maestro-skill-author — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited maestro-skill-author (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every built-in skill is a directory under skills/built-in/:
skills/built-in/maestro%3A{name}/
SKILL.md (required -- frontmatter + content)
reference/ (optional)
{file}.md (reference documents)
steps/ (for multi-step skills)
step-01-{name}.md
step-02-{name}.mdThe directory name is the URL-escaped skill slug. For built-in maestro:* skills, replace : with %3A on disk while keeping the frontmatter name unchanged.
---
name: maestro:{slug}
description: "When to trigger and what this skill does. Be specific about contexts."
argument-hint: "<track description>"
---| Field | Required | Notes |
|---|---|---|
name | Yes | Must match the logical skill slug; the on-disk directory uses %3A instead of : |
description | Yes | Primary trigger mechanism -- be specific about when to use |
argument-hint | No | Shown in skill-list output. Bracket notation, not camelCase. |
Frontmatter rules:
--- on their own lines (lines 1 and 3+)key: value pairs only -- no multiline values"value" and 'value' both work)name or description causes the skill to be skipped during buildThe body after frontmatter is pure markdown. Structure it for the agent that will read it:
# {Skill Name}
## Overview
One-paragraph purpose and when to use.
## When to Use / When NOT to Use
Explicit trigger conditions.
## The Workflow / Steps
Numbered actions the agent should follow.
## Key Principles / Rules
Concise behavioral constraints.Description writing: The description is how Claude decides whether to load the skill. Make it "pushy" -- include specific trigger phrases, file patterns, and contexts. A generic description means the skill never triggers.
Reference files provide deeper content loaded on demand. They keep SKILL.md under 500 lines while giving the skill access to unlimited reference material.
reference/
interview-guide.md -- Question banks, decision trees
templates.md -- Code or document templates
checklist.md -- Verification checklistsLoad from SKILL.md: "Read reference/interview-guide.md and follow its question sequence."
For skills with sequential workflows (like maestro:design with 16 steps):
reference/steps/
step-01-init.md
step-02-classify.md
step-03-vision.md
...Each step file follows this template:
# Step N: {Title}
**Progress: Step N of {total}** -- Next: {Next Step Title}
### Goal
{One-sentence objective for this step}
### Execution
1. {Action}
2. {Action}
3. {Action}
### Next Step
Read and follow `reference/steps/step-{N+1}-{name}.md`.Step file rules:
References can be nested (e.g., reference/codex-skills/land/SKILL.md). The build system handles recursive embedding. Path keys in the generated registry use forward slashes: codex-skills/land/SKILL.md.
When you run bun run build, the generator (src/skills/generate.ts) processes all skills:
skills/built-in/maestro%3A*/SKILL.mdreference/src/skills/registry.generated.ts (~320KB)The generated file embeds:
Record<string, string> mapAfter any skill change, you must rebuild:
bun run buildIf you skip the rebuild, the MCP server and CLI will serve stale skill content.
| Convention | Example | Notes |
|---|---|---|
| Directory name | maestro%3Adesign | URL-escaped on-disk path |
| Slug in code | 'maestro:design' | String key in registry |
| CLI usage | maestro skill maestro:design | User-facing |
For renamed skills, add aliases in src/skills/aliases.ts:
export const SKILL_ALIASES: Record<string, string> = {
'brainstorming': 'maestro:brainstorming',
'systematic-debugging': 'maestro:debugging',
// old name -> new name
};When a user loads an aliased name, they get the skill with a deprecation warning.
To deprecate a skill, add it to DEPRECATED_SKILLS in the registry:
const DEPRECATED_SKILLS = new Map<string, string>([
['maestro:symphony-setup', 'Use `maestro symphony install` instead.'],
]);Deprecated skills still load but prepend a warning banner.
Users can also create skills outside the built-in directory. Discovery priority (highest first):
skills/external/ -- source: 'external'.maestro/skills/ -- source: 'maestro'.claude/skills/ -- source: 'claude''builtin'External skills use the same directory layout (SKILL.md + reference/) but are loaded from the filesystem at runtime, not embedded at build time.
After creating or modifying a skill:
name in frontmatter matches directory slug exactlydescription is present and specific enough to trigger correctlyargument-hint uses bracket notation (not camelCase)bun run build succeeds without warningsmaestro skill-list shows the skill with correct metadatamaestro skill {name} returns the full contentmaestro skill {name} --ref {path} loads reference files correctly~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.