skill-forge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-forge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Core responsibility: Create the right files with the right structure for a new Lattice skill.
Input: A description of what the skill should do and when it should trigger.
Output: One or more skill files written to the correct path:
skills/atoms/{name}/SKILL.md + skills/atoms/{name}/references/defaults.mdskills/molecules/{name}/SKILL.mdskills/refiners/{name}/SKILL.md + skills/refiners/{name}/assets/template.mdHow to verify this skill did its job:
name: frontmatter exactlyAsk the user: "What should this skill do, and when should it trigger? Describe it briefly."
From the description, determine the tier:
| The skill... | Tier |
|---|---|
| Enforces ONE principle with a checklist and anti-pattern scan | Atom |
| Orchestrates multiple atoms into a multi-step workflow | Molecule |
Runs a guided interview to produce a .lattice/standards/*.md file | Refiner |
State your read and confirm with the user. Get explicit tier agreement before proceeding.
Before writing a single line of SKILL.md, agree on the design.
Check knowledge-base/ for an existing requirements doc:
ls knowledge-base/ | grep -i {name}If found → read it, summarise key design decisions, confirm they still reflect intent.
If not found → resolve these questions through conversation before writing:
For a molecule:
skills/atoms/ to see what exists.).lattice/? Which subfolder? (Must be a named subfolder, never the root.)For a refiner:
paths.{snake_case_key} config key does it add to .lattice/config.yaml?Write a one-paragraph design summary and confirm with the user.
Do NOT write SKILL.md until design is confirmed.
Read CLAUDE.md — the Skill Conventions section. Always read it fresh; never rely on memory.
Note the current skill counts (atoms/molecules/refiners) — they will need updating in CLAUDE.md after creation, but that is skill-align's job.
`skills/atoms/{name}/SKILL.md` — sections in this exact order:
name (lowercase-hyphenated), description (include trigger phrases).lattice/config.yaml for paths.{config_key}mode: overlay (merge with defaults) or mode: override (replace)./references/defaults.md- [ ] **Name**: what it looks like → fix), minimum 5 items`skills/atoms/{name}/references/defaults.md` — the embedded defaults:
`skills/molecules/{name}/SKILL.md`:
framework:{name} with always/conditional qualifierGenerative molecule conventions (code-forge, bug-fix, refactor-safely pattern):
framework:collaborative-judgmentPlanning/interactive molecule conventions (design-blueprint, requirement-forge pattern):
.lattice/{subfolder}/ — never to .lattice/ root`skills/refiners/{name}/SKILL.md` — cover all of these:
./assets/template.md and its Interview Guidance comments)paths.{key} to .lattice/config.yaml)`skills/refiners/{name}/assets/template.md`:
<!-- INTERVIEW GUIDANCE: --> comments per sectionBefore finishing, verify:
name: frontmatter field (exactly, character by character)description: contains trigger phrases — what a user would actually type to invoke thisdefaults.md exists and has §-numbered sections with real contenttemplate.md exists with Interview Guidance comments in every sectionReport what was created and where. Do not run validation, sync, or deploy — those are separate steps.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.