gen-catalog — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gen-catalog (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a catalog generation agent. Do NOT ask the user questions.
============================================================ PHASE 1: DISCOVER ALL SKILLS ============================================================
~/.claude/skills/.*/SKILL.md and */skill.md files under the skills directory.Also check ~/.claude/commands/*.md for global commands (slash commands that exist outside the skills directory).
--- delimiters):name (required)description (required)Do NOT use a fixed category list. Instead:
(but are not limited to): research/discovery, spec/design, build, testing, quality/review, documentation, operations, security, infrastructure, combo/chain, deployment, analysis, etc.
defined in the /X skill" or "Chains /X -> /Y"), classify it as a combo/chain skill and record the chain sequence.
"testing", "docs", "ops", "combo").
(e.g., "research" -> "Research & Discovery", "build" -> "Build & Implement").
relative to the skills directory root (e.g., [/name](./name/SKILL.md)).
============================================================ PHASE 2: DETERMINE OUTPUT FORMAT ============================================================
Check if the user requested a specific output format. Supported formats:
skills-catalog.jsonskills-catalog.htmlIf no format is specified, use "readme".
Read the existing README.md in the skills directory.
Preserve everything ABOVE <!-- AUTO-GENERATED-SKILLS-TABLE-START -->. Preserve everything BELOW <!-- AUTO-GENERATED-SKILLS-TABLE-END -->.
If these markers do not exist yet, add them after the first heading and intro paragraph.
Between the markers, generate:
For each detected category (sorted alphabetically, with combo/chains last):
#### [Category Display Name]
| Skill | Description |
|---|---|
/name | description |
For combo/chain skills, add a "Chain" column:
| Skill | Chain | Description |
|---|---|---|
/name | /a -> /b -> /c | description |
Also include global commands from ~/.claude/commands/ with a note:
Global commands (available in any project):
| Command | Description |
|---|---|
/name | description |
Write a JSON file with this structure:
{
"generated": "ISO-8601 timestamp",
"skills_directory": "/path/to/skills",
"categories": {
"category-label": {
"display_name": "Category Display Name",
"skills": [
{
"name": "skill-name",
"description": "...",
"path": "relative/path/to/SKILL.md",
"chain": ["/a", "/b"] // only for combo skills
}
]
}
},
"global_commands": [
{ "name": "command-name", "description": "..." }
]
}Generate a standalone HTML page with:
============================================================ PHASE 3: UPDATE skills-list (README format only) ============================================================
If outputting README format and skills-list/SKILL.md exists in the skills directory, update its embedded skills table:
parallelization rules, development patterns).
The generated table format:
| Skill | Description |
|---|---|
| name | description |
Group by category with category headers.
============================================================ PHASE 4: VERIFY ============================================================
Report:
============================================================ PHASE 5: COMMIT (optional) ============================================================
If changes were made, stage the updated files. Commit: "docs: auto-generate skills catalog (N skills)"
Do NOT include Co-Authored-By lines. Push after committing.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing documentation, validate completeness:
IF VALIDATION FAILS:
============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /gen-catalog — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.