skill-harvest — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-harvest (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A library of skills only compounds if what you learn gets back into it. The default failure is silent: you solve something non-obvious, the session ends, and the lesson dies with the context window. The next agent — maybe you tomorrow — re-learns it from scratch. This skill is the reflex that closes the loop: notice the lesson, decide whether it's worth keeping, and route the keepers into the library through [[skill-creator]].
Harvest is the trigger and triage layer. It does not author skills — [[skill-creator]] does that. Harvest decides whether, what, and where; skill-creator handles how.
Run a harvest pass when the session produced a reusable lesson, especially:
Skip when:
Not a substitute for [[skill-creator]] (the authoring craft) or [[decision-docs]] (project-specific records). Harvest points to those; it doesn't replace them.
Before ending the work, ask explicitly: what did I learn here that a future agent would want? Look for the signals above. Write each candidate as one sentence — the lesson, not the incident.
Weak: "We fixed the login bug."
Strong: "OAuth state cookies silently drop when SameSite=Lax and the IdP posts back cross-site —
the fix is SameSite=None; Secure. Worth a guardrail in hardening."If nothing clears the bar, say so and stop — a forced harvest produces noise that dilutes routing.
| The lesson is… | Destination |
|---|---|
| A repeatable process people predictably cut corners on | New skill → [[skill-creator]] |
| A gap or error in an existing skill (missing step, wrong trigger, stale advice) | Improve that skill → [[skill-creator]] |
| A mistake to prevent before destructive/risky actions | Extend [[agent-guardrails]] |
| A routing miss (right skill existed, wasn't picked) | Fix the [[skill-router]] table / description |
| A project-specific fact or decision | [[decision-docs]] / repo docs — not a skill |
| A one-off fact, no repeatability | Drop it — not worth capturing |
Most weak harvests come from skipping this step and writing a "skill" for something that's really a doc or a one-off. Triage honestly: a skill encodes a repeatable workflow where corners get cut.
Search the library before creating anything (grep -ri "<keyword>" skills/ agents/). Overlap dilutes routing worse than a missing skill. If a skill nearly covers it, improve or link that one rather than spawning a near-duplicate.
this work. Cheaper, keeps the library tight. Most harvests land here.
name the trigger conditions an agent would see.
Pass the triaged, deduped lesson to [[skill-creator]] with the destination decided. Skill-creator owns the anatomy — trigger-rich description, executable Process, Common Rationalizations, Red Flags, checkbox Verification — and the validation/catalog steps. Don't reinvent that here.
For a guardrail or router fix, make the edit directly in [[agent-guardrails]] / [[skill-router]] and still run validation.
Run scripts/validate.sh and scripts/generate-catalog.sh (and scripts/skill-test.sh if you added a behavioral test). A harvest that breaks structure or skips the catalog isn't done ([[pipeline-ops]] enforces this in CI).
State what was harvested and where it went — or that nothing met the bar. A harvest with no decision and no diff is a harvest that didn't happen.
validate.sh + generate-catalog.sh run (and skill-test.sh if a test was added)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.