skill-publishing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-publishing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
How to write a good agent skill and publish it so others (and your other machines) can install it with npx skills.
Reusable, on-demand context for an AI coding agent. One skill = one folder with a SKILL.md:
---
name: my-skill # kebab-case, matches the folder
description: <one line> # the TRIGGER — see below; most important field
metadata:
author: you
version: "1.0.0" # semver; bump on meaningful change
---
# Title
<the body the agent loads only when this skill fires>Context economy: only the description of every installed skill stays in the agent's context. The body loads only when the description matches the task. That's the whole design — so the description does the heavy lifting.
description is the trigger (get this right)Write it as concrete triggers: what it does, then "Use when …" listing symptoms, situations, and phrases a user might actually say.
edge, a cropped shadow, or the page jumps after the keyboard closes.`
Helps with iOS Safari styling.If the agent won't match it to the right moment, the skill is dead weight.
SKILL.md focused; put heavy reference docs orscripts in sibling files and link them so they load only when needed.
useful across situations.
A skill is a directory, not just one file. SKILL.md is the entry point; you can ship reference docs, scripts, templates, and assets next to it:
skills/my-skill/
SKILL.md # entry: frontmatter + concise body
reference/
api.md # deep detail / long tables — read on demand
scripts/
init.sh # a runnable helper the skill invokes
templates/
config.example.json # boilerplate the skill copiesOnly SKILL.md's body loads when the skill fires; everything else loads, reads, or runs only when `SKILL.md` tells the agent to, referenced by relative path. Keep SKILL.md short and high-signal; push heavy material into siblings:
For the full option list, read `reference/api.md`.
Scaffold with `scripts/init.sh <name>`.The CLI installs the whole directory (symlink or --copy), so relative links keep working. Split only when a skill gets large or needs runnable helpers — a small skill is perfectly fine as a single SKILL.md.
skills/<skill-name>/SKILL.md # flat (preferred)
skills/<category>/<skill-name>/SKILL.md # categorised (only if you have enough)
SKILL.md # a single skill at repo root also worksREADME.md = the human index (a table of skills) + SEO. The machine indexis just each skill's description; no separate index file.
AGENTS.md (+ CLAUDE.md symlink) = authoring conventions for the repo..claude-plugin/marketplace.json manifest is optional, only forplugin-marketplace features or non-standard skill paths.
skills CLI (vercel-labs/skills)npx skills init skills/<name> # scaffold a new skill folder + SKILL.md
npx skills add owner/repo # interactive: pick skills + agents
npx skills add owner/repo --list # browse the repo, install nothing
npx skills add owner/repo --skill a b # install specific skills
npx skills add owner/repo --all -g # everything, global (~/.claude/skills)
npx skills add owner/repo --copy # copy instead of symlink into agent dirs
npx skills list # installed skills (-g for global)
npx skills find <keyword> # search
npx skills update [name...] # update
npx skills remove [name...] # remove
npx skills use owner/repo@skill # one-off prompt without installingFlags that matter: -s/--skill, -a/--agent (* = all), -g/--global, -l/--list, -y/--yes (skip prompts), --all. Telemetry is on by default; DISABLE_TELEMETRY=1 to opt out.
git init && git add -A && git commit -m "chore: bootstrap skills repo"
gh repo create owner/skills --public --source=. --push
# SEO: a clear description + topics make it discoverable
gh repo edit owner/skills \
--description "Agent skills for … — install: npx skills add owner/skills" \
--add-topic agent-skills --add-topic claude-skills --add-topic claude-code \
--add-topic skills --add-topic ai-agentsKeep the README's skills table and each description sharp — those are what both humans and npx skills find read.
npx skills add does a plain `git clone` under the hood (defaulting to the HTTPS URL), so:
run gh auth setup-git once so git uses your GitHub login non-interactively; or pass an SSH URL directly: npx skills add [email protected]:owner/repo.git.
public discovery surfaces (skills.sh leaderboard/search) only index public repos. So: private = great for personal/studio use; public = shareable + discoverable.
skills/<kebab-name>/ and name: matches.description reads as triggers ("Use when …"), not marketing.metadata.version set (semver).npx skills add <repo> --list shows it with the right description.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.