add-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Coordinate adding a new external skill to the agent-skills repository. Covers scaffolding, publish workflow registration, and symlink creation.
Use this skill when:
skills/skills/skills/<skill-name>/ directory needs to be created and registeredAsk first:
Is this an integration skill (agent generates code + tests calling real APIs) or a tool skill (agent runs a CLI command)?
create-seed-skill, then continue with Steps 2–4Integration skills wrap SDKs or frameworks where the agent generates runnable code and integration tests.
Examples: ydc-ai-sdk-integration, teams-anthropic-integration, ydc-openai-agent-sdk-integration
Activate the create-seed-skill skill. It handles:
skills/<skill-name>/SKILL.md and assets/tests/<skill-name>/ directories with .gitkeep files (one per language if both)prompts.jsonl entry per language to data/prompts/prompts.jsonlComplete the create-seed-skill workflow fully before proceeding to Step 2.
Tool skills are CLI wrappers where the agent runs commands rather than writing code.
Examples: youdotcom-cli
Create the skill directory and SKILL.md at skills/<skill-name>/SKILL.md.
Required frontmatter:
---
name: <skill-name>
description: |
One-line summary. When to activate.
license: <ISC|MIT|Apache-2.0>
compatibility: <runtime requirements, e.g. "Requires Bun 1.3+">
metadata:
author: youdotcom-oss
version: "1.0.0"
category: <tool|integration|scaffolding>
keywords: <comma-separated>
---Validate immediately:
bunx @plaited/development-skills validate-skill skills/<skill-name>Two edits to .github/workflows/publish.yml:
Under on.workflow_dispatch.inputs, add:
<skill-name>:
description: "<skill-name>"
required: false
type: choice
default: skip
options:
- skip
- patch
- minor
- majorAppend at the end of the jobs: section. The new job must needs the current last job to preserve push serialization:
publish-<skill-name>:
needs: <current-last-job>
if: ${{ always() && inputs['<skill-name>'] != 'skip' }}
uses: ./.github/workflows/_publish.yml
with:
skill_name: "<skill-name>"
bump_type: ${{ inputs['<skill-name>'] }}
secrets:
PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}Find the current last job at runtime — do not rely on a hardcoded list. Run this to get the job ID to use as needs:
grep '^ publish-' .github/workflows/publish.yml | tail -1The output will be a line like publish-youdotcom-cli: — use the job ID (without the trailing colon) as <current-last-job>.
The always() in if: is required — without it a skipped predecessor causes the dependent job to be skipped too, even if this skill was selected.
External skills symlink from .claude/skills/ into skills/:
ln -s ../../skills/<skill-name> .claude/skills/<skill-name>Note: internal skills (in .agents/skills/) use a different target: ../../.agents/skills/<skill-name> — but this skill only handles external skills.
bunx @plaited/development-skills validate-skill skills/<skill-name>Confirm the output reports valid: true before committing.
create-seed-skill — Full scaffolding workflow for integration-type skills (SKILL.md + assets + prompts.jsonl)validate-skill — Validate any skill's structure against the AgentSkills spec~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.