skillify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skillify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use right after a browse/scrape flow worked and the user wants it reusable — "skillify this", "make this a skill", "save this flow". It writes a new skill in the local repo so future invocations just run /the-new-name.
From the session that just worked, pin down:
$B verbs / chain that worked, in order, with theselectors and the URL (or URL pattern / parameter) used.
If any of these is unclear, ask once with AskUserQuestion. Pick a short kebab-case name.
Find the vibestack repo (the vibe-* binaries are symlinks into it):
REPO="$(cd "$(dirname "$(readlink "${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-config" 2>/dev/null)")/.." 2>/dev/null && pwd || true)"
[ -f "$REPO/install" ] || { echo "REPO_NOT_FOUND"; }If REPO_NOT_FOUND, ask the user where they cloned vibestack.
Write skills/<name>/SKILL.md with: frontmatter (name, one-sentence description, allowed-tools, triggers), a ## When to invoke section, the {{include lib/snippets/browse-setup.md}} directive, the captured $B steps with their selectors, the extraction/return logic, and a closing {{include lib/snippets/capture-learnings.md}}. Match the house style of an existing skill (e.g. skills/scrape/SKILL.md). Keep brand-clean — no external project names.
cd "$REPO"
bin/vibe-render-skill "skills/<name>/SKILL.md" /tmp/_skillify_check.md && echo "RENDER_OK"
# Brand check: the new skill must contain no external project names. Run the
# repo's zero-external-brand audit (see CLAUDE.md) — it must return nothing.
./install --yesConfirm RENDER_OK, zero brand hits, and that install reports the new count.
Tell the user the new /<name> is installed; a new agent session may be needed if the host doesn't hot-reload. Suggest they bump the skill count in the README and docs/skills.md, and /ship the change when ready.
{{include lib/snippets/capture-learnings.md}}
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.