skill-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-builder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create skills that follow the agentskills.io standard. A skill is a directory with a SKILL.md file and optional resources.
Golden rule: Add what the agent lacks, omit what it knows. If the agent would get it right without your instruction, cut it.
Language: All skill content must be written in English. Skill frontmatter, instructions, examples, and reference files are consumed by AI agents — English is the expected language.
Prose: No hard-wrapping — paragraphs flow as single lines; the renderer wraps. Write what matters, skip the rest; no preambles, no filler.
Create <name>/SKILL.md (directory name MUST match name):
---
name: roll-dice
description: Roll dice using a random number generator. Use when asked to roll a die (d6, d20, etc.), roll dice, or generate a random dice roll.
---
To roll a die, use:
echo $((RANDOM % <sides> + 1))
Replace `<sides>` with the number of sides (6 for standard, 20 for d20).That's a complete skill. Expand only as needed.
skill-name/
├── SKILL.md # Required: metadata + instructions
├── scripts/ # Optional: executable code
├── references/ # Optional: docs loaded on demand
├── assets/ # Optional: templates, static resources
└── evals/ # Optional: test casesKeep file references one level deep from SKILL.md. Avoid deeply nested chains.
| Field | Rules |
|---|---|
name | 1-64 chars. a-z, 0-9, hyphens. No leading/trailing/consecutive hyphens. Must match folder name. |
description | 1-1024 chars. What it does AND when to use it. See "Writing descriptions" below. |
| Field | Purpose |
|---|---|
license | License name or bundled file reference |
compatibility | 1-500 chars. Env requirements (tools, OS, products). Most skills don't need this. |
metadata | Arbitrary key-value map. Use unique keys to avoid conflicts. |
allowed-tools | Space-separated pre-approved tools (experimental, support varies) |
Minimal:
---
name: pdf-processing
description: Extract PDF text, fill forms, merge files. Use when handling PDFs.
---With optional fields:
---
name: data-pipeline
description: >
Build and run data pipelines using our internal ETL framework.
Use when the user mentions data ingestion, batch jobs, or ETL.
license: Proprietary. LICENSE.txt has complete terms
compatibility: Requires Python 3.14+ and uv
metadata:
author: data-team
version: "1.0"
allowed-tools: Bash(git:*) Bash(jq:*) Read
---The description decides activation. Poor description → skill never triggers.
Principles:
Good vs poor:
# Poor — vague, no trigger context
description: Helps with PDFs.
# Poor — too narrow, misses common phrasings
description: Process CSV files.
# Good — specific scope, explicit triggers, broad coverage
description: >
Analyze CSV and tabular data — summary statistics, derived columns,
charts, and data cleaning. Use when the user has a CSV, TSV, or
Excel file and wants to explore, transform, or visualize data,
even if they don't explicitly mention "CSV" or "analysis."Nuance: agents often skip skills for simple one-step tasks they can handle alone. Descriptions matter most for specialized knowledge or non-obvious domains.
Keep SKILL.md under 500 lines / 5,000 tokens. Move reference material to separate files.
Ask for each paragraph: "Would the agent get this wrong without this instruction?" If no → cut it.
See references/WRITING_SKILLS.md for body structure, patterns, and examples.
Three load stages:
name + description loaded at startup for all skillsSKILL.md loaded when task matchesscripts/, references/, assets/ loaded only when referencedTell the agent when to load each file:
# Good
Read `references/api-errors.md` when the API returns a non-200 status.
# Bad
See references/ for details.Bundle executables in scripts/ when the agent repeats the same logic. Use one-off commands (uvx, npx) for simple invocations.
Design for agentic use:
--help documentationSee references/USING_SCRIPTS.md for language-specific setup (Python PEP 723, Deno, Bun, Ruby).
Test each case with skill vs without skill (or previous version) to prove the skill adds value.
See references/EVALUATING.md for full workflow.
A skill only helps if it activates. Test triggering systematically.
See references/OPTIMIZING_DESCRIPTIONS.md for eval query design and optimization loop.
skills-ref validate ./my-skillChecks frontmatter and naming conventions.
name in frontmatter. Mismatch breaks discovery.references/.See references/BEST_PRACTICES.md and references/SPECIFICATION.md for full details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.