expert-skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited expert-skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<skill_scope skill="expert-skill-creator"> Related skills:
skill-creator:skill-creator (Anthropic) - Basic skill mechanics, directory structure, initializationopinionated-software-engineering:software-engineer - Design principles that inform skill architectureopinionated-software-engineering:test-driven-development - Validation methodology parallelsThis skill complements Anthropic's `skill-creator:skill-creator` skill. Load both when creating skills: skill-creator:skill-creator provides basic mechanics (e.g., directory structure, initialization scripts, packaging), while this skill provides expert-level guidance on content quality, structure, and validation.
Skills are modular packages that extend Claude's capabilities by providing specialized knowledge, workflows, and tool integrations. They function as retrieval triggers that activate and organize Claude's trained knowledge, not as teaching material that explains concepts from scratch.
Critical insight: For LLMs, skills activate existing knowledge rather than teaching new content. The risk is that too much detail constrains behavior rather than enhancing it. Skills should provide high-level frameworks that trigger trained knowledge, with detailed content reserved for genuinely novel or problematic areas.
Model calibration: This skill assumes Opus as the authoring model and targets created skills primarily at Opus and Fable. Fable 5 is new and capacity-limited as of June 2026; treat it as an upgrade path rather than a dependency (see <model_targeting>). For skills targeting Sonnet or Haiku tiers, see references/prompting-sonnet.md and references/prompting-haiku.md. </skill_scope>
<when_to_use> Use this skill when:
references/retrofitting-existing-skills.md)Do not use this skill for:
<directive_language>name and description — see skill-creator:skill-creator for fields like context, agent, allowed-tools, hooks, argument substitution, and dynamic context injection</when_to_use>
<skill_vs_subagent_decision> Before designing a skill, verify that a skill is the right primitive. Skills and subagents solve overlapping problems at different layers. A skill that should have been a subagent (or vice versa) is harder to fix later than getting the choice right up front.
| Primitive | Task text from | Reach for it when |
|---|---|---|
| Subagent | The caller (main agent's delegation message or user's @mention) | Task content varies arbitrarily per invocation; value is "handle anything in domain X"; multiple skills or workflows might want it as a worker |
| Skill (inline) | The skill file itself; small parameterization via $ARGUMENTS | You have a repeatable procedure; steps are stable; you want /slash-command access; material benefits from the main context (e.g., conventions, reference, checklists) |
Skill with context: fork | The skill file, sent as the subagent's task prompt | Skill-shaped procedure and one of: it would pollute main context; it needs a specialized environment (e.g., read-only tools, different model, restricted permissions); you want to pin it to a specific subagent type |
Heuristics:
context: forkSkills and subagents compose in two supported patterns[^2]:
| Pattern | System prompt | Task | Also loads |
|---|---|---|---|
Skill with context: fork + agent: | From the selected agent type | SKILL.md body, rendered | CLAUDE.md |
Subagent with skills: frontmatter field | Subagent's own markdown body | Caller's delegation message | Preloaded skills + CLAUDE.md |
A "fork skill" composes the two primitives rather than replacing either: the skill supplies a fixed task, the subagent supplies the environment. Both remain independently usable on their own.
Common confusion to avoid: "This procedure is long, so let's make it a fork skill rather than a subagent." The procedure's length isn't the discriminator — who writes the task is. A long, fixed procedure is a fork skill. A long, variable task that the caller specifies each time is a subagent with a substantial system prompt.
<composition_contracts> When skills and agents are designed to be used together, the interface between them is a contract. A consumer must be able to act on a producer's output without guessing.
Composition takes several shapes (e.g., a fork skill handing a task to a subagent, a skill that invokes another skill, or a family of skills that pass artifacts down a pipeline). In each, one component's output is another's input, so three things have to agree across the set:
| Contract element | Keep aligned by |
|---|---|
| Vocabulary | One term per concept across every component (a concept named two ways reads as two concepts) |
| Locations | Shared file paths and output directories defined once and referenced, not retyped per component |
| Artifact shape | A stated schema for what's handed off, so the consumer parses it deterministically rather than inferring it |
Drift in any of these breaks the handoff the way a type mismatch breaks a function call, and it surfaces at runtime — a downstream component that silently misreads or ignores an upstream artifact — rather than at authoring time. Define the shared vocabulary, paths, and schema in one canonical place (e.g., a shared reference file or the most upstream component) and have the others point to it, consistent with <cross_reference_guidelines>. When you revise one side of a contract, revise the other side in the same change (see <consistency_validation>). </composition_contracts>
Once you've decided a skill is the right primitive, see <content_patterns> for choosing between Reference (inline) and Task (fork) content. </skill_vs_subagent_decision>
<skill_anatomy>
skill-name/
├── SKILL.md (required)
│ ├── YAML frontmatter (required)
│ │ ├── name: lowercase-hyphenated (max 64 chars)
│ │ └── description: what + when (max 1024 chars)
│ └── Markdown body with XML-tagged sections
├── scripts/ - Executable code (deterministic operations)
├── references/ - Documentation loaded on-demand
└── assets/ - Files used in output (e.g., templates, icons)Skills use three-level loading to manage context efficiently:
| Level | Content | When Loaded | Size Target |
|---|---|---|---|
| 1. Metadata | name + description | Always in context | ~100 words |
| 2. SKILL.md body | Instructions, frameworks | When skill triggers | <5k words |
| 3. Bundled resources | Scripts, references, assets | As needed by Claude | Unlimited |
Design implication: Keep SKILL.md lean. Move detailed reference material, schemas, and examples to references/ files. Information should live in either SKILL.md or references, never both.
<content_patterns> Skills fall into two architectural patterns that require different content approaches:
| Pattern | Frontmatter | Content style | Example |
|---|---|---|---|
| Reference (inline) | Default | Knowledge, conventions, decision frameworks Claude applies alongside conversation context | Style guides, API conventions, language idioms |
| Task (fork) | context: fork | Self-contained task prompt with explicit steps; runs in an isolated subagent with no conversation history | Deployment workflows, research orchestration, batch operations |
Reference skills provide context Claude weaves into its responses. Write them as frameworks and principles (i.e., the guidance throughout this skill). They run inline with full conversation access.
Task skills are complete prompts that drive a subagent. They need explicit instructions because the subagent has no conversation context. Use context: fork and optionally agent: to select the execution environment (e.g., Explore for read-only, general-purpose for full tool access). Task skills can launch further agents via the Agent tool, enabling fan-out patterns like parallel research or batch code changes.
Choose the pattern based on whether the skill augments Claude's knowledge (reference) or orchestrates an independent workflow (task). </content_patterns> </skill_anatomy>
<quality_guidelines> These guidelines emerged from creating 15+ skills and observing their performance in clean context windows. They represent hard-won lessons about what makes skills effective.
<xml_tag_guidelines> Skills are prompts—apply XML tagging best practices.[^1]
Why XML tags matter:
Tag naming conventions:
snake_case names: <dependency_update_checklist>, <error_handling_patterns>, <api_versioning_strategy><remember> or <notes> don't describe what to remember or what the notes contain; prefer names like <migration_safety_constraints> or <version_compatibility_matrix><platform_differences><macos_specifics>...</macos_specifics></platform_differences>Standard tags:
<skill_scope skill="skill-name"> — Use for the skill's introductory section (e.g., overview, purpose, related skills). The skill attribute prevents collision when multiple skills are loaded. Every skill should begin with this tag after the title.Explicit tag references: Reference tags by name when discussing their content. This reinforces connections between sections and helps readers navigate related guidance.
<release_checklist> before publishing"<input_validation_rules> for requirements)"Tag attributes:
<example type="good">, <quote source="SICP">Position matters (primacy bias): Content earlier in a tag receives more attention than content later. At the document level, placing long reference material at the top with instructions and queries at the bottom can improve response quality by up to 30% in tests on multi-document inputs.[^3] Within sections, structure accordingly:
Tag granularity:
Combine XML with other techniques:
<examples><example>...</example><example>...</example></examples><thinking>...</thinking><answer>...</answer>[^3] — avoid in skills that may run on Fable-class models, where instructing the model to reproduce its reasoning as response text can trigger a reasoning_extraction refusal (see <model_targeting>)<if_typescript>...</if_typescript>Example structure:
## Section Title
<section_name>
Most important guidance first...
<subsection_name>
Nested content...
</subsection_name>
Elaboration and details follow...
</section_name></xml_tag_guidelines>
<content_depth> Staff-level insights over junior-level checklists.
Include:
Avoid:
Exception—Safety constraints are valuable even for well-known content: Safety guardrails should be included even if Claude "knows" them. These constrain toward safety, not away from good behavior. Distinguish "teaching content" (condense) from "safety guardrails" (keep). </content_depth>
<directive_language> Skills are prompts. Directive intensity directly affects model behavior, and the effect is version-specific — calibrate against the models the skill targets.
Current documented behavior by model class:
| Class | Documented behavior | Implication for skill prose |
|---|---|---|
| Opus (documented for Opus 4.8) | Takes instructions at face value and applies them only to their stated scope; leans on reasoning before reaching for tools[^4] | State scope and thresholds explicitly — a vague bar like "only report important issues" is followed faithfully, suppressing output you wanted |
| Fable (documented for Fable 5) | A brief instruction steers most behaviors; heavy prescription carried over from older skills can hurt output[^5] | Prefer one condition-framed sentence over enumerating behaviors (see <model_targeting>) |
Rows are class defaults. When targeting a newer release, check the model-specific prompting pages rather than trusting parametric recall — class behavior has reversed between adjacent versions before.
Write skill content the way you'd brief a senior colleague: clear, direct, without shouting.[^3]
| Instead of | Write |
|---|---|
| "CRITICAL: You MUST..." | "Use [tool] when..." |
| "ALWAYS check..." | "Check [condition] before..." |
| "NEVER do X" | Describe the desired behavior instead |
| "If in doubt, use [tool]" | "Use [tool] when it would improve your understanding" |
Prefer positive framing. Tell the model what to do instead of what not to do: "Your response should be composed of smoothly flowing prose paragraphs" rather than "Do not use markdown in your response".[^3] Showing examples of the desired behavior tends to work better than prohibiting the undesired one.[^4] This applies at every level of skill content — from high-level behavioral guidance to specific output formatting instructions.
Include 3-5 few-shot examples when a skill needs to demonstrate output format, tone, or reasoning patterns.[^3] Wrap them in <examples><example>...</example></examples> tags. Choose diverse examples that cover edge cases; quality and variety matter more than quantity. This recommendation currently applies across tiers, Haiku included (see references/prompting-haiku.md).
This connects to the "retrieval trigger" philosophy in <skill_scope>: if skills activate existing knowledge, aggressive directives are counterproductive. They constrain behavior rather than activating capability. The right prompt intensity is the minimum needed to reliably activate the desired behavior. </directive_language>
<model_targeting> Author for Opus as the baseline; treat Fable as an upgrade path, not a dependency.
This section synthesizes and paraphrases Anthropic's model-specific prompting pages.[^4][^5] Fable's safety classifiers can return a refusal stop reason with automatic fallback to Opus 4.8,[^5] and this skill assumes Fable access can't be banked on while it's new (an authoring assumption, not a documented limit). A skill that behaves well only on Fable therefore has no guaranteed runtime. Write skills that are correct on Opus; Fable's stronger instruction-following then needs less of the skill's prose, not different prose.
Cautions for skills that may run on Fable-class models:
reasoning_extraction refusal category and force fallback; applications needing reasoning visibility should read structured thinking output from the API instead.[^5]<content_patterns>), state the conditions under which delegation is appropriate — Fable reaches for parallel subagents more readily than earlier models did.[^5]In skills you author, do the same: model classes in guidance, version numbers in evidence (citations, provenance notes, dated status facts).
Skills targeting Sonnet or Haiku (e.g., as subagent workers in multi-tier systems) follow the same general principles; tier-specific calibration lives in references/prompting-sonnet.md and references/prompting-haiku.md. Anthropic currently publishes model-specific prompting pages only for its top tiers (currently, Fable 5 and Opus 4.8); Sonnet and Haiku guidance comes from the general best-practices page and migration guides, which those references synthesize. </model_targeting>
<guidance_vs_invariants> A directive is guidance the model can decline to follow. If a behavior must hold, route it to a mechanism, not a sentence.
Skill content shapes probability, not control flow. Phrasing a requirement more forcefully (e.g., "CRITICAL", "NEVER", "NO EXCEPTIONS") may raise the odds of compliance; it does not guarantee it, and on some tiers it backfires (see <directive_language>). So before writing a requirement, classify it:
| Kind | Definition | How to encode it |
|---|---|---|
| Guidance | The model should usually do X; an occasional miss is tolerable | A calm, positively-framed directive |
| Invariant | X must hold for the skill to be correct or safe; a single miss is a defect | A deterministic gate the skill runs (e.g., a script, validator, test, or hook), with the directive as a backstop rather than the sole guard |
Treat escalating directive intensity as a design smell. The urge to write "you MUST never mark this done unless tests pass" is a signal that the requirement is an invariant the prose cannot enforce; the fix is a gate (run the tests, read the result), not a louder sentence. A model can narrate that it followed an unenforceable rule while not having followed it — only a mechanism observes the actual state.
This skill's own <pii_and_secret_scanning> models the move: it wires the scan "into the same validation gate ... enforced rather than remembered." Generalize it — when a skill defines work that must happen (e.g., a precondition, a format, a check), prefer wiring it into a gate the skill executes over trusting the model to remember.
When the invariant is "the code does what the spec says," the gate is a test; see opinionated-software-engineering:test-driven-development (tests as contracts). For the broader principle of pushing correctness into mechanisms rather than convention, see opinionated-software-engineering:software-engineer.
This section covers when to reach for a gate and what kind to reach for; it does not yet cover how to build one. Concrete implementation patterns — wiring a hook, structuring a validator script, embedding a test the skill runs — are an open area not yet developed here. </guidance_vs_invariants>
<open_world_framing> Write skill instructions for an open world. The domains skills describe — tools, APIs, options, the model's own capabilities, among others — keep changing, and any one skill sees only part of them.
A list that reads as complete becomes wrong the moment the world adds a case it didn't enumerate, and it can suppress the model's trained knowledge of cases the list omits (the opposite of the retrieval-trigger goal in <skill_scope>). Default to phrasing that stays true as the world changes and as present unknowns surface.
Practices:
<directive_language>).Closure is sometimes right, and over-hedging is its own failure mode. Assert plainly when the set is genuinely finite and the skill defines it (e.g., an enum the skill itself specifies), when an invariant truly holds, or for safety constraints, where closing toward safety is intentional (see <content_depth>). The skill is the discriminator: hedge where you describe an open domain, assert where you define a closed one.
| Closed-world phrasing | Open-world rewrite |
|---|---|
| "The three valid options are X, Y, Z." (when more may arise) | "Options such as X, Y, and Z." |
| "This is the list of supported platforms." | "Supported platforms include …; check current docs for additions." |
| "X always causes Y." | "X usually causes Y; the outcome can depend on <factors>." |
</open_world_framing>
<decision_frameworks> Focus on WHEN/WHY, not WHAT/HOW.
Skills should help identify when to use patterns, not teach how to write basic syntax. Include:
Example format:
| Context | Approach | Why |
|---------|----------|-----|
| Short-lived, personal branch | Rebase | Linear history |
| Shared/public branch | Merge | Preserve collaboration |
| Audit requirements | Merge | Full history trail |</decision_frameworks>
<proportional_engagement> A high-quality skill recognizes when its own ceremony is disproportionate to the task and says so.
A skill that runs its full process on every invocation becomes friction on the small cases it never needed to touch. Where a skill carries real overhead (e.g., multi-step workflows, heavy upfront planning, multi-agent orchestration), give it an explicit off-ramp: name the conditions under which a lighter path — a simpler sibling skill, the model's native capabilities, or doing the task directly — is the better call. This extends <when_to_use>'s "do not use for" from a static boundary into in-flight judgment: not only when not to start, but when to step aside partway. Scope the effort to the task; the goal is the outcome, not the ritual. </proportional_engagement>
<common_mistakes_guidelines> Every skill should include common mistakes organized by background.
Structure mistakes by where practitioners are coming from:
<from_java> - Mistakes Java programmers make<from_python> - Mistakes Python programmers make<from_bash> - Mistakes bash users make<general_anti_patterns> - Universal mistakesWhy background matters: Different backgrounds create different blind spots. A Java programmer learning Clojure makes different mistakes than a Python programmer learning Clojure.
Format:
### Common Mistakes
<common_mistakes>
#### From Java Users
<from_java>
- **Using class hierarchies**: Clojure prefers composition via protocols
- **Expecting mutable state**: Atoms/refs for coordinated state changes
</from_java>
#### From Python Users
<from_python>
- **Using None for missing values**: Use nil, but prefer explicit optionality
- **Imperative loops**: Use sequence operations (e.g., map, filter, reduce)
</from_python>
</common_mistakes></common_mistakes_guidelines>
<cross_reference_guidelines> Reference authoritative skills; briefly restate critical principles.
Strategy:
opinionated-software-engineering:test-driven-development skill for general testing philosophy"When to reference vs. duplicate:
Example:
## Testing
**For general testing philosophy, see the `opinionated-software-engineering:test-driven-development` skill.**
Core principle (restated): Tests are contracts—fix implementation, not tests.
This section covers language-specific practices...</cross_reference_guidelines>
<resources_guidelines> Resources serve two purposes: pointing Claude to content it can read at runtime, and naming works that activate trained knowledge. Both are valuable; distinguish them clearly.
Fetchable resources — Claude can read these at runtime:
Training-data resources — Claude can't fetch these, but naming them activates parametric knowledge of their content. This aligns with the retrieval-trigger philosophy in <skill_scope>: a book title in a Resources section is a retrieval trigger, not a URL to fetch. Include seminal books, classic papers, and foundational works when Claude's training plausibly covers them. Mark these clearly so users understand Claude is drawing on trained knowledge, not a retrieved source.
Never include:
Local documentation is especially valuable:
Format:
## Resources
<resources>
**Official:**
- [Language Documentation](https://docs.example.com/)
- [Style Guide](https://github.com/example/style-guide)
**Local:**
- `/path/to/local/docs/`
- Man pages: `/usr/share/man/man1/tool*.1`
**Foundational (training-data):**
- Author. Year. *Title*. Publisher. — Brief note on why this activates relevant knowledge
</resources></resources_guidelines>
<description_optimization> The description field is critical for skill discovery.
The description in YAML frontmatter determines when Claude invokes the skill. Include:
Good example:
description: Fish shell scripting judgment frameworks and critical idioms. Use when writing Fish scripts or shell automation. Focuses on when to use Fish vs bash, macOS/Fedora compatibility requirements, and Fish-specific patterns that prevent bugs.Bad example:
description: Fish shell scripting.Max length: 1024 characters per description; name is capped at 64.[^7] There's also a collective budget: in Claude Code, the listing text per skill (combined description and when_to_use) is truncated at 1,536 characters, and all listings share a budget defaulting to 1% of the model's context window (raisable via the skillListingBudgetFraction setting or the SLASH_COMMAND_TOOL_CHAR_BUDGET environment variable).[^6] On overflow, skill names stay listed but the descriptions of least-invoked skills are shortened or dropped first — stripping the keywords discovery depends on. Concise descriptions aren't just good practice — they're a shared resource. A verbose 900-character description crowds out other skills' discovery text. </description_optimization>
<content_assessment> Assess what Claude knows vs. what needs detail.
| Knowledge State | Treatment |
|---|---|
| Well-known from training | Condense to principles and frameworks |
| After training cutoff | Include detail, examples, patterns |
| Known problem area | Justify expanded coverage |
Example assessment (Swift skill):
Target lengths:
</content_assessment> </quality_guidelines>
<research_phase> Use agents to research skill content before writing.
Research is warranted when:
<research_process>
subagent_type='opinionated-research:research-investigator' for methodical evidence-gathering (the typical case for skill research, where you want sources you can cite) or subagent_type='opinionated-research:research-analyst' when the skill design itself requires cross-source synthesis judgmentsExample research prompt:
Research the current best practices for [topic]. Specifically:
1. What are the official documentation sources?
2. What tooling is recommended by the community?
3. What are common mistakes practitioners make?
4. What has changed since [date]?
Return findings with URLs for each source so I can create proper citations.</research_process>
For skill research, the opinionated-research:research-investigator agent is the usual fit (methodical, evidence-trail, citations per claim):
[CITED]/[TRAINING DATA]/etc. provenance labels and ACM-format citations per [CITED] claim</research_phase>
<citation_requirements> All third-party content must be attributed. Use formal ACM citations when the source adds value.
<citation_scope> Distinguish attribution from formal citation:
Must attribute:
Informal attribution is sufficient for:
"quote" — Author, Source WorkFormal ACM citations are warranted when:
Does not require attribution:
Judgment call: When in doubt, attribute. Formal citation when the source adds value. </citation_scope>
<citation_format> When formal citations are warranted, use ACM style with Markdown footnote syntax.
In-text citation: Use Markdown footnote references: [^1], [^2]
Reference list format:
## Sources
<sources>
[^1]: Author Name. Year. Title. Publication venue. URL or DOI
[^2]: Organization. Year. Document Title. Retrieved [Date] from URL
</sources>Example citations:
Rich Hickey's "Simple Made Easy" talk[^1] distinguishes simplicity from ease...
## Sources
<sources>
[^1]: Rich Hickey. 2011. Simple Made Easy. Strange Loop Conference. Retrieved November 24, 2025 from https://www.infoq.com/presentations/Simple-Made-Easy/
[^2]: ACM. 2023. Reference Formatting. Retrieved November 24, 2025 from https://www.acm.org/publications/authors/reference-formatting
</sources>Why Markdown footnotes: Footnote syntax ([^1]) renders properly in Markdown viewers, creates clickable links to sources, and distinguishes citations from array indexing or other bracket uses in technical content. </citation_format>
<citation_accuracy> Never fabricate bibliographic details.
[unverified]</citation_accuracy>
<source_verification> Training data is not verification. Use tools to confirm sources before citing.
Memories from training are hypotheses, not facts. Before adding any citation:
When verification tools are available (e.g., WebFetch, WebSearch, Kagi, Exa), use them. The cost of a few tool calls is trivial compared to publishing incorrect citations.
Common verification failures:
Verification workflow:
</source_verification>
<citation_mistakes> Lessons learned from skill validation:
... to indicate incompleteness[^1]: Author. Title. URL</citation_mistakes> </citation_requirements>
<validation_phase> Validate skill content before finalizing.
<content_validation> Before completing a skill, verify:
Structure:
name and description<skill_scope skill="skill-name"> containing related skillssnake_case namesContent Quality:
<directive_language>)<model_targeting>)<guidance_vs_invariants>)<proportional_engagement>)<open_world_framing>)Attribution and Citations:
<citation_scope>)<source_verification>)Consistency:
<composition_contracts>)Publication Safety:
<pii_and_secret_scanning></content_validation>
<empirical_validation> Skills are iteratively refined based on actual usage. Walk the user through the process of validating a skill.
After creating a skill:
Evaluation questions:
<model_targeting>)? A directive calibrated for one version may overtrigger, be followed too literally, or underperform on another (see <directive_language>).</empirical_validation>
<plagiarism_validation> For skills intended for publication, run systematic plagiarism checks.
Parallel agent validation: Launch multiple agents simultaneously to check each skill file. Each agent should:
Example prompt for validation agent:
Read [skill file] and check for potential plagiarism. Look for:
1. Text that sounds copied from external sources
2. Quotes or specific claims lacking citations
3. Statistics or unique phrases without sources
Report: File path, suspicious passages with line numbers, assessment.Post-validation: Address all flagged issues before publication. Even "clean" files may have minor citation improvements identified. </plagiarism_validation>
<pii_and_secret_scanning> Before publishing, scan the whole publishable surface for personal data and secrets — not just the `SKILL.md` you edited.
Skills get published: GitHub releases, marketplaces, shared ZIPs. What goes public is every tracked file — skill bodies, agents, README, manifests, example snippets, bundled resources — so scan the tracked tree, not the single file you touched. Untracked files headed for a later commit count too; scan them before they land.
Common leak vectors and how to tell signal from noise. The patterns below are examples to seed the scan, not a closed checklist — add others your content invites (e.g., physical addresses, OAuth client secrets, license keys):
| Vector | Example pattern | Usually benign when… |
|---|---|---|
| Email addresses | [email protected] | Placeholder ([email protected]) or example domain (example.com, test.) |
| Home-path username leaks | /Users/<name>, /home/<name>, C:\Users\<name> | Generic placeholder (/Users/you, $HOME) |
| Credentials | API keys, bearer tokens, AKIA…, -----BEGIN … PRIVATE KEY, ghp_… | Treat every real-looking match as live until proven otherwise |
| Personal identifiers | Author's real name, phone, SSN | Citing a public figure's published work (attribution, not exposure) |
| Internal references | Private hostnames, internal URLs, ticket IDs | Public docs or documented example hosts |
Most hits are false positives, so judge each one: a placeholder email and a citation to a public author are clean; a stray /Users/yourname path or a real-looking token are not. When a match is genuinely a secret, rotate it — removing it from the working tree doesn't remove it from history.
Run a pattern scan over tracked files (e.g., git grep -nIE for the vectors above). For secrets specifically, add an entropy-based scanner (e.g., gitleaks, trufflehog) to catch high-entropy strings the patterns miss. Wire the scan into the same validation gate that runs the other checks so it's enforced rather than remembered — a skipped manual step is the exact failure mode this guards against. </pii_and_secret_scanning>
<consistency_validation> When creating or updating a skill, check for conflicts with related skills, and for contract drift among skills used together:
<composition_contracts>)</consistency_validation> </validation_phase>
<creation_process> Follow this process in order, skipping steps only with clear justification.
<step_understand> Goal: Clearly define what the skill does and when it should be used.
Activities:
Questions to answer:
Complete when: Clear purpose statement and scope boundaries established. </step_understand>
<step_research> Goal: Gather authoritative information for skill content.
Activities:
opinionated-research:research-investigator for unfamiliar domains (or opinionated-research:research-analyst when the skill design itself requires cross-source synthesis judgments)Skip when: Creating a skill for a domain you're already expert in, with no post-cutoff content.
Complete when: All necessary information gathered with source attribution. </step_research>
<step_plan> Goal: Design the skill's structure and identify reusable components.
Activities:
Architectural questions:
Complete when: Clear outline with section structure and resource allocation. </step_plan>
<step_initialize> Goal: Create the skill directory structure.
For new skills, use the init script in Anthropic's skill-creator:skill-creator skill if available:
scripts/init_skill.py <skill_name> --path <output_directory>Manual initialization:
mkdir -p skill-name/{scripts,references,assets}
touch skill-name/SKILL.mdSkip when: Iterating on an existing skill.
Complete when: Directory structure exists with SKILL.md template. </step_initialize>
<step_write> Goal: Create the skill content following quality guidelines.
Writing principles:
Order of writing:
<skill_scope skill="skill-name"> with related skills and purposeComplete when: All content written with proper structure. </step_write>
<step_validate> Goal: Ensure skill meets quality standards.
Activities:
Complete when: All validation checks pass. </step_validate>
<step_iterate> Goal: Refine skill based on actual performance.
Iteration triggers:
Iteration process:
Note: Skill refinement is ongoing. Document observations for future improvements. </step_iterate> </creation_process>
<skill_tiers> Skills exist in a hierarchy with fallback behavior.
| Tier | Purpose | Example |
|---|---|---|
| Meta-skill | Universal principles | opinionated-software-engineering:software-engineer |
| Paradigm skills | Fallback for language families | functional-programmer, object-oriented-programmer |
| Language skills | Specific language guidance | java-programmer, clojure-programmer |
| Process skills | Situation-specific | opinionated-software-engineering:test-driven-development, opinionated-software-engineering:git-version-control |
Invocation behavior:
opinionated-software-engineering:software-engineer) invoked for all coding tasksContent placement:
opinionated-software-engineering:software-engineer</skill_tiers>
<anti_patterns> Patterns that reduce skill effectiveness:
<directive_language>)</anti_patterns>
<resources> Official documentation:
Bundled references:
references/prompting-sonnet.md - Sonnet-tier calibration for skill authorsreferences/prompting-haiku.md - Haiku-tier calibration for skill authorsreferences/retrofitting-existing-skills.md - Staged runbook for bringing existing skills up to these standardsRelated skills:
opinionated-software-engineering:software-engineer - Design principles informing skill architecture</resources>
<sources> [^1]: Anthropic. 2025. Use XML tags to structure your prompts. Retrieved November 24, 2025 from https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/use-xml-tags.md
[^2]: Anthropic. 2025. Skills Documentation. Claude Code. Retrieved November 24, 2025 from https://code.claude.com/docs/en/skills.md
[^3]: Anthropic. 2026. Prompting best practices. Claude API Documentation. Retrieved June 10, 2026 from https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices
[^4]: Anthropic. 2026. Prompting Claude Opus 4.8. Claude API Documentation. Retrieved June 10, 2026 from https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-opus-4-8
[^5]: Anthropic. 2026. Prompting Claude Fable 5. Claude API Documentation. Retrieved June 10, 2026 from https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-fable-5
[^6]: Anthropic. 2026. Extend Claude with skills. Claude Code Documentation. Retrieved June 10, 2026 from https://code.claude.com/docs/en/skills.md
[^7]: Anthropic. 2026. Agent Skills. Claude API Documentation. Retrieved June 10, 2026 from https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview </sources>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.