create-skill-proxy-en — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-skill-proxy-en (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creates a local <n>-proxy skill that wraps a remote Agent Skill.
The creator of the 'Skill Proxy' is not liable for any damages arising from the use of this 'Skill Proxy'. The risk and responsibility lies exclusively with the user who uses this 'Skill Proxy'. If the 'Skill Proxy' user is an agent, then the user who is responsible for that agent bears the responsibility.
The proxy pins the remote skill to a specific commit hash and SHA-256 checksum. Every time the agent activates the proxy, it fetches the remote SKILL.md and verifies the checksum before following any instructions. If the checksum does not match, the agent stops and alerts the user.
This follows the Page Object Pattern — the proxy hides where a skill lives while keeping all trusted external skills in one place under your control.
| Parameter | Required | Description |
|---|---|---|
REMOTE_URL | Yes | Any GitHub URL pointing to the remote skill (see URL forms below) |
OUTPUT_DIR | No | Parent directory to write the proxy skill into (default: ./skills) |
All five forms are accepted and translated automatically:
| Input form | Example |
|---|---|
| Repo root | https://github.com/observerw/skill-container |
| Tree root | https://github.com/observerw/skill-container/tree/main |
| Tree path | https://github.com/observerw/skill-container/tree/main/skills/my-skill |
| Blob file | https://github.com/observerw/skill-container/blob/main/SKILL.md |
| Raw URL | https://raw.githubusercontent.com/observerw/skill-container/main/SKILL.md |
uv run scripts/create-proxy.py \
--url "https://github.com/observerw/skill-container" \
--output-dir ./skillsThe script:
references/url-translation.md)SKILL.md content from remote<n>-proxy/SKILL.md with pinned commit URL and checksumskills-ref validate on the generated proxy skill# Re-verify: check if remote content still matches pinned checksum
uv run scripts/verify-proxy.py --proxy ./skills/skill-container-proxy
# Update: re-fetch, re-validate, update commit pin and checksum
uv run scripts/update-proxy.py --proxy ./skills/skill-container-proxyRun verify-proxy.py periodically or in CI to detect upstream changes. Run update-proxy.py only after consciously reviewing the upstream changes.
references/url-translation.md — full URL translation rules and examplesreferences/proxy-format.md — exact format of generated proxy SKILL.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.