agent-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill for creating custom subagents packaged inside proper plugins. This skill handles the entire flow: gathering requirements, generating a rich persona from even a one-line description, scaffolding the correct folder structure, and optionally creating a companion skill that auto-routes tasks to the new agent.
Use this skill whenever you need a dedicated, isolated "brain" to handle a specific repetitive task, or when you find yourself repeatedly pasting the same massive system prompt or constraints into the main chat. Creating a dedicated subagent keeps the main conversation lightweight and focused.
The contributed example assumes a Windows-style host layout <appDataDir>\config\plugins\; it is not a universal Codex/Claude plugin path. For a subagent to be properly registered and invokable, it needs to be inside a plugin's agents/ directory with a valid plugin.json. Getting this structure right manually is tedious and error-prone. This skill automates the entire process so the user can go from "I want an agent that reviews code" to a reviewable agent package. Activation requires host-specific schema validation and an actual invocation check.
Confirm the user's target host and its supported schema/path first. Codex and Claude distribution remain intentionally blocked in this skill's metadata until compatible packaging is validated. Do not remove these blocks merely because a folder can be created. The legacy example layout is:
<appDataDir>\config\plugins\<plugin-name>\If the user wants the agent inside an existing plugin, add the agent folder to that plugin's agents/ directory. If no plugin is specified, create a new plugin named <agent-name>-plugin.
Before creating any path, validate both <agent-name> and <plugin-name>:
^[a-z0-9]+(-[a-z0-9]+)*$/, \, ., .., absolute paths, whitespace, shell metacharacters, and YAML metacharacters<appDataDir>\config\plugins\Use information already supplied, make routine reversible drafting choices, and ask only for material missing host, purpose or placement requirements. Creating a persona does not grant permission to spawn agents or modify global host configuration.
Ask the user these questions one at a time (use the ask_question tool where appropriate, or ask conversationally if the flow is natural):
code-reviewer, sql-expert, test-writer)<appDataDir>\config\plugins\<agent-name>-pluginthis agent? (Create only when requested)
This is the most important step. The user might give you a one-liner like "for reviewing code" — your job is to expand that into a rich, detailed persona that makes the agent genuinely excellent at its job.
A good persona includes:
For example, if the user says "for reviewing code", generate a persona like:
Act as a careful code reviewer working across multiple languages and paradigms. You approach every review with three priorities: correctness first, maintainability second, performance third. You never approve code you haven't fully understood. You flag security vulnerabilities with high urgency. You distinguish between blocking issues (must fix), suggestions (should consider), and nitpicks (style preference). You provide concrete fix suggestions, not just problem descriptions. You check for edge cases, error handling, resource leaks, and race conditions. You respect the codebase's existing patterns unless they are actively harmful.
Create the following structure:
plugins/<plugin-name>/
├── plugin.json
├── agents/
│ └── <agent-name>.md
└── skills/ (only i~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.