skill-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Goal: produce a SKILL.md a future session will actually auto-invoke and follow, matching the house style of the skills already in ~/.claude/skills/. Not a doc. A loadable procedure.
Before writing anything, classify the request (lesson from claude-code-mastery.md):
client names, fixed conventions) → belongs in CLAUDE.md, NOT a skill. Say so and offer to append to the right CLAUDE.md instead. Stop.
inputs and outputs) → this is a skill. Proceed.
Rule of thumb: "CLAUDE.md = facts always true; Skill = procedures you'd re-paste." A skill that's just a list of facts will bloat context for zero leverage.
If the user already described the workflow (or said "turn what we just did into a skill"), MINE the conversation first — don't re-ask what you can infer. Then fill gaps with ONE batched AskUserQuestion. Capture all 7:
cv-tailor,ghl-video-drip). Must be unique vs existing skills (glob to check).
/name slash form. These drive auto-invocation — weak triggers = dead skill.
including the order-matters gotchas.
not col 5", "this host = manual ZIP not GitHub auto-deploy"). These are gold — bake every one in.
If the user is vague, ask for the steps before generating. Never invent a procedure.
Match this exactly:
---
name: <kebab-case> # MUST equal the folder name
version: 1.0.0 # start here; bump on real change
description: | # pipe block, multi-paragraph
<2-4 line prose blurb: what it does, the win, the mechanism>
<optional second paragraph: who it's tuned for / distilled-from receipt>
Trigger when user says: "<phrase>", "<phrase>", "/<name>", ... (5-9 literal)
Auto-trigger heuristic: <one concrete condition> (optional but preferred)
license: MIT
compatibility: claude-code
allowed-tools: # ONLY tools the steps actually use — least privilege
- Read
- Write
- Edit
- ...
---The description is the single most important field — it's all a future session sees when deciding whether to load the skill. Pack it with literal trigger phrases.
# <name> + one-line goal restatement## When to use — USE when ALL true / SKIP when (bullet lists)## Inputs — what the user supplies; what to ask if missing## The N-step recipe or ## Workflow — numbered, runnable, with code blocks## Templates — paste-and-go blocks (orchestrator prompt, output format)## Output format — the exact structure to emit## Files — list of helper files in the skill folder (only if they exist)## Failure modes + fixes — a | Failure | Cause | Fix | table## Anti-patterns — ❌ bullets## Quality checklist — [ ] items to self-verify before delivering## Cost model — when worth it / when to skip (for heavy/parallel skills)Density: terse, imperative, concrete numbers and real paths. No filler, no "this powerful skill will help you". Arrows (→) for flows. Receipts where they exist ("distilled from batch7 2026-05-30").
Per section above. If facts-only → redirect to CLAUDE.md and stop.
Mine the conversation, then one batched AskUserQuestion for gaps.
Glob: ~/.claude/skills/<name>/SKILL.mdIf it exists → confirm overwrite or pick a new name. Also glob **/<name>/SKILL.md in case it's nested under a plugin pack.
Write house-style frontmatter + body. Trigger phrases must include /<name> and 5-9 natural phrases. allowed-tools = least privilege (only what steps use). Keep all gotchas as explicit rules in body.
~/.claude/skills/<name>/SKILL.mdThis is canonical. NOTE: ~/.claude/commands/<name>.md ALSO registers /<name> — custom commands are merged into skills — but skills/<name>/SKILL.md is the house standard. Use it unless the user explicitly wants a bare command.
/<name>. Only create aseparate commands\<name>.md if the user wants a different alias or a thin wrapper. Ask before creating.
(~/.claude/.../memory/MEMORY.md) so the skill is discoverable later. Keep it to the manifest format (one line, per memory-hygiene rule — manifest only, no dump).
name: in frontmatter == folder name == kebab-casedescription: is a pipe block with a prose blurbTrigger when user says: line present with 5-9 literal phrases incl. /<name>allowed-tools lists ONLY tools the steps use (least privilege)~/-relative, OS-appropriateSKILL CREATED: <name>
Path: ~/.claude/skills/<name>/SKILL.md
Triggers: <list>
Tools: <allowed-tools>
Validation: <N/N checks passed, or list failures>
Add-ons offered: /command alias? <y/n> MEMORY.md pointer? <y/n>
Reload note: new skills register on next session — /clear or restart to pick it up.A common first use: an unfiled-but-good SKILL.md is sitting somewhere outside the canonical skills tree (e.g. a Desktop or Downloads folder), so no session can auto-invoke it. Filing it is a canonical use of skill-builder.
To adopt it:
*-SKILL.md. Check its frontmatter name: and whether it'salready house-style — often minimal rework is needed.
~/.claude/skills/<name>/.~/.claude/skills/<name>/SKILL.md(verify name == folder == kebab-case).
prompts/, templates/, references/ that don't exist yet — either create stubs or strip the ## Files section so it doesn't promise missing files.)
correctly — ask first.
| Failure | Cause | Fix |
|---|---|---|
| New skill never auto-invokes | Weak/missing trigger phrases in description | Add 5-9 literal phrases incl. /<name> + auto-trigger heuristic |
| Skill loaded but ignored | name: ≠ folder name | Make them identical, kebab-case |
| Context bloat, zero leverage | It was facts, not a procedure | Move to CLAUDE.md; delete the skill |
| Steps not reproducible | Vague "do the thing" steps | Re-elicit real commands + order-matters gotchas |
| Secret leaked into skill file | Hardcoded key/token | Replace with pointer to where the secret lives |
/command doesn't appear | New skill not loaded this session | /clear or restart — skills register at session start |
| Path breaks on this box | Unix paths / forward slashes | Windows absolute paths, backslashes, PowerShell-safe |
| Duplicate skill | Didn't glob for existing name | Glob **\<name>\SKILL.md before writing |
.claude/skills/<name>//dev/null on a Windows box## Files helpers that don't existevery future run and keeps idle token cost at ~0 (loads only when invoked).
House references: ~/.claude/skills/fanout-ship/SKILL.md, ~/.claude/skills/upwork-proposal/SKILL.md, and ~/.claude/skills/code-audit-fanout/SKILL.md (once filed) are the canonical style exemplars. When in doubt, copy their density and structure.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.