or display (Cowork, a remote box), or a present_files tool, read references/other-surfaces.md first: it says which steps below and in references/running-evals.md change.
This section is one continuous sequence: don't stop partway through. Do NOT use /skill-test or any other testing skill.
Put results in <skill-name>-workspace/ as a sibling to the skill directory. Within the workspace, organize results by iteration (iteration-1/, iteration-2/, etc.) and within that, each test case gets a directory eval-<id>-<name>/, where <id> is the test case's id in evals/evals.json (ids start at 1) and <name> is a short descriptive name (for example eval-1-chart-axis-labels/). Don't create all of this upfront, just create directories as you go.
Read references/running-evals.md before the first run and follow its Steps 1 to 5 in order: spawn all runs (with-skill AND baseline) in the same turn, draft assertions while they run, capture timing data as each completes, grade, aggregate and launch the viewer, then read the feedback.
This is the heart of the loop. You've run the test cases, the user has reviewed the results, and now you need to make the skill better based on their feedback.
First check you're in the right loop. If the skill produces the right outputs but rarely fires, the body is fine and the description is the problem: go to Description Optimization. If it fires but the outputs are wrong, iterate on the body here. If it fires and the agent bypasses its rules under pressure, that's a discipline problem: pressure-test per references/bulletproofing.md instead of polishing prose.
Before you revise the skill, read references/improving-skills.md: generalize from the feedback, keep the prompt lean, explain the why, look for repeated work across test cases, and micro-test contested wording.
After improving the skill:
/reload-plugins)iteration-<N+1>/ directory, including baseline runs (Steps 1 to 5 of references/running-evals.md). If you're creating a new skill, the baseline is always without_skill (no skill); that stays the same across iterations. If you're improving an existing skill, use your judgment on what makes sense as the baseline: the original version the user came in with, or the previous iteration.--previous-workspace pointing at the previous iterationKeep going until:
When the user asks to cut, trim, shorten, simplify, or de-slop a skill, or to make it trigger less eagerly, read references/cutting-skills.md. It sorts each rule by how binding it is and each passage by what it contains, so every deletion has a stated reason, and it covers narrowing the description. A review request is an audit: report the cuts, edit nothing. A cut is a skill edit, so prove it with the iteration loop above, with the pre-cut snapshot as baseline: pass rate must hold while tokens fall. Length alone is not a reason to cut.
For situations where you want a more rigorous comparison between two versions of a skill (e.g., the user asks "is the new version actually better?"), there's a blind comparison system. Read agents/comparator.md and agents/analyzer.md for the details. The basic idea is: give two outputs to an independent agent without telling it which is which, and let it judge quality. Then analyze why the winner won.
This is optional, requires subagents, and most users won't need it. The human review loop is usually sufficient.
The description field in SKILL.md frontmatter is the primary mechanism that determines whether Claude invokes a skill. After creating or improving a skill, offer to optimize the description for better triggering accuracy. The loop in references/description-optimization.md needs claude -p; on claude.ai, check triggering by hand as references/other-surfaces.md says.
Read references/description-optimization.md and follow its steps: generate trigger eval queries, review them with the user, run the optimization loop, and apply the result within the length limits. It also explains how skill triggering works and how to keep a trigger regression test.
If you have a present_files tool, or the user wants a .skill file for claude.ai or Cowork, follow "Package and present" in references/other-surfaces.md.
The agents/ directory contains instructions for specialized subagents. Read them when you need to spawn the relevant subagent.
agents/grader.md: How to evaluate assertions against outputsagents/comparator.md: How to do blind A/B comparison between two outputsagents/analyzer.md: How to analyze why one version beat anotherThe references/ directory has additional documentation:
references/skill-writing-guide.md: optional frontmatter fields, skill anatomy, progressive disclosure, lack of surprise, writing patterns and style. Read it when you lay out a skill and write its body.references/running-evals.md: Steps 1 to 5 of running and evaluating test cases. Read it before you run test cases.references/improving-skills.md: how to think about improvements. Read it before each revision of a skill body.references/description-optimization.md: trigger eval queries, the optimization loop, how triggering works, the trigger regression test. Read it when you optimize a description.references/schemas.md: JSON structures for evals.json, grading.json, etc.references/platform-mechanics.md: how Claude Code, claude.ai, and the API discover, load, render, and constrain skills (locations and precedence, invocation states, the full frontmatter reference, arguments and substitutions, dynamic context injection, content lifecycle and compaction, listing budgets, portability and upload limits). Read it when picking frontmatter beyond name and description, deciding where a skill lives, bundling scripts, diagnosing triggering, or preparing a claude.ai upload.references/writing-great-skills.md: skill design vocabulary adapted from Matt Pocock's writing-great-skills (invocation and context load, information hierarchy, leading words, completion criteria, pruning, failure modes). Read it when drafting a new skill or diagnosing a misbehaving one.references/bulletproofing.md: test-first hardening for discipline-enforcing skills, adapted from Jesse Vincent's writing-skills (baseline-before-writing, pressure scenarios, rationalization tables, the form-to-failure matrix, wording micro-tests, persuasion register). Read it when a skill enforces a rule agents might skip under pressure, or when an agent keeps rationalizing its way around one.references/cutting-skills.md: trimming a skill to its behavioral core, adapted from swyx's skill-cutter (audit and cut modes, rule-force and content tables, gate check, trigger narrowing, report shape). Read it when the user asks to cut, shorten, or de-slop a skill, or to make it trigger less.references/other-surfaces.md: what changes on claude.ai (no subagents) and in Cowork (no browser or display), how to update an installed skill there, and how to package and present a .skill file. Read it before you start on claude.ai or in Cowork, before running test cases when you lack subagents or a display, or when you have a present_files tool.references/marketplace-integration.md: shipping a skill inside a plugin marketplace repo (convention discovery, manifest and marketplace registration, version bump discipline, structure and trigger-regression test scaffolds). Read it when the skill under construction lives in a repo that distributes plugins.Repeating one more time the core loop here for emphasis:
eval-viewer/generate_review.py to help the user review themPlease add steps to your TodoList, if you have such a thing, to make sure you don't forget.
Good luck!
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.