create-project-skills-ec642b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-project-skills-ec642b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generates one skill per detected convention area in the project's skill directory so future Claude or Codex sessions auto-load them when working in the repo.
At the start, use TaskCreate to create a task for each phase:
/create-skill skillIf $ARGUMENTS specifies paths, scope the scan to those paths; otherwise scan the whole repository.
Build the extraction context:
package.json, Cargo.toml, pyproject.toml, go.mod, Package.swift, pom.xml, Gemfile, and others appropriate to the stack).CLAUDE.md, .claude/rules/, AGENTS.md, and any .cursor/rules or .cursorrules. Note the conventions already documented there. The generated skills must not duplicate them..claude/skills/ (Claude Code), .agents/skills/ (Codex), and a top-level skills/ directory (match case-insensitively so Skills/ or similar non-standard casing is detected too). Resolve symlinks so co-linked paths are treated as one logical location.AskUserQuestion to confirm where generated skills should live. List each distinct resolved location as an option, noting any symlink alias in the option description. If .claude/skills/ is not among the detected locations, include it as a default option. The auto-added "Other" option lets users specify a custom path such as a project-specific directory.## section heading from the body. These signals feed rename-conflict detection in Step 3.Output a short text summary of detected stack, top-level layout, chosen target directory, and existing skills before moving on.
When that summary shows no source code to extract conventions from, stop here rather than dispatching Step 2. Executable code in any language qualifies, including scripts no manifest declares, so judge from the directory map rather than the detected stack. Documentation, instruction files, and configuration alone do not: extraction run over prose returns that prose's assertions as observed conventions, and Step 3 scores them with no code sites to test them against.
State that as text first — what the survey found, and that conventions extracted from it would have nothing to verify against. Then use AskUserQuestion to offer:
On the first option, run the /create-skill skill directly on that knowledge and skip the remaining steps. On either of the first two, mark the extraction phases cancelled so they no longer read as pending work.
Read references/pattern-extractor.md to see the full taxonomy of pattern categories. Decide which categories apply to the detected stack (e.g., drop "Styling and UI" for a backend service, drop "State management" for a static-analysis tool).
Emit all extraction Agent tool calls below in one assistant message. Each Agent call uses model: "opus" and no name. Wait for every agent to report before continuing. Do not begin the next step on a partial set, and do not relaunch an agent that has not yet reported. Launch one Agent per applicable category and state the total count explicitly when emitting the calls. Every agent's prompt must direct it to treat the shared working tree and its git index as read-only and to extract by reading and reasoning. Every agent's prompt must also direct it to search the repository with a tool that skips gitignored files, such as git grep --untracked or the Grep tool, and to open or search a gitignored path only when its prompt or a file its prompt directs it to read names it, or when a dependency's installed source is needed to verify a claim, never one holding local configuration or credentials. HEAD stays where it is: read other refs with git show <ref>:<path> rather than git checkout or git switch. Each agent's prompt must:
CLAUDE.md and .claude/rules/ so duplicates are skippedAggregate findings from all agents. For each finding, score three axes:
Group the surviving findings by topic into candidate skills. Each candidate typically covers one category, but related categories may merge if the patterns are tightly coupled. Split a candidate into two skills if its patterns cover clearly distinct sub-topics.
For each candidate skill, produce:
name (kebab-case, narrow to the topic, e.g., swift-naming, react-state, api-clients)file:line)If rename-conflict detection is ambiguous from the Step 1 signals alone, read the existing skill's SKILL.md body and compare convention statements before finalizing the Status tag.
Output the full proposal as text first, not inside AskUserQuestion. For each candidate skill, show:
After all candidates are listed, use AskUserQuestion to confirm the proposal with these options: "Approve all", "Make edits", "Cancel". If the user selects "Make edits", continue in conversation so the user can specify which candidates to drop, merge, or rename before returning here.
For each Rename conflict candidate, use a separate AskUserQuestion asking whether to update the existing skill, create the new one alongside it, or skip. Add a Get a second opinion option as a fourth choice, since creating alongside always establishes a second skill covering the same conventions. It runs the /consult-codex skill for which resolution leaves the skill set coherent. Then resolve the conflict with that answer in hand, re-asking when the choice stays the user's.
/create-skill SkillBuild the batch from approved candidates only. Do not include anything not explicitly approved in Step 4.
Output all approved candidates (both New and Update status) as text in a single batch. For each candidate, list the Status tag, proposed name, description, target path <target-skill-directory>/<name>/SKILL.md, and the 3–8 convention statements organized under ## <Section> headings with inline evidence citations (file_path:line). These convention statements define the target state the final SKILL.md should match, regardless of whether the skill is being created or updated.
This gives /create-skill everything it needs to skip its Step 1 (usage patterns clearly understood) and Step 2 (project skills typically need no additional reusable resources). For Update candidates, /create-skill also skips its Step 3 (initialization) per its own "skill already exists, iteration needed" skip rule and iterates on the existing SKILL.md in Step 4 until it matches the target convention statements.
Run the /create-skill skill once with this batch in context. Its batch-aware review, evaluation, and apply cycle then runs across all touched skills.
After /create-skill completes, output a summary of created and updated skills, grouped by status. If any candidates were dropped or skipped in Step 4, list them so the user knows what was left out.
CLAUDE.md or .claude/rules/. Reference them instead if needed.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.