aa-bundler-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aa-bundler-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create lightweight aa-* / aaa-* bundle entry skills and optionally localize skill descriptions to Chinese, so installed skills are easier to discover and call.
This skill is an installation, organization, and optional localization helper. It should run after skills are installed, when the user asks to organize skills installed earlier, or when the user asks to translate/localize skill descriptions. It must not replace, move, rename, or merge the original skills.
aa-bundler-skill is the organizer. It uses the aaa- prefix to sort at the very top of skill lists.aa- prefix so they sort near the top of skill lists.SKILL.md.aa-* bundle skills unless the user explicitly asks.name, folder names, headings, display_name, and displayName in their original form unless the user explicitly asks to rename titles.SKILL.md description, metadata.short-description, agents/openai.yaml short_description, and plugin shortDescription / longDescription.Run this skill when the user asks to:
Do not run this skill just because a normal task might use a skill. For example, do not run it for "fix this bug", "build a page", "analyze this data", or "open the browser" unless the user is asking to organize skills.
description and body keywords to group by functional domain. Skills like tdd, test-driven-development, diagnose, and systematic-debugging will be grouped under "Engineering Discipline" even if they came from different install sources.SKILL.md files under the relevant skill roots.name, description, and optional metadata.short-description.agents/openai.yaml and plugin .codex-plugin/plugin.json only when they exist or when localizing UI metadata.references/grouping-rules.md for detailed rules per strategy.figma-create-new-file to have been run first if no existing fileKey is available."aa-* bundle skill per meaningful group.aa-* bundles to detect:Report these findings separately in the final output.
aa-* bundles were created or updatedUse this when the user just installed one or more skills.
If an install-before snapshot exists in the conversation or workspace, compare it with the current scan. If no snapshot exists, infer the newest batch from directory creation time, common source, and timestamp closeness.
Use this when the user asks to organize skills installed earlier.
Scan existing skills and create bundles for meaningful historical groups. Skip groups that already have aa-* bundles unless the user asks to refresh them. On subsequent backfill runs, use the incremental scan timestamp to skip unchanged directories.
Use this when the user explicitly asks to translate, localize, or Chinese-ify skill entries. This mode implies the user already wants localization, so skip the ask step.
Default behavior:
display_name, displayName, name, headings, and folder names stay original.agents/openai.yaml exists, update only short_description by default.agents/openai.yaml, do not create one just to translate the title. Create one only when the UI needs a translated short_description and preserving the title is possible..codex-plugin/plugin.json exists, keep interface.displayName unchanged and translate description, interface.shortDescription, and interface.longDescription when they are likely to appear in UI.aa-* bundles, use the aa- prefix in the technical skill name for sorting. Put Chinese explanations in the body and description, not by renaming the title.When localizing plugin caches, prefer active plugin cache roots over marketplace or temporary candidate caches. Do not bulk-translate uninstalled marketplace candidates unless the user explicitly asks.
After any bundle or localization update, run a fresh structural validation:
SKILL.md frontmatter as YAML.name and description fields still exist.agents/openai.yaml as YAML and confirm interface.display_name and interface.short_description exist.display_name and plugin displayName should not contain Chinese unless the user explicitly requested title localization.description, metadata.short-description, short_description, shortDescription, and longDescription..codex-plugin/plugin.json as JSON.agents/ folder.aa-* bundles, verify referenced child skill names exist..agents, and plugin caches.Read only the references needed for the current task:
references/grouping-rules.md: use when deciding which skills belong in the same generated bundle. Updated with semantic grouping rules and minimum threshold.references/chinese-copy-rules.md: use when generating or updating Chinese descriptions, aliases, trigger phrases, or UI metadata.references/bundle-template.md: use when writing a generated aa-* bundle SKILL.md. Updated with constraint/dependency section.aa-* bundles may be created or updated.After creating or updating bundles, report:
aa-* bundles were created or updated~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.