skill-forge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-forge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Orchestrates this repo's own tooling to add a correct, well-formed skill: it scaffolds the folder, fills the frontmatter against the three-axis taxonomy, validates it, regenerates the README index, and registers it in the marketplace manifest. It is the meta skill that lets the marketplace extend itself.
validate_frontmatter.py and you need to bring it to spec.Run all commands from the repo root. The heavy lifting lives in the repo's root scripts/ — this skill drives them; it does not reimplement them.
name and taxonomy values you pass):
python scripts/new_skill.py <name> \
--category "Data & Analysis" --lifecycle Plan --domain Finance \
--description "Does X. Use when Y."<name> must be kebab-case, equal the folder name, and not contain claude/anthropic.
skills/<name>/SKILL.md following template/SKILL.mdand the three-axis taxonomy in docs/taxonomy.md. Keep the body order: Title → What this does → When to use it → How to use it (numbered) → Inputs → Output → Notes & constraints. Keep it tight (< ~250 lines); push detail into references/, deterministic steps into scripts/, templates into assets/. See references/authoring-rules.md for the full self-check.
references/, scripts/, assets/) and linkthem from the body with forward-slash relative paths. Scripts must run on stock Python 3 or guard optional imports with a clear pip install message; no destructive actions or hidden network calls.
python scripts/validate_frontmatter.py — confirm the newskill prints OK. Fix any reported errors and re-run.
python scripts/gen_index.py — regenerates the three READMEtables and the skill count from frontmatter.
.claude-plugin/marketplace.json under the correctplugin's skill list so it ships in the marketplace.
confirm validate_frontmatter.py exits 0 and gen_index.py --check is up to date.
name equals the folder name, kebab-case, ≤ 64 chars, no claude/anthropic.description is one line, third person, ≤ 1024 chars, and **must contain a"when to use" trigger** (write Use when …).
metadata.category / lifecycle / domain must each be an exact value fromdocs/taxonomy.md (and scripts/_skilllib.py TAXONOMY).
metadata.version is semver (start at 1.0.0); license: MIT.Claude only reads the description to decide whether to load a skill, then the body, then bundles on demand. So: make the description specific with a real trigger; keep the body focused on how to drive the skill; and move reference material, runnable logic, and templates into bundles rather than inlining them.
skills/<name>/ with a spec-valid SKILL.md (+ optional bundles)..claude-plugin/marketplace.json.validate_frontmatter.py and gen_index.py.docs/taxonomy.md and theTAXONOMY map in scripts/_skilllib.py, then open a PR — don't invent values.
scripts/new_skill.py, validate_frontmatter.py, andgen_index.py; do not duplicate their logic inside a skill.
Server:tool.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.