skill-creator

Create, improve, and audit AI agent skills. Every skill follows 14 proven structural patterns.

Scope: Skills only. NOT for creating agents (use agent-conventions), building MCP servers (/mcp-creator), or running existing skills. This repo uses raw SKILL.md format committed directly to skills/.

Dispatch

| $ARGUMENTS | Action | Example | | ----------------------------------- | ---------------------------- | -------------------------------------------------- | | create <name> / new <name> | Develop (new) | /skill-creator create my-analyzer | | create <name> --from <source> | Develop (new, from exemplar) | /skill-creator create my-analyzer --from wargame | | improve <name> / improve <path> | Develop (existing) | /skill-creator improve design | | plan <name> / plan <path> | Plan (existing) | /skill-creator plan review | | plan --all / plan repo | Plan (repo-wide) | /skill-creator plan --all | | audit <name> | Audit | /skill-creator audit review | | audit <name> --security | Security Audit | /skill-creator audit review --security | | audit --all | Audit All | /skill-creator audit --all | | eval <name> | Eval | /skill-creator eval review | | benchmark <name> | Benchmark | /skill-creator benchmark review | | compare <old> <new> | Compare | /skill-creator compare review-v1 review-v2 | | optimize-description <name> | Optimize Description | /skill-creator optimize-description review | | dashboard | Dashboard | /skill-creator dashboard | | package <name> / package --all | Package | /skill-creator package wargame | | example-blocks <name> | Example Blocks | /skill-creator example-blocks review | | Natural language skill idea | Auto: Develop (new) | "tool that audits Python type safety" | | Skill name + modification verb | Auto: Develop (existing) | "refactor the wargame skill" | | Path to SKILL.md | Auto: Develop (existing) | skills/wargame/SKILL.md | | "MCP server" / "agent" / "run" | Refuse + redirect | — | | Empty | Gallery | /skill-creator |

Auto-Detection Heuristic

If no explicit mode keyword is provided:

1. Path ending in SKILL.md or directory under skills/ → Develop (existing)
2. Existing skill name + modification verb (improve, refactor, enhance, update, fix, rewrite, optimize, polish, revise, change) → Develop (existing)
3. --from <source> in arguments → Develop (new, from exemplar)
4. "benchmark", "A/B", "with skill", "without skill", "old skill", "new skill" → Benchmark or Compare
5. "trigger", "false positive", "false negative", "description fires" → Optimize Description
6. "security", "supply chain", "malicious", "unsafe", "permission", "hook" → Security Audit
7. New capability description ("I want to build...", "tool that...", "skill for...") → Develop (new) — derive name, confirm before scaffolding
8. "MCP server", "agent", "run" → refuse gracefully and redirect
9. Ambiguous → ask the user which mode they want

Quick Start

uv run python skills/skill-creator/scripts/scaffold_skill.py <name>  # Scaffold from template
uv run python scripts/check.py                                        # Validate from skill directory
uv run python skills/skill-creator/scripts/audit.py skills/<name>/    # Score quality
uv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run  # Portability check

Skill Development

Unified process for creating new skills and improving existing ones. Load references/workflow.md for the full procedure.

| Step | New Skill | Existing Skill | | ------------- | --------------------------------------------------------- | ----------------------------------------------- | | 1. Understand | Define use cases, scope, patterns | Audit + understand user's intent | | 2. Plan | Structure, description, frontmatter | Gap analysis + improvement plan (approval gate) | | 3. Scaffold | scaffold_skill.py <name> | Skip | | 4. Build | Write/edit body, references, scripts, templates, evals | Same | | 5. Validate | scripts/check.py + audit.py | Same | | 6. Iterate | Test, identify issues, loop to Step 4 | Same |

Scaling Strategy

Use maximum verified independence, not maximum agent count. Load references/orchestration-graph.md for the full graph contract.

| Scope | Strategy | Parallelism | |-------|----------|-------------| | Small | Single-skill edit: inline sequential edit + validation | Lead only | | Medium | Single-skill multi-surface edit: stabilize body contract, then split references/evals/scripts by owned file | 2-5 disjoint lanes | | Large | Skill cluster or repo-wide plan: inventory, rank, shard by skill or surface, add judge lane | One worker per owned shard | | Large | Public workflow/schema/tooling change: OpenSpec first, then workers behind explicit dependencies | Spec, implementation, verifier, docs-steward lanes | | Large | Behavioral eval/benchmark program: static gates first, then opt-in eval runner/report lanes | Trigger, output, safety, report, judge lanes |

Every lane must define inputs, owned paths, output artifact, validation command, and accounting state before dispatch. Same-file edits, generated docs, hooks, packaging semantics, and schema decisions are serialized unless an explicit lock/arbiter protocol exists.

Repo-Wide / Multi-Skill Planning

Use plan <name> for an existing-skill refinement plan without editing and plan --all or plan repo for a ranked repo-wide planning pass.

Required planning output:

1. baseline audit summary
2. highest-value findings
3. explicit file targets
4. expected score impact
5. approval gate before any edits

For repo-wide planning, produce a ranked queue plus one standalone refinement plan per promoted skill or skill cluster. Do not edit any skill until the user approves the plan.

Load references/refinement-plan.md when producing the standalone refinement-plan packet.

Audit

Score a skill using deterministic analysis + AI review. Load references/audit-guide.md.

Security Audit

Audit a skill as an executable supply-chain asset. Load references/security-governance.md.

Required output:

1. security surface inventory
2. source/sink threat model
3. permission posture
4. hook/script/template/reference findings
5. adversarial eval recommendations
6. risk tier: low, medium, high, or blocked

Security Audit is read-only. Do not install third-party skills, run untrusted scripts, or modify the audited skill.

Audit All

Comparative ranking of all repository skills. Load references/audit-guide.md § Audit All.

Eval / Benchmark / Compare / Optimize Description

Behavioral proof complements static audit scoring. Load references/evidence-and-benchmarking.md.

| Mode | Purpose | |------|---------| | Eval | Review or author trigger, output, regression, safety, and portability eval cases | | Benchmark | Plan or run opt-in with-skill vs without-skill measurement for a skill | | Compare | Plan or run opt-in old-skill vs new-skill measurement for an improvement | | Optimize Description | Test trigger and near-miss negative queries, then revise the description from evidence |

Default to read-only planning unless the user explicitly approves live eval runs and the target workspace. Store behavioral run artifacts outside committed skills/ source.

Dashboard

Render visual creation process monitor or audit quality dashboard. Load references/audit-guide.md § Dashboard.

Auto-detects mode from data: phases field → process monitor; skills array → audit overview.

Gallery (Empty Arguments)

Present skill inventory with scores and available actions. Run uv run python scripts/audit.py --all --format table, display results, offer mode menu.

Package

Package skills into portable ZIP files for Claude Code Desktop import. Load references/packaging-guide.md for ZIP structure, manifest schema, portability checks, and cross-agent compatibility.

uv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run  # Check before emitting a ZIP
uv run python skills/skill-creator/scripts/package.py skills/<name>/            # Single skill → <name>-v<version>.skill.zip

Example Blocks Generator

Generate Empty/Help Gallery example bullets from an existing dispatch table.

uv run python skills/skill-creator/scripts/generate_example_blocks.py <name>           # Preview block
uv run python skills/skill-creator/scripts/generate_example_blocks.py <name> --apply # Append when missing

Use this mode after the dispatch table stabilizes and before publishing the skill. Do not append duplicate ## Example Blocks sections.

Runtime Hook Projection

This portable skill source does not embed skill-scoped hooks frontmatter. Repo-managed hook policy lives in config/hook-registry.json and is projected into supported harness settings by the repository sync/rendering workflow.

Runtime-projected hook enforcement for this skill should preserve these behaviors:

• SKILL.md edits trigger validate_skill.py
• evals/*.json edits trigger validate_evals.py
• hook-bearing skill/settings edits trigger validate_hooks.py
• Stop hooks validate dirty skill-definition, eval, and hook surfaces before exit
• Stop hooks exit immediately when hook input has stop_hook_active: true to avoid recursive loops

Packaged skills must not depend on repo-root commands such as uv run python scripts/verify.py .... Keep executable hook commands in runtime-specific config, not in portable skill frontmatter.

State Management

Creation progress persists at ~/.{gemini|copilot|codex|claude}/skill-progress/<name>.json. Read/write via scripts/progress.py. Survives session restarts. Use --state-dir to override the default location.

Reference File Index

| File | Content | Read When | | --------------------------------- | ------------------------------------------------------------------------------------ | -------------------------------------------------- | | references/workflow.md | Unified skill lifecycle process for new and existing skills | Develop (new), Develop (existing), Eval, Benchmark | | references/refinement-plan.md | Standalone refinement-plan contract for existing-skill and repo-wide planning output | Plan (existing), Plan (repo-wide) | | references/audit-guide.md | Audit procedure, Audit All, Dashboard rendering, Gallery, grade thresholds | Audit, Audit All, Dashboard, Gallery | | references/proven-patterns.md | 14 structural patterns with examples from repo skills | Step 4 (Build), gap analysis | | references/best-practices.md | Anthropic guide + superpowers methodology + cross-agent awareness | Step 2 (Plan), Step 4 (Build), description writing | | references/frontmatter-spec.md | Full field catalog, invocation matrix, decision tree | Step 3 (Scaffold), frontmatter configuration | | references/packaging-guide.md | ZIP structure, manifest schema, portability checks, import instructions | Package | | references/evaluation-rubric.md | 13 weighted scoring dimensions normalized to 100, grade thresholds, pressure testing | Audit (pressure testing), scoring targets | | references/evidence-and-benchmarking.md | Lifecycle packet, behavioral evals, benchmark artifacts, trigger optimization | Eval, Benchmark, Compare, Optimize Description | | references/security-governance.md | Threat model, third-party intake, permission posture, hook/script safety | Security Audit, Step 2 (Plan), Package | | references/runtime-compatibility.md | Portable and runtime-specific fields, install paths, graceful degradation | Step 3 (Scaffold), Package, Security Audit | | references/orchestration-graph.md | Parallel lane graph, ownership, accounting, locks, judge layer | Scaling Strategy, repo-wide plans |

Read reference files as indicated by the "Read When" column above. Do not rely on memory or prior knowledge of their contents.

Core Principles

Conciseness is respect — The context window is shared. Every line competes with the agent's working memory. Earn every line or delete it.

Progressive disclosure — Frontmatter for discovery (~100 tokens), body for dispatch (<5K tokens), references for deep knowledge (on demand), scripts/templates for execution (never loaded).

Self-exemplar — This skill follows every pattern it teaches. When in doubt, look at how skill-creator applies it.

Validation Contract

Run from this skill directory before declaring changes complete:

uv run python scripts/check.py

Completion criteria:

1. uv run python scripts/check.py exits 0.
2. No portable-CLI violations remain under this skill directory.

Critical Rules

1. Run uv run python scripts/check.py from the target skill directory before declaring any skill complete
2. Re-run uv run python scripts/check.py after changing evals and before declaring the skill complete
3. Run uv run python scripts/audit.py after every significant SKILL.md change
4. Never create a skill without a dispatch table — it is the routing contract
5. Never create a dispatch table without an empty-args handler — unrouted input is a bug
6. Every reference file must appear in the Reference File Index — orphan refs are invisible
7. Every indexed reference must exist on disk — phantom refs cause agent errors
8. Body must stay under 500 lines (below frontmatter) — move detail to references
9. Description must include "Use when" trigger phrases AND "NOT for" exclusions
10. Names must be kebab-case, 2-64 chars, no consecutive hyphens, no reserved words
11. Scripts use argparse + JSON to stdout — no custom output formats
12. Templates are self-contained HTML with no external dependencies
13. Do NOT call repo-specific docs generators directly — delegate to docs-steward
14. Do NOT create agents or MCP servers — refuse gracefully and redirect
15. Improving existing skills requires presenting an improvement plan and getting user approval before implementing changes
16. Audit mode is read-only — never modify the skill being audited
17. Update evals when dispatch behavior or modes change — stale evals are invisible bugs
18. plan <name> and plan --all are read-only planning modes — never edit during planning
19. Repo-wide or multi-skill requests require a ranked plan and standalone refinement-plan output before any implementation begins
20. Runtime-projected Stop hooks must include a stop_hook_active guard — recursive hook loops are implementation bugs
21. Source-ground new skills in real workflow evidence; generic best-practice generation starts as needs-evidence
22. Benchmark meaningful changes against without_skill or old_skill before claiming behavioral improvement
23. Security-governance findings can block release even when static quality score is A
24. Choose an explicit permission posture for every skill that uses scripts, hooks, tools, network, credentials, or writes
25. Use OpenSpec before changing public eval schema, validation behavior, hook policy, packaging semantics, or generated-doc workflows
26. Do not run live installs, live behavioral evals, browser launches, or command-file injection from Plan, Audit, or Security Audit modes

Canonical terms (use these exactly throughout):

• Modes: "Develop (new)", "Develop (existing)", "Plan (existing)", "Plan (repo-wide)", "Audit", "Security Audit", "Audit All", "Eval", "Benchmark", "Compare", "Optimize Description", "Dashboard", "Package", "Gallery"
• Steps (Development): "Understand", "Plan", "Scaffold", "Build", "Validate", "Iterate"
• Grade scale: "A" (90-100), "B" (75-89), "C" (60-74), "D" (40-59), "F" (<40)
• Patterns: "dispatch-table", "reference-file-index", "critical-rules", "canonical-vocabulary", "scope-boundaries", "classification-gating", "scaling-strategy", "state-management", "scripts", "templates", "hooks", "progressive-disclosure", "body-substitutions", "stop-hooks"
• Audit dimensions: "frontmatter", "description", "dispatch-table", "body-structure", "pattern-coverage", "reference-quality", "critical-rules", "script-quality", "portability", "conciseness", "canonical-vocabulary", "evaluation-coverage", "validation-contract", "security-governance"