skill-factory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-factory (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bundled commands use $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), otherwise the absolute path of this skill folder's ../...
Create skills that any host agent can actually use: clear trigger metadata, compact hot-path instructions, conditional resources, and executable validation.
Read $PLUGIN_ROOT/references/skill-runtime-model.md before creating, synthesizing, materially refactoring, or installing skills across Codex, Claude Code, Cursor, or the open Agent Skills format. It records startup metadata, on-demand body loading, resource loading, host-specific discovery paths, and install/reload behavior.
For material name or description work, use skill-trigger-metadata first. For portfolio-level split, merge, delete, router, reference-extract, or script-extract decisions across multiple skills, use capability-portfolio-architect first. This skill owns concrete skill structure, resources, scripts, packaging, and validation after the boundary decision is made.
Use the bundled initializer unless you are editing an existing skill. Choose the destination from the selected delivery surface: plugin-contained skills go under the plugin source tree; repo-local skills go under the current or named repository; installed personal skills go in the active agent's global skills dir. Example for an installed Codex skill:
python3 "$PLUGIN_ROOT/scripts/skill/init_skill.py" <skill-name> --path "${CODEX_HOME:-$HOME/.codex}/skills" --resources scripts,referencesChoose the destination deliberately:
${CODEX_HOME:-$HOME/.codex}/skills/<skill-name>, Claude: ${CLAUDE_HOME:-$HOME/.claude}/skills/<skill-name>, Cursor: ${CURSOR_HOME:-$HOME/.cursor}/skills/<skill-name>; detect the active agent with $PLUGIN_ROOT/scripts/agent_target.py<plugin-root>/skills/<skill-name> when the user requested a plugin/plugin pack or the current repository is a plugin source treeinstall-scope.json<output-dir>/synthesized-skill only for reference-only drafts, failed/partial synthesis, or an explicit no-install requestKeep names lowercase, hyphenated, and under 64 characters. Do not infer repo-local output from dirty git state or a merely local candidate path. Repo instructions and recognizable plugin/skill source trees are valid evidence only when they apply to the current capability task and do not conflict with the latest user message.
Frontmatter must include only:
---
name: skill-name
description: What the skill does and concrete trigger situations.
---Body guidelines:
SKILL.md.description when they could let the agent act from metadata and skip SKILL.md; use skill-trigger-metadata for focused name/description audits.references/.For material skill work, measure and audit:
python3 "$PLUGIN_ROOT/scripts/context/token_count.py" <skill-dir>/SKILL.md --json
python3 "$PLUGIN_ROOT/scripts/context/context_density_audit.py" <skill-dir> --json --top 20Use the audit to remove duplicate hot-path prose, stale history, brittle request-phrase trigger design, and brittle parsing of generated model text. Do not shrink away trigger precision, safety rules, or required commands.
For material skill refactors, run a structured quality-review pass before and after the change:
python3 "$PLUGIN_ROOT/scripts/context/token_count.py" <skill-dir> --json --top 20
python3 "$PLUGIN_ROOT/scripts/context/context_density_audit.py" <skill-dir> --json --top 20Use token hotspots, measured risk entries, duplication clusters, and blocking flags as triage input, not as a replacement for the skill runtime model, trigger metadata review, or quick_validate.py.
Run:
python3 "$PLUGIN_ROOT/scripts/skill/quick_validate.py" <skill-dir>When agents/openai.yaml is present or desired, regenerate it after final SKILL.md edits:
python3 "$PLUGIN_ROOT/scripts/skill/generate_openai_yaml.py" <skill-dir> \
--interface display_name="<Display Name>" \
--interface short_description="<25-64 chars>" \
--interface default_prompt="<representative task prompt>"Test any added scripts with representative inputs. For complex skills, forward-test with a realistic task if a fresh subagent or isolated session is available.
For complete installed skills, validate the install-scope contract:
python3 "$PLUGIN_ROOT/scripts/synthesis/install_scope_gate.py" <output-dir>/install-scope.json --finalFor lightweight edits confined to one existing skill's text or metadata — no new scripts, no installation, no new capability claims — quick_validate.py plus a one-line scope note in the report replaces the ledgers.
State:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.