fullstack-web — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fullstack-web (MCP Server) and scored it 75/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 6 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Metaskill: Instant AI Agent Teams for Any Project
One skill to create them all.
Metaskill is a Claude Code skill that creates AI agent teams, individual agents, and custom skills — all through a single /metaskill command.
# Generate a full agent team for a project
/metaskill ios app with SwiftUI
/metaskill fullstack web app with React and PostgreSQL
/metaskill data science pipeline with PyTorch
/metaskill game dev with Unity and C#
# Create a single agent
/metaskill a security reviewer agent for Go microservices
/metaskill a code reviewer agent
# Create a single skill
/metaskill a deploy-to-staging skill with Docker
/metaskill a lint-and-format skillOne command. It detects your intent and routes to the right flow automatically.
When you describe a project type, Metaskill runs a 4-phase process:
Phase 1: RESEARCH
├── Web search: real-world team structures for your domain
├── Web search: existing Claude Code agent configs on GitHub
├── Web search: MCP servers relevant to your tech stack
└── Web search: best practices, linters, testing frameworks
Phase 2: BUILD
├── CLAUDE.md — routing table + orchestration protocol
├── .claude/agents/ — 4-6 agents (tech-lead + specialists + reviewer)
├── .claude/skills/ — 2-4 workflow automation skills
├── .claude/rules/ — coding standards for the primary language
└── .mcp.json — MCP server configuration
Phase 3: CREDENTIALS
└── Asks for any API keys/tokens needed by MCP servers
(always offers "skip / configure later")
Phase 4: VERIFY
└── Lists all created files, validates .mcp.json, prints summaryThe research phase is what makes each generated team genuinely useful — it's not a fixed template. It adapts to what actually matters in your domain right now.
When your request mentions "agent", "reviewer", or a specific role, Metaskill creates a single .claude/agents/<name>.md with:
When your request mentions "skill", "command", or "slash command", Metaskill creates a single .claude/skills/<name>/SKILL.md with:
ios-app-agents/
├── CLAUDE.md ← routing table + orchestration protocol
├── .mcp.json ← MCP servers, auto-discovered by Claude Code
└── .claude/
├── agents/
│ ├── tech-lead.md ← Opus model, routes all tasks
│ ├── ios-engineer.md ← SwiftUI, platform APIs
│ ├── ui-designer.md ← layouts, animations, design system
│ ├── test-engineer.md ← XCTest, UI testing
│ └── code-reviewer.md ← quality gate for all code changes
├── skills/
│ ├── build-and-test/SKILL.md
│ └── run-simulator/SKILL.md
└── rules/
└── swift-standards.mdAfter generation:
cd ios-app-agents
claude
> "Build a SwiftUI todo app with iCloud sync"The tech-lead agent breaks the task down and delegates to specialists. You supervise, they build.
curl -fsSL https://raw.githubusercontent.com/xvirobotics/metaskill/main/install.sh | bashThis installs /metaskill to ~/.claude/skills/metaskill/.
Or manually:
mkdir -p ~/.claude/skills/metaskill/flows
curl -fsSL https://raw.githubusercontent.com/xvirobotics/metaskill/main/skill/SKILL.md \
-o ~/.claude/skills/metaskill/SKILL.md
curl -fsSL https://raw.githubusercontent.com/xvirobotics/metaskill/main/skill/flows/team.md \
-o ~/.claude/skills/metaskill/flows/team.md
curl -fsSL https://raw.githubusercontent.com/xvirobotics/metaskill/main/skill/flows/agent.md \
-o ~/.claude/skills/metaskill/flows/agent.md
curl -fsSL https://raw.githubusercontent.com/xvirobotics/metaskill/main/skill/flows/skill.md \
-o ~/.claude/skills/metaskill/flows/skill.mdRequirements: Claude Code CLI installed and authenticated.
Modern AI coding agents are powerful, but setting up a well-structured multi-agent team takes hours: designing roles, writing system prompts, choosing MCP servers, configuring routing. Metaskill automates that entire setup step.
The name is a reference to the philosophical concept of a meta-skill — a skill that makes you better at acquiring other skills. In this case: a skill that generates the skills (and agents, and rules) you need to work on any kind of project.
One prompt. One team. Start building.
Every generated team follows this pattern:
| Role | Model | Responsibility |
|---|---|---|
tech-lead | Opus | Routes tasks, coordinates agents, never implements directly |
<specialist-1> | Sonnet | Domain expert #1 (e.g. frontend, iOS, data engineering) |
<specialist-2> | Sonnet | Domain expert #2 |
<specialist-3> | Sonnet | Domain expert #3 (optional) |
code-reviewer | Sonnet | Quality gate — all code passes through here |
Orchestration protocol (in every generated CLAUDE.md):
Metaskill selects MCP servers based on your domain. Verified catalog:
| Server | Package | Purpose | Transport |
|---|---|---|---|
context7 | @upstash/context7-mcp@latest | Up-to-date library docs | stdio |
playwright | @playwright/mcp@latest | Browser automation & e2e testing | stdio |
filesystem | @modelcontextprotocol/server-filesystem | Enhanced file operations | stdio |
postgres | @modelcontextprotocol/server-postgres | Database queries | stdio |
sequential-thinking | @modelcontextprotocol/server-sequential-thinking | Structured multi-step reasoning | stdio |
memory | @modelcontextprotocol/server-memory | Persistent knowledge graph | stdio |
github | https://api.githubcopilot.com/mcp/ | GitHub API access | HTTP |
All servers are written to .mcp.json and auto-discovered by Claude Code on launch. No claude mcp add needed.
The examples/ directory contains real, usable agent teams generated by Metaskill. Each is a complete project you can copy and use directly:
| Example | Stack | Agents | Skills |
|---|---|---|---|
fullstack-web/ | React + Node.js + PostgreSQL | tech-lead, frontend-engineer, backend-engineer, devops-engineer, code-reviewer | build-and-test, deploy-preview, api-test |
ios-app/ | SwiftUI + Swift | tech-lead, ios-engineer, ui-designer, test-engineer, code-reviewer | build-and-test, run-simulator |
data-science/ | Python + PyTorch | tech-lead, data-engineer, ml-engineer, analyst, code-reviewer | run-pipeline, evaluate-model, generate-report |
Try one:
cp -r examples/fullstack-web my-project
cd my-project && claudemetaskill/
├── skill/
│ ├── SKILL.md ← /metaskill entry point (intent routing)
│ └── flows/
│ ├── team.md ← full agent team generation flow
│ ├── agent.md ← single agent creation flow
│ └── skill.md ← single skill creation flow
├── install.sh ← installer
└── examples/ ← example generated outputsPRs welcome. The skill is modular — edit the specific flow file for what you want to improve:
skill/flows//metaskillIf you use Metaskill in research, please cite:
@software{sung2025metaskill,
author = {Sung, Flood},
title = {Metaskill: A Meta-Skill for Autonomous AI Agent Team Generation},
year = {2025},
url = {https://github.com/xvirobotics/metaskill},
license = {MIT}
}A CITATION.cff file is also provided for GitHub's "Cite this repository" button.
MIT © XVI Robotics
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.