skill-trigger-metadata — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-trigger-metadata (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bundled commands use $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), otherwise the absolute path of this skill folder's ../...
Design name and description as the retrieval contract that makes an agent read the right SKILL.md. Use this before finalizing skill frontmatter or plugin skill metadata.
If the task also changes skill instructions, resources, scripts, packaging, or installation, use this skill for metadata first, then use skill-factory or plugin-factory for the broader lifecycle.
The description must answer: should the agent read this skill now?
Write for progressive disclosure: name is the searchable handle, description is the trigger contract, and SKILL.md body contains workflow, commands, constraints, and examples.
Do not put enough workflow detail in description for the agent to act without reading SKILL.md.
Treat skill selection as tool lookup plus routing:
Top-load trigger boundaries and critical constraints so the agent can decide to read the skill before acting.
Write a selection card before wording the final description:
Use when:
Inputs/signals:
Do not use when:
Failure symptoms:
Adjacent skills:Then turn it into this shape:
description: Use when <task contexts, artifacts, failures, or agent decision points that should trigger this skill>.Include concrete terms for user intent, artifacts, symptoms, source evidence, synonyms, adjacent phrasing, and negative boundaries when nearby skills share vocabulary.
For router/process skills where missing the skill is the dominant failure, stronger phrasing is acceptable: "Use when..." or "Use before...". Do not make ordinary domain skills globally mandatory.
Before finalizing metadata, write a small trigger set:
Check each prompt against the description:
SKILL.md?Revise until the boundary is clear. If two skills own the same trigger surface, split responsibilities or make the router skill explicit.
If the skill under-triggers, add missing concrete intent, artifacts, file types, error text, or domain synonyms.
If it over-triggers, add scope qualifiers or negative boundaries and remove generic nouns.
If it triggers but the agent skips required steps, remove workflow steps from description, top-load constraints in SKILL.md, and shorten body text that hides the required action.
When changing metadata, report:
name or description;quick_validate.py and any repository/plugin checks.Use $PLUGIN_ROOT/references/trigger-metadata.md for name rules, description wording patterns, and detailed failure repair.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.