Install
$ agentstack add skill-arenukvern-skill-steward-skill-authoring-lifecycle ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Skill authoring lifecycle
Add, review, and validate an installable skill package under skills/ in the Skill Steward marketplace.
When to use
- User wants a new skill in this repo
- "Review this skill" or "Is this SKILL.md valid?"
- Bootstrapping
SKILL.mdfornpx skillscompatibility - PR touches
skills/*/SKILL.md
Phase 1: Creation Workflow
- Verify intent — Does the intent overlap with an existing skill? Merge into an existing skill if they serve the same high-level goal or are two halves of the same lifecycle ([ADR 0016](../../docs/decisions/0016-skill-cohesion-and-lifecycle-boundaries.mdx)).
- Collect examples — Write 2–3 concrete user prompts that should trigger the skill and 1 prompt that should not. Skip only when the request already supplies clear usage patterns.
- Plan resources — Decide whether the skill needs instructions only,
scripts/for repeated or fragile operations,references/for detailed knowledge, orassets/for templates/static files. - Choose a name —
kebab-case, 1–64 chars, matches Agent Skills rules (seedocs/STANDARDS.mdx). - Create directory —
skills/{name}/(directory name must equalnamein frontmatter). - Copy template — from
templates/skill/SKILL.md; replace placeholders. - Write description — one concise block covering what and when (trigger phrases users say). Activation-critical routing belongs here, not only in a body "When to use" section.
- Cite sources — create
references/sources.mdfromtemplates/skill/references/sources.md; add rows for every spec/repo/paper used. - Write body — numbered steps, examples, output format; keep under 500 lines.
- Evals — T1 behavior-critical skills (see [STANDARDS](../../docs/STANDARDS.mdx)):
references/evals.md+ ≥2evals/cases/*.yaml. Others: optionalevals.md. - Optional metadata — add
agents/openai.yamlonly when Codex app UI metadata, invocation policy, or tool dependencies are useful. - Optional resources — create only the needed
scripts/,references/, andassets/directories; delete placeholder resources. - Register skill:
- Add skill id to
skills.sh.jsonusing the current repo schema. - Add row to root
README.mdskill table.
- Forward-test tricky skills — For broad or fragile workflows, use a fresh subagent/thread with a natural user prompt and raw artifacts. Do not leak the intended answer, suspected bug, or planned fix into the validation prompt.
Frontmatter template
---
name: {same-as-directory}
description: {capability + trigger phrases, 20-1024 chars}
license: MIT
type: governance
metadata:
author: skill-steward
version: "1.0.0"
category: {marketplace|multi-agent|...}
---
Phase 2: Review & Audit Checklist
Review a skill package before merge or publish to skills.sh.
Skill Cohesion
- [ ] Complete lifecycle: The skill covers a complete journey (e.g., creating + validating) rather than forcing an agent to switch tools mid-task.
- [ ] Mechanics included: Abstract rules or culture guidelines are bundled alongside the mechanical tools that enforce them.
Structure
- [ ] Directory name is
kebab-caseand matchesnamein frontmatter - [ ] File is exactly
SKILL.md(case-sensitive) - [ ] No
README.mdinside the skill folder (usereferences/)
Frontmatter
- [ ]
name: 1–64 chars,[a-z0-9-], no leading/trailing-, no-- - [ ]
description: 1–1024 chars, states capability and when to activate - [ ]
licenseset if not repo MIT - [ ]
metadata.versionandmetadata.author - [ ]
compatibilityif skill needs git, network, docker, or a specific product - [ ]
agents/openai.yamlpresent only when Codex-specific UI/policy/dependency metadata is useful
Body
- [ ] Clear numbered workflow
- [ ] Under ~500 lines (or split to
references/) - [ ] Relative file links one level deep
- [ ]
references/sources.mdwith URLs for external claims - [ ] Install command documented:
npx skills add arenukvern/skill_steward --skill
Distribution Readiness
- [ ] Skill can run from a copied directory without relying on repo-relative paths
outside its own package unless those paths are explicitly documented
- [ ] Agent-specific assumptions are isolated to optional metadata or references,
not baked into the core workflow
- [ ] If the skill may be bundled inside a product plugin, the product repo owns
the copy/init script and host manifests; the skill remains canonical in skills/{name}/
- [ ] Marketplace or plugin-readiness language distinguishes skills-only
install, local copy/init scripts, host manifests, and public marketplace submission proof
- [ ] Vendor-specific claims cite current Codex, Cursor, Claude, Zed, or
npx skills sources in references/sources.md
Scripts (if present)
- [ ] Shebang present (
bashornode) - [ ]
set -euo pipefailfor bash - [ ] stderr for logs, stdout for machine-readable output
- [ ] Representative scripts were actually run, or skipped with a recorded reason
Registry (this repo)
- [ ] Skill id in
skills.sh.json - [ ] Row in root
README.mdtable - [ ]
pnpm run validatepasses (nosources.mdwarning) - [ ] T1 behavior-critical:
evals/cases/*.yaml+pnpm run eval
Phase 3: Deprecation & Renaming (Changesets)
We do not keep permanent "tombstone" skills, as they clutter the repository. Instead, we treat skill renames and merges as breaking API changes and communicate them using standard ecosystem tooling (Changesets).
When renaming or merging a skill:
- Safely
rm -rfthe old skill directory. - Remove the old skill from
skills.sh.jsonandREADME.md. - Generate a changeset (
pnpm changeset) documenting the deletion, or manually create a.changeset/skill-consolidation.mdfile. Explain clearly why it was removed and which skill replaces it. - Agents and users reading the changelog will automatically see the redirection.
Output format for Reviews
Report as:
## Summary
{pass | needs changes}
## Errors (blocking)
...
## Warnings
...
Install
npx skills add arenukvern/skill_steward --skill skill-authoring-lifecycle
Sources
See [references/sources.md](references/sources.md). When researching, follow skill-source-citations.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Arenukvern
- Source: Arenukvern/skill_steward
- License: MIT
- Homepage: https://docs.page/arenukvern/skill_steward
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.