Skill Master

Skill Master

The definitive skill for creating, importing, and auditing agent skills. Ensures every skill follows the Agent Skills open standard, passes security vetting, and ships with proper documentation.

Mode Detection

Determine the operating mode from the user's request:

| User Says | Mode | Reference | |-----------|------|-----------| | "create a skill", "build a skill", "new skill", "help me make a skill" | CREATE | [creation-workflow.md](references/creation-workflow.md) | | "import this skill", "install skill from [URL]", pastes a link to a skill | IMPORT | [import-audit-workflow.md](references/import-audit-workflow.md) | | "review my skill", "check this skill", "audit skill", "is this skill safe" | REVIEW | Run both quality + security checks inline |

If ambiguous, ask: "Are you creating a new skill, importing one from somewhere, or reviewing an existing one?"

Quick Reference: What Makes a Valid Skill

skill-name/           # kebab-case, matches frontmatter name
├── SKILL.md           # REQUIRED — YAML frontmatter + markdown body
├── scripts/           # Optional — executable code
├── references/        # Optional — docs loaded on demand
└── assets/            # Optional — templates, resources

Frontmatter (between --- markers):

• name (required): 1-64 chars, lowercase + hyphens only, no consecutive hyphens, must match directory name
• description (required): 1-1024 chars, third-person, what it does + when to use it, no XML tags
• license, compatibility, metadata, allowed-tools: all optional

See [spec-quick-reference.md](references/spec-quick-reference.md) for the full specification.

CREATE Mode

Read and follow [creation-workflow.md](references/creation-workflow.md). Summary:

1. Understand — Ask purpose, audience, and use cases
2. Deduplicate — Check if an existing skill already covers the same ground
3. Decide — Walk user through 4 critical architectural decisions (explained for non-technicals)
4. Draft — Generate frontmatter + SKILL.md body with progressive disclosure
5. Supplement — Recommend complementary skills from the ecosystem
6. Validate — Run scripts/validate_skill.py and scripts/security_scan.py
7. Scaffold — Create the full directory structure
8. Ship — Generate GitHub README, guide user to host publicly

IMPORT Mode

Read and follow [import-audit-workflow.md](references/import-audit-workflow.md). Summary:

1. Fetch — Download skill from URL
2. Scan — Run scripts/security_scan.py on ALL files
3. Report — Present findings with severity + plain-English explanations
4. Gate — Block DANGER, warn on CAUTION, approve SAFE
5. Validate — Check structure + frontmatter against spec
6. Supplement — Suggest complementary skills
7. Deduplicate — Check if an existing skill already covers the same ground
8. Install — Place in correct directory

REVIEW Mode

Combine both checks on an existing skill:

1. Run python ${CLAUDE_SKILL_DIR}/scripts/validate_skill.py
2. Run python ${CLAUDE_SKILL_DIR}/scripts/security_scan.py
3. Read [quality-checklist.md](references/quality-checklist.md) and evaluate manually
4. Check for duplicate or overlapping skills already installed
5. Present combined report with actionable fixes

Security: Non-Negotiable

Every skill — created, imported, or reviewed — gets scanned. See [security-checklist.md](references/security-checklist.md) for the full threat model.

DANGER signals (block immediately):

• Environment variable exfiltration (credential file access, .env reads)
• Obfuscated code (encoded payloads decoded then executed)
• Download-and-execute patterns (piping remote scripts to shell)
• Prompt injection (role overrides, safety suppression, instruction hijacking)
• Outbound data transmission to unknown domains

CAUTION signals (warn user, require explicit approval):

• Third-party URL fetching
• Overly broad tool permissions
• Scripts that spawn subprocesses
• File operations outside the skill directory

Supplementary Skills

After creating or importing a skill, consult [supplementary-skills-guide.md](references/supplementary-skills-guide.md) to recommend complementary skills from:

• The official Anthropic skills repository (github.com/anthropics/skills)
• SkillHub (skillhub.club) — 24,000+ community skills
• The user's already-installed skills

Ask the user if they want to add any as cross-references or bundled references.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: hexcantcode
• Source: hexcantcode/skill-master
• License: MIT

Install and usage instructions live in the source repository linked above.