create-seed-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-seed-skill (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scaffold an integration-type skill from scratch. A seed skill is SKILL.md + reference assets + prompts.jsonl entries that together teach an agent to sprout a working, testable integration.
Integration skills (use this skill):
ydc-ai-sdk-integration, teams-anthropic-integrationTool skills (do NOT use this skill):
youdotcom-cliAsk the developer first:
Is this an integration skill (the agent generates code + tests) or a tool skill (the agent runs a CLI command)?
Ask these questions all at once (do not ask one by one):
my-sdk-integration)prompts.jsonl entries (one -typescript, one -python), and two tests/ directories (tests/<skill-name>-typescript/ and tests/<skill-name>-python/), each with a .gitkeep file.prompts.jsonl entry, one tests/<skill-name>/ directory with a .gitkeep file.MY_API_KEY, OPENAI_API_KEY)Before writing any code, read the reference assets to understand the required structure:
Create all files in one pass. The skill lives in skills/<skill-name>/.
Directory layout:
skills/<skill-name>/
├── SKILL.md
└── assets/
# TypeScript:
├── path-a-<variant>.ts # Path A integration
├── path-b-<variant>.ts # Path B integration (if applicable)
├── integration.spec.ts # Bun test file
# Python:
├── path_a_<variant>.py # Path A integration
├── path_b_<variant>.py # Path B integration (if applicable)
├── test_integration.py # pytest file
└── pyproject.toml # Python project config (required for uv run pytest)
# Also create (see below):
tests/<skill-name>/ # single language
└── .gitkeep
# — or for both languages —
tests/<skill-name>-typescript/
└── .gitkeep
tests/<skill-name>-python/
└── .gitkeepAlso create the `tests/` eval target directory (or directories) with a `.gitkeep` file so the directory exists in git before agents write to it:
tests/<skill-name>/.gitkeeptests/<skill-name>-typescript/.gitkeep and tests/<skill-name>-python/.gitkeep# Single language (adjust path as needed):
mkdir -p tests/<skill-name> && touch tests/<skill-name>/.gitkeep
# Both languages:
mkdir -p tests/<skill-name>-typescript tests/<skill-name>-python
touch tests/<skill-name>-typescript/.gitkeep tests/<skill-name>-python/.gitkeepAppend one entry per language to data/prompts/prompts.jsonl.
Single language template (pick one concrete example — do NOT leave TypeScript or Python as a placeholder):
TypeScript:
{"id":"<skill-name>","input":["Using the <skill-name> skill, create a working TypeScript <description of Path A> integration. Write flat minimal code with no comments or TSDoc. Write integration tests that call real APIs and assert on meaningful response content. Save everything to the tests/<skill-name> directory.","Extend the integration with <description of Path B>. Write flat minimal code with no comments or TSDoc. Update the integration tests to verify the extended integration also works with a live query."],"metadata":{"cwd":"tests/<skill-name>","language":"typescript"}}Python:
{"id":"<skill-name>","input":["Using the <skill-name> skill, create a working Python <description of Path A> integration. Write flat minimal code with no comments or docstrings. Write integration tests that call real APIs and assert on meaningful response content. Save everything to the tests/<skill-name> directory.","Extend the integration with <description of Path B>. Write flat minimal code with no comments or docstrings. Update the integration tests to verify the extended integration also works with a live query."],"metadata":{"cwd":"tests/<skill-name>","language":"python"}}Both languages — append TWO entries:
{"id":"<skill-name>-typescript","input":["Using the <skill-name> skill, create a working TypeScript <description of Path A> integration. Write flat minimal code with no comments or TSDoc. Write integration tests that call real APIs and assert on meaningful response content. Save everything to the tests/<skill-name>-typescript directory.","Extend the integration with <description of Path B>. Write flat minimal code with no comments or TSDoc. Update the integration tests to verify the extended integration also works with a live query."],"metadata":{"cwd":"tests/<skill-name>-typescript","language":"typescript"}}
{"id":"<skill-name>-python","input":["Using the <skill-name> skill, create a working Python <description of Path A> integration. Write flat minimal code with no comments or docstrings. Write integration tests that call real APIs and assert on meaningful response content. Save everything to the tests/<skill-name>-python directory.","Extend the integration with <description of Path B>. Write flat minimal code with no comments or docstrings. Update the integration tests to verify the extended integration also works with a live query."],"metadata":{"cwd":"tests/<skill-name>-python","language":"python"}}Rules for prompts:
metadata.cwd must match the tests/ directory created in Step 3 (the grader reads files from here)metadata.language must be typescript or pythonln -s ../../skills/<skill-name> .claude/skills/<skill-name>bunx @plaited/development-skills validate-skill skills/<skill-name>name, description, license, compatibility, allowed-tools, assets list, metadata**Rules:**
- No mocks — call real APIs
- Assert on keywords from a deterministic query, not just `length > 0`
- Validate required env vars at test start (inside the test function, not at module scope)
- TypeScript: use `bun:test`, dynamic imports inside tests, `timeout: 60_000`
- Python: use `pytest`, import inside test function; always include `pyproject.toml` with `pytest` in `[dependency-groups] dev`
- Run TypeScript tests: `bun test` | Run Python tests: `uv run pytest`instructions/system_prompt__main__ example) and the test assertionslength > 0import() in testsmain(query: str) -> str function, use deferred imports inside test functionsThe real goal: verify the integration code ran, not that the LLM knows the answer.
Most LLMs can answer factual questions from memory without calling any tool. A query the model can answer without searching doesn't prove the MCP server or SDK tool was invoked — the integration may silently skip the tool and still pass.
What actually matters: the test passes only if the code path worked — the SDK was initialized, the MCP server was reached, and a response was returned. A keyword assertion that matches typical tool output is better than no assertion, but it doesn't prove the tool fired.
Practical guidance:
length > 0scripts/grader.ts) also evaluates the generated code structure, not just whether keywords appearGood examples (explicit tool instruction + stable keywords):
"Search the web for the three branches of the US government" → assert legislative, executive, judicial"Use web search to find what programming language TypeScript compiles to" → assert javascript"Search the web for the four classical elements" → assert earth, water, fire, airThe "Search the web for..." or "Use [tool name] to find..." prefix makes tool use an explicit instruction, not an inference — the model must call the tool to follow the prompt.
Avoid:
The grader (scripts/grader.ts) runs from metadata.cwd:
bun test, scans **/*.{ts,js} for generated filesuv run pytest (requires pyproject.toml in the test dir)Common failure modes to prevent in your SKILL.md:
pyproject.toml asset with pytest in dev depsGiven: wrapping the httpx library with You.com search, Python only.
Files to create:
skills/ydc-httpx-integration/
├── SKILL.md
└── assets/
├── path_a_basic.py
├── test_integration.py
└── pyproject.toml
tests/ydc-httpx-integration/
└── .gitkeepCreate the tests directory:
mkdir -p tests/ydc-httpx-integration && touch tests/ydc-httpx-integration/.gitkeepprompts.jsonl entry:
{"id":"ydc-httpx-integration","input":["Using the ydc-httpx-integration skill, create a working Python application that calls the You.com search API directly with httpx and returns search results. Write integration tests that call the real API and verify the response contains expected keywords. Save everything to the tests/ydc-httpx-integration directory.","Extend the integration to also support content extraction from URLs. Update the integration tests to verify both search and content extraction work with live queries."],"metadata":{"cwd":"tests/ydc-httpx-integration","language":"python"}}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.