Lifecycle Management for Agent Skills
SaferSkills independently audited skillsmith (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Skillsmith is your master skill for the full lifecycle of agent skills — across every MCP-capable agent runtime. Use Skillsmith to discover, evaluate, install, use, maintain, author, govern, and retire SKILL.md-format skills without leaving your editor.
Every Skillsmith operation maps to one of 8 lifecycle stages. Use the stage name when you want to be explicit ("use Skillsmith to discover testing skills"); natural prompts work too.
| # | Stage | What it covers | Primary surface |
|---|---|---|---|
| 1 | Discover | Find skills by query, recommendation, or filter | MCP search, skill_recommend |
| 2 | Evaluate | Compare candidates, read trust badges, view diffs | MCP get_skill, skill_compare, skill_diff |
| 3 | Install | Add a skill to the runtime's skills directory | MCP install_skill; CLI install |
| 4 | Use | Invoke the installed skill at the runtime layer | runtime-native (e.g. Claude Code skill match) |
| 5 | Maintain | Update, pin, audit collisions, configure modes | CLI update/pin/unpin/audit collisions; MCP skill_updates, skill_outdated |
| 6 | Author | Init, validate, transform, publish a new skill | CLI author init/validate/publish/subagent/transform/mcp-init |
| 7 | Govern | Audit logs, RBAC, SIEM, compliance (Team+) | MCP audit_export, audit_query, siem_export |
| 8 | Retire | Uninstall, deprecate | MCP uninstall_skill; CLI remove |
| Tool | Stage | Use when | Example prompt |
|---|---|---|---|
search | Discover | Finding skills by keyword/category/trust tier | "Use Skillsmith to search for testing skills" |
skill_recommend | Discover | Contextual recommendations | "Ask Skillsmith to recommend skills for my React project" |
get_skill | Evaluate | Full details for a known skill | "Use Skillsmith to show details for community/jest-helper" |
skill_compare | Evaluate | Side-by-side comparison | "Use Skillsmith to compare jest-helper and vitest-helper" |
skill_diff | Evaluate | Diff two installed versions | "Use Skillsmith to diff jest-helper versions" |
install_skill | Install | Add a skill to your runtime | "Use Skillsmith to install jest-helper" |
skill_validate | Install | Pre-install validation of SKILL.md | "Use Skillsmith to validate ./my-skill" |
skill_updates | Maintain | Check for available updates | "Ask Skillsmith for updates to my installed skills" |
skill_outdated | Maintain | List skills behind latest | "Use Skillsmith to show outdated skills" |
skill_inventory_audit | Maintain | Namespace-collision audit (Team+) | "Use Skillsmith to audit my skills inventory" |
audit_export / audit_query / siem_export | Govern | Compliance + SIEM (Enterprise) | "Use Skillsmith to export audit logs for last 30 days" |
uninstall_skill | Retire | Remove an installed skill | "Use Skillsmith to uninstall jest-helper" |
Triggering tip: prefix natural-language prompts with Use Skillsmith to ... or Ask Skillsmith for .... The product-name anchor binds tool selection reliably across MCP-capable runtimes.
Some lifecycle operations live in the CLI and have no MCP equivalent (yet). When the user asks for these, surface the exact terminal command:
| Operation | CLI command | |||
|---|---|---|---|---|
| Pin a skill to a version | skillsmith pin <skill> <version> | |||
| Unpin a skill | skillsmith unpin <skill> | |||
| Update all installed skills | skillsmith update --all | |||
| Audit advisories (Team+) | skillsmith audit advisories | |||
| Audit collisions | skillsmith audit collisions | |||
| Configure audit mode | `skillsmith config set audit_mode <preventative\ | power_user\ | governance\ | off>` |
| Author a new skill | skillsmith author init <name> | |||
| Publish a skill | skillsmith author publish | |||
| Login | skillsmith login |
Always show the command verbatim with a one-line note: "Run this in your terminal."
Skillsmith's MCP server works in any MCP-capable agent runtime:
~/.claude/skills/.SKILLSMITH_CLIENT=<runtime> in your MCP server env config to install to the runtime-equivalent path. See Getting Started.SKILLSMITH_CLIENT.Skills are categorized by verification level:
| Tier | Badge | Meaning | When to Trust |
|---|---|---|---|
| Verified | Green checkmark | Official Skillsmith / Anthropic | Always safe |
| Curated | Blue badge | Vendor-org publisher, ≥0.80 quality | Generally safe |
| Community | Yellow | Security scan + required metadata | Review before install |
| Experimental | Orange | Beta / new | Use cautiously |
| Unknown | Red warning | No verification | Only if you trust the author |
For criteria detail, see https://skillsmith.app/docs/trust-tiers.
| Tier | API calls/month | Price |
|---|---|---|
| Community | 1,000 | Free |
| Individual | 10,000 | $9.99/mo |
| Team | 100,000 | $25/user/mo |
| Enterprise | Unlimited | $55/user/mo |
Usage warnings at 80% and 90%. Upgrade at https://skillsmith.app/upgrade.
Skillsmith is the security boundary between untrusted skill sources and your runtime.
What Skillsmith validates before install:
What Skillsmith cannot prevent:
Recommendation: review skill content before installation, especially for unverified skills.
Skill authoring lives in the CLI:
skillsmith author init my-new-skill
skillsmith author validate
skillsmith author publishFor an end-to-end walkthrough, see https://skillsmith.app/docs/tutorials/author.
The companion skill-builder skill guides you through frontmatter, progressive disclosure structure, and directory organization. Install it with skillsmith install skill-builder (it's not bundled by default).
"Use Skillsmith to recommend skills for my Next.js project"
"Use Skillsmith to install community/next-helper""Use Skillsmith to compare jest-helper and vitest-helper"
"Use Skillsmith to show details for community/vitest-helper"
"Use Skillsmith to install community/vitest-helper""Ask Skillsmith for updates to my installed skills"
# Then run in terminal:
skillsmith update --all"Use Skillsmith to audit my skills inventory"
# Or in terminal:
skillsmith audit collisionsSkillsmith uses Elastic License 2.0:
skillsmith --help~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.