skill-creator-pro — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator-pro (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create production-grade skills that extend Claude's capabilities.
User: "Create a skill for X"
↓
Claude Code uses this meta-skill as guidance
↓
Follow Domain Discovery → Ask user clarifying questions → Create skill
↓
Generated skill with embedded domain expertiseThis skill provides guidance and structure for creating skills. Claude Code:
Key Principle: Users want domain expertise IN the skill. They may not BE domain experts.
Proactively research the domain before asking anything:
| Discover | How | Example: "Kafka integration" |
|---|---|---|
| Core concepts | Official docs, Context7 | Producers, consumers, topics, partitions |
| Standards/compliance | Search "[domain] standards" | Kafka security, exactly-once semantics |
| Best practices | Search "[domain] best practices 2025" | Partitioning strategies, consumer groups |
| Anti-patterns | Search "[domain] common mistakes" | Too many partitions, no monitoring |
| Security | Search "[domain] security" | SASL, SSL, ACLs, encryption |
| Ecosystem | Search "[domain] ecosystem tools" | Confluent, Schema Registry, Connect |
Sources priority: Official docs → Library docs (Context7) → GitHub → Community → WebSearch
Before asking user anything, verify internally:
- [ ] Core concepts understood?
- [ ] Best practices identified?
- [ ] Anti-patterns known?
- [ ] Security considerations covered?
- [ ] Official sources found?
If ANY gap → Research more (don't ask user for domain knowledge)
Only if CANNOT discover (proprietary/internal) → Ask userOnly ask about user's SPECIFIC context:
| Ask | Don't Ask |
|---|---|
| "What's YOUR use case?" | "What is Kafka?" |
| "What's YOUR tech stack?" | "What options exist?" |
| "Any existing resources?" | "How does it work?" |
| "Specific constraints?" | "What are best practices?" |
The skill contains domain expertise. User provides requirements.
Ask about SKILL METADATA and USER REQUIREMENTS (not domain knowledge):
1. Skill Type - "What type of skill?"
| Type | Purpose | Example |
|---|---|---|
| Builder | Create artifacts | Widgets, code, documents |
| Guide | Provide instructions | How-to, tutorials |
| Automation | Execute workflows | File processing, deployments |
| Analyzer | Extract insights | Code review, data analysis |
| Validator | Enforce quality | Compliance checks, scoring |
2. Domain - "What domain or technology?"
3. Use Case - "What's YOUR specific use case?"
4. Tech Stack - "What's YOUR environment?"
5. Existing Resources - "Any scripts, templates, configs to include?"
6. Constraints - "Any specific requirements or limitations?"
Skills must handle VARIATIONS, not single requirements:
❌ Bad: "Create bar chart with sales data using Recharts"
✅ Good: "Create visualizations - adaptable to data shape, chart type, library"
❌ Bad: "Deploy to AWS EKS with Helm"
✅ Good: "Deploy applications - adaptable to platform, orchestration, environment"Identify what VARIES vs what's CONSTANT in the domain. See references/reusability-patterns.md.
Context window is a public good (~1,500+ tokens per skill activation). Challenge each piece:
Prefer concise examples over verbose explanations.
Match specificity to task fragility:
| Freedom Level | When to Use | Example |
|---|---|---|
| High | Multiple approaches valid | "Choose your preferred style" |
| Medium | Preferred pattern exists | Pseudocode with parameters |
| Low | Operations are fragile | Exact scripts, few parameters |
Three-level loading system:
Generated skills are zero-shot domain experts with embedded knowledge.
skill-name/
├── SKILL.md (required)
│ ├── YAML frontmatter (name, description, allowed-tools?, model?)
│ └── Procedural knowledge (workflows, steps, decision trees)
└── Bundled Resources
├── references/ - Domain expertise (structure based on domain needs)
├── scripts/ - Executable code (tested, reliable)
└── assets/ - Templates, boilerplate, images| Component | Requirement |
|---|---|
| Line count | <500 lines (extract to references/) |
| Frontmatter | See references/skill-patterns.md for complete spec |
name | Lowercase, numbers, hyphens; ≤64 chars; match directory |
description | [What] + [When]; ≤1024 chars; third-person style |
| Description style | "This skill should be used when..." (not "Use when...") |
| Form | Imperative ("Do X" not "You should X") |
| Scope | What it does AND does not do |
Embed domain knowledge gathered during discovery:
| Gathered Knowledge | Purpose in Skill |
|---|---|
| Library/API documentation | Enable correct implementation |
| Best practices | Guide quality decisions |
| Code examples | Provide reference patterns |
| Anti-patterns | Prevent common mistakes |
| Domain-specific details | Support edge cases |
Structure references/ based on what the domain needs.
Large files: If references >10k words, include grep search patterns in SKILL.md for efficient discovery.
Generate scripts when domain requires deterministic, executable procedures:
| Domain Need | Example Scripts |
|---|---|
| Setup/installation | Install dependencies, initialize project |
| Processing | Transform data, process files |
| Validation | Check compliance, verify output |
| Deployment | Deploy services, configure infrastructure |
Decision: If procedure is complex, error-prone, or needs to be exactly repeatable → create script. Otherwise → document in SKILL.md or references/.
Generate assets when domain requires exact templates or boilerplate:
| Domain Need | Example Assets |
|---|---|
| Starting templates | HTML boilerplate, component scaffolds |
| Configuration files | Config templates, schema definitions |
| Code boilerplate | Base classes, starter code |
User invokes skill → Gather context from:
1. Codebase (if existing project)
2. Conversation (user's requirements)
3. Own references/ (embedded domain expertise)
4. User-specific guidelines
→ Ensure all information gathered → Implement ZERO-SHOTEvery generated skill should include:
## Before Implementation
Gather context to ensure successful implementation:
| Source | Gather |
|--------|--------|
| **Codebase** | Existing structure, patterns, conventions to integrate with |
| **Conversation** | User's specific requirements, constraints, preferences |
| **Skill References** | Domain patterns from `references/` (library docs, best practices, examples) |
| **User Guidelines** | Project-specific conventions, team standards |
Ensure all required context is gathered before implementing.
Only ask user for THEIR specific requirements (domain expertise is in this skill).After determining skill type, follow type-specific patterns:
| Type | Key Sections | Reference |
|---|---|---|
| Builder | Clarifications → Output Spec → Standards → Checklist | skill-patterns.md#builder |
| Guide | Workflow → Examples → Official Docs | skill-patterns.md#guide |
| Automation | Scripts → Dependencies → Error Handling | skill-patterns.md#automation |
| Analyzer | Scope → Criteria → Output Format | skill-patterns.md#analyzer |
| Validator | Criteria → Scoring → Thresholds → Remediation | skill-patterns.md#validator |
Metadata → Discovery → Requirements → Analyze → Embed → Structure → Implement → ValidateSee references/creation-workflow.md for detailed steps.
references/scripts/package_skill.py and test---
name: skill-name # lowercase, hyphens, ≤64 chars
description: | # ≤1024 chars
[What] Capability statement.
[When] Use when users ask to <triggers>.
allowed-tools: Read, Grep, Glob # optional: restrict tools
---See references/skill-patterns.md for complete frontmatter spec and body patterns.
Before delivering a skill, verify:
name: lowercase, hyphens, ≤64 chars, matches directorydescription: [What]+[When], ≤1024 chars, clear triggersallowed-tools: Set if restricted access neededreferences/ (structured per domain needs)references/skill-patterns.md)| File | When to Read |
|---|---|
references/creation-workflow.md | Detailed step-by-step creation process |
references/skill-patterns.md | Frontmatter spec, type-specific patterns, assets guidance |
references/reusability-patterns.md | Procedural+domain knowledge, varies vs constant |
references/quality-patterns.md | Clarifications, enforcement, checklists |
references/technical-patterns.md | Error handling, security, dependencies |
references/workflows.md | Sequential and conditional workflow patterns |
references/output-patterns.md | Template and example patterns |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.