skill-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Builds structured skills for AI agents following a consistent pattern.
A skill is a bundled, routing-based knowledge system. The agent doesn't navigate a folder tree — it follows routes from a single entry point. Dead content is worse than no content: every file must be registered in the routing table or it won't be found.
Every new skill follows this path:
1. Bootstrap → Create repo structure, write SKILL.md skeleton
2. Add docs → Create *.md reference docs, register in SKILL.md routing
3. Add scripts → Create tools under scripts/, reference from docs (optional)
4. Add agents → Create specialized agents under agents/ (optional)
5. Validate → Run structure testsNot every skill needs scripts or agents. Start with docs only.
Answer these before writing any code:
| Question | Example |
|---|---|
| What is the name? | python, terraform, docker |
| What triggers it? | File extensions, keywords, file patterns |
| What do users want to do? | Write code, debug, manage config |
| What scripts are needed? | Search, validation, code generation |
| What agents are needed? | verify, lint, build |
skills/<name>/
├── SKILL.md # Entry point (required)
├── *.md # Reference docs (at least basics.md)
├── agents/ # Specialized agents (optional)
├── scripts/ # Tool scripts (optional)
├── data/ # Embedded indexes (optional)
└── examples/ # Runnable examples (optional)Important: The skills/<name>/ directory is the bundle. Everything outside it is development infrastructure.
SKILL.md must have:
--- frontmatter with name and descriptionFor each doc:
skills/<name>/<topic>.mdScripts go in scripts/. Requirements:
| Requirement | Reason |
|---|---|
| Python 3.10+ | Matches toolchain baseline |
argparse with --help | Agents need to call them |
--json for structured output | Agents parse machine output better |
| Exit 0 on success, non-zero on failure | Script exit codes are meaningful |
Data embedded in data/ | Offline, deterministic |
Run the structure validator:
python tests/test_structure.pyEvery .md file must be registered in SKILL.md routing table.
~~~markdown
name: <name> description: 'One-line description. Use when: (1) trigger conditions, (2) file patterns, (3) user intent'
What activates this skill?
File patterns: *.ext, *.config Keywords: import, function, task Commands: build, deploy, init
Required tools and how to install them.
python scripts/search.py "query"| Example | Description |
|---|---|
| example.ext | ... |
~~~
Rules for .md files inside skills/<name>/:
`<lang> for code, `bash for shellWhen a task needs a specialized agent, create agents/<name>-<task>.md:
---
name: <name>-<task>
description: 'What this agent does. Use when: trigger conditions'
model: claude-sonnet-4-6
---
You are a <task> agent for <name>. [Detailed system prompt...]When scripts live inside skills/<name>/scripts/:
from pathlib import Path
base_dir = Path(__file__).parent.parent # → skills/<name>
data_dir = base_dir / "data"
# For upstream docs at repo root:
upstream_dir = base_dir.parent / "references" / "docs"Use parent.parent (not parent.parent.parent). Rule: scripts are at skills/<name>/scripts/.
If upstream docs are HTML, you can parse them to build a search index:
(Print | ?), must be looked up exactlyK1 = 1.5 # term frequency saturation
B = 0.75 # document length normalization
WEIGHTS = {'name': 3.0, 'syntax': 2.0, 'description': 1.0}Field weights: name at 3x because exact matches should rank highest.
python scripts/search.py "query" --top 5 # ranked search
python scripts/search.py --name "keyword" # exact lookup
python scripts/search.py "query" --json # structured outputWindows console may use GBK. Always clean text output:
def clean_text(text: str) -> str:
return text.replace('\xa0', ' ').replace('', '')| Type | Detection Markers |
|---|---|
| Compiled language | File extensions, block endings (End Function), metacommands ($Dynamic) |
| Interpreted / Script | Shebang (#!/...), REPL commands |
| Config / Infrastructure | File patterns (*.tf, *.yaml), resource types |
Do not assume shebang — many compiled languages don't have it.
Every new file MUST be registered in SKILL.md's routing table.
A doc not in the routing table is invisible to agents. Test tests/test_structure.py enforces this.
Pattern:
.md doc → add row in routing tableImperative mood, lowercase, no period. Scope prefix.
skill: bootstrap <name> structure
docs: add basics.md and config.md
scripts: add search with embedded index
agent: add <name>-verify agent| Mistake | Fix |
|---|---|
| SKILL.md missing frontmatter | Must start with --- name: ... --- |
| Doc not in routing table | Add entry before finishing doc |
Script paths use parent.parent.parent | Scripts are at skills/<name>/scripts/, use parent.parent |
Forgetting --json flag | Agents parse structured output better |
| Forgetting encoding clean | Windows GBK + UTF-8 content = broken output |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.