capability-synthesizer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited capability-synthesizer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bundled commands use $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), otherwise the absolute path of this skill folder's ../...
Build one cohesive result from a broad capability corpus. The internet and public repositories are the primary corpus; local skills are supplementary evidence and candidate implementations. Candidates are evidence, not merge targets.
Before discovery, write a compact contract:
{
"capability": "short target",
"primary_target": "named skill/plugin/MCP/capability to create or strengthen",
"named_targets": ["@plugin-or-$skill explicitly named by the user"],
"cwd_role": "workspace | source-reference | target",
"mode": "new-skill | augment-existing | plugin-pack | source-import | reference-only",
"artifact_type": "skill | plugin | mcp | mixed | report",
"install_scope": "global-agent | repo-local | workspace-snapshot | reference-only",
"install_required": false,
"destination_path": "chosen source or install path",
"marketplace_path": "only when global marketplace activation is required",
"trigger_model": ["task context, artifacts, evidence, or agent decision point that should invoke the capability"],
"core_workflows": ["workflow 1"],
"non_goals": ["excluded behavior"],
"must_keep_capabilities": ["capability that must survive distillation"],
"safety_boundaries": ["no candidate execution", "no hidden network", "no credentials"],
"validation_scenarios": [
{"name": "happy path", "expected": "observable pass"},
{"name": "safety case", "expected": "blocked or approval-gated"},
{"name": "edge case", "expected": "covered or explicitly deferred"}
]
}Use $PLUGIN_ROOT/references/synthesis-contract.md for the scoring rubric and coverage ledger. Use $PLUGIN_ROOT/references/external-discovery.md for broad public-source search waves and diminishing-return criteria. Use $PLUGIN_ROOT/references/install-scope.md to choose the source/edit surface and whether installation is required.
For target binding, a named skill/plugin is the primary target by default. A current plugin/skill source repository may be the edit target when the request, repo instructions, or workspace profile indicate that capability artifacts should be authored there.
For new-skill, augment-existing, and plugin-pack synthesis, create installation-scope and external-discovery ledgers before editing the target skill/plugin:
python3 "$PLUGIN_ROOT/scripts/synthesis/install_scope_gate.py" --template > <output-dir>/install-scope.json
python3 "$PLUGIN_ROOT/scripts/synthesis/install_scope_gate.py" <output-dir>/install-scope.jsonpython3 "$PLUGIN_ROOT/scripts/synthesis/external_discovery_gate.py" --template > <output-dir>/external-discovery-ledger.json
python3 "$PLUGIN_ROOT/scripts/synthesis/external_discovery_gate.py" <output-dir>/external-discovery-ledger.jsonDo not call the result complete unless the gate validates status=complete, breadth=external-broad, and stop_condition=diminishing_returns. If the gate is partial or skipped, the final answer and reports must say external_discovery_partial or local_only, and must not claim broad validation.
Do not call an output complete until install-scope.json validates the selected delivery surface and install_scope_gate.py --final passes. Use repo-local for source artifacts in a selected repository and install_required=false unless the user asked for activation. Use global-agent when the requested result is an installed personal/global capability or no repository source surface is selected; detect the active agent (Codex, Claude, or Cursor) with $PLUGIN_ROOT/scripts/agent_target.py.
Official docs lookup, Context7 docs, or one search query is not enough. It can be one source family, but ready-made public skills/plugins/MCP servers/community implementations still need discovery unless blocked.
Choose discovery breadth explicitly from $PLUGIN_ROOT/references/synthesis-contract.md. For new-skill, augment-existing, plugin-pack, "well-vetted", "synthesize", "distill", "strengthen", or marketplace capability requests, default to external-broad.
Use $PLUGIN_ROOT/references/external-discovery.md for source families, search waves, query patterns, triage, and diminishing-return rules. The hot path is:
python3 "$PLUGIN_ROOT/scripts/capability_inventory.py" --query "<topic>" --jsonexternal_discovery_partial when time, network, access, or safety blocks the required breadth.Do not treat a strong local candidate set as enough to skip external discovery for synthesis/augmentation. Local candidates can win after scoring, but they do not define the search frontier.
For ClawHub/OpenClaw CLI use, disable telemetry when possible:
CLAWHUB_DISABLE_TELEMETRY=1 clawhub search "<topic>"
CLAWHUB_DISABLE_TELEMETRY=1 clawhub inspect <slug>Skip sources that require login, paid access, opaque install, API keys, or telemetry just to inspect. Record the limitation and search for an inspectable alternative.
Run the static helper for readable local candidates:
python3 "$PLUGIN_ROOT/scripts/synthesis/audit_skill_candidate.py" <candidate-a> <candidate-b> --output candidate-audits.jsonThen manually review the files that matter. For each candidate, record:
Score mechanisms, not whole candidates. Prefer best-supported mechanisms after safety, dependency, portability, and validation costs are accounted for. Reject any required or hidden high-risk mechanism even if the rest of the candidate is strong.
description.If no output directory is provided, write reports and ledgers to ./skill-synthesis/<target-slug>/ in the current workspace. This is a report/work area, not the default installation target. Produce:
discovery-report.mdsafety-vetting-report.mdcapability-matrix.mddistillation-plan.mdinstall-scope.jsoninstall_required=truesynthesis-changelog.mdUse $PLUGIN_ROOT/references/synthesis-contract.md and $PLUGIN_ROOT/references/safety-vetting.md for required sections.
Before finalizing:
install_required=true.python3 "$PLUGIN_ROOT/scripts/synthesis/install_scope_gate.py" <output-dir>/install-scope.json --final.plugin-factory.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.