improve-self — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited improve-self (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill turns the trace of just-completed work into a question: was there a procedure I should have had written down? When the answer is yes, it scaffolds a candidate Agent Skill into the current project — with the human approving every write.
The discipline is conservative by design. A skill created for a one-off question becomes long-term noise in the activation context of every future task. A skill created without checking existing skills becomes a duplicate and a confusion vector. A skill encoding version-specific or transient behavior becomes a permanent footgun. The bar for creation: a concrete, recurring, procedural gap that survived a check against every existing skill, with the user signing off on the draft.
Script paths are resolved relative to this SKILL.md, not the agent's CWD. If a relative command (for example python3 scripts/discover_skills.py) fails to resolve, prefix it with the directory the platform loaded SKILL.md from.
Fallback. If python3 is missing or the script cannot be located, every procedure here ships a manual alternative — follow that instead.
A gap is procedural and recurring. Not every difficulty is a gap.
| Pattern in the trace | Skill-shaped? |
|---|---|
| The agent repeated the same 3-step lookup three times in one task | Yes |
| The agent figured out a non-obvious investigation workflow from scratch and it worked | Yes |
| The agent recovered from an error by inventing a procedure that should be reusable | Yes |
| The user corrected the agent's approach with "no, here we always do X first" | Yes |
| The agent realized mid-task it lacked a playbook other agents would also face | Yes |
| The agent did not know a fact ("what is the Kafka default port?") | No — research gap, not skill gap |
| The agent failed once and recovered easily | No — one-off, not recurring |
| The task was complex but succeeded smoothly | No — complexity ≠ missing procedure |
| The agent had to consult unfamiliar library docs | No — that is what research-it is for |
| The task succeeded without struggle | No — nothing to fix |
Decision rule: would the agent copy this procedure from memory next time, verbatim? If yes, write it down. If no, it is not a skill.
Self-assessment runs at the end of a task when at least one of these signals is observable in the trace. The signals are concrete; the agent does not need to guess.
.{vendor}/skills/ directories that actually exist on this host (resolved in Phase 2 Step A). Phrasing in the agent's own reasoning like "I had to discover that …" or "it would help to have a documented procedure for …" is the marker.If none of these fire, do not run self-assessment. False-positive gaps create churn in the skill library.
Write down, internally:
If the procedure runs to more than ten numbered steps before any branching, the gap is too broad. Split it into the narrowest reusable subprocedure. Monolithic skills do not activate precisely (see make-skill anti-patterns).
Restate the gap as a single sentence that names the procedural domain. Good: "investigation procedure for verifying Postgres MVCC behavior across major versions." Bad: "Postgres stuff." The narrower phrasing is also the working draft of the new skill's description.
Phase 2 is mandatory. Discovery is two steps so the agent only consults the vendor prefixes it actually reads at runtime — not every .{name}/skills/ directory that happens to exist on the filesystem.
Step A — Identify the vendor directories THIS agent reads from. Use references/platform-vendors.md to resolve the comma-separated --vendors list. It holds the running-agent → vendor mapping, a filesystem-probe fallback for when self-identification fails, and the empty-result rule (skip Step B and treat as "no existing skills to deduplicate against").
Step B — Hand the resolved list to the discovery script. Save it into a variable for the script call:
vendors=<comma-separated names from Step A>
python3 scripts/discover_skills.py --vendors "$vendors"--vendors is mandatory; unknown names exit 2 with the accepted set listed so the agent can self-correct.
Default output is XML, one <skill> element per skill, with <name>, <category>, <description> in a fixed order. For opt-in fields (--with-type, --with-agent, --with-path), alternative formats (--format json|markdown|csv), ordering, user-vs-project precedence, exit codes, and the no-python3 bash fallback, see references/discover-skills-reference.md.
Read each description. For each, classify against the candidate gap:
| Comparison | Action |
|---|---|
| Exact or near-overlap with an existing skill | Do not create. Either use the existing skill (re-read its body) or propose an edit to its SKILL.md. Surface this to the user. |
| Partial overlap (existing covers half) | Narrow the candidate to the uncovered delta. Re-state the gap. Loop back to Phase 1. |
| No overlap | Proceed to Phase 3. |
If the existing skill is close but stale or wrong, do not silently re-author it as a new skill. Open the original SKILL.md and propose a patch. Duplication is worse than imperfection.
A skill is the right shape only when all four hold:
If any criterion fails, route the gap via references/alternatives-to-a-skill.md. Default to not creating. The cost of a skill — its presence in the activation context forever, its description competing in the model's top-of-context scan — exceeds the benefit unless all four hold.
Use the make-skill skill for the authoring discipline (frontmatter rules, body structure, density). This skill is the gap-detection front end; make-skill is the authoring back end.
Path: $PWD/.{vendor}/skills/{name}/SKILL.md in the current working project directory, never the home folder. Pick {vendor} with this decision order:
.claude/skills/, .opencode/skills/, .gemini/skills/, .github/skills/, …) when the new skill genuinely depends on that vendor's frontmatter extensions — disable-model-invocation, user-invocable, argument-hint, context: fork for Claude; policy.allow_implicit_invocation companion file for Codex; paths-scoped activation for Cursor, etc. Document the dependency in the skill's own description.find . -path '*/skills/improve-self/SKILL.md' -not -path '*/node_modules/*' 2>/dev/null to confirm where it lives — that location reflects the project's stated policy. If found in a vendor-specific directory, prefer the same vendor for the new skill so the library stays coherent..cursor/skills/", do that.NEVER write to $HOME/.{vendor}/skills/ — self-generated skills belong to the project, not the user's global library.
Bootstrap the directory with init_skill.py from make-skill. Then follow the Workflow pattern from make-skill › Phase 4: Body — for gap-driven skills the natural sections are Trigger, Procedure, Validation, Anti-patterns, because they map one-to-one onto Phase 1 trace evidence (trigger signal → Trigger, inverted procedure → Procedure, success criterion → Validation, what went wrong → Anti-patterns).
The procedure must be exact enough that running it would have prevented the original difficulty observed in Phase 1's trace evidence. If not, the gap is not closed — refine before hand-off.
Do not silently install. The agent is its own author, executor, and inspector for self-created skills; without an external checkpoint, deprecated APIs get frozen into procedural memory and transient failures become permanent avoidance. Two checkpoints before the skill counts as installed:
Then ask explicitly whether to write the file. Do not write before the answer is yes.
Use the validate_skill.py script from make-skill to check the new SKILL.md against the style rules.
If the validator returns errors, fix and re-run. Manual fallback when no validator is reachable: frontmatter parses, name matches the directory, description ≤ 1024 chars and third person, body ≤ 500 lines, references one level deep, forward-slash paths only.
The gap is closed when the validator passes and the new SKILL.md sits in the chosen .{vendor}/skills/<name>/ directory under the project root.
These degrade the skill library and erode trust in the self-improvement loop:
sleuth, the typical gap is a narrow source catalogue or bias-detection pattern for one domain — not a skill called "investigating things" (that is what research-it already is).CLAUDE.md or AGENTS.md compressed into an unwieldy skill. Defence: route via references/alternatives-to-a-skill.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.