Install
$ agentstack add skill-paldom-skillskit-create-skill-repo ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
create-skill-repo
Stamps out a new skills repository: gh repo create provisions it on GitHub (private by default, MIT license, technology .gitignore, README) and clones it into the current directory; the bundled template (assets/template/ inside this skill) is then overlaid — OSS hygiene files, CI with a skills.sh consumer job, validation hooks, in-repo add-skill/publish-repo dev skills, plugin/marketplace manifests, skills.sh.json, and a gitignored .local/PROMPT.md that drives the follow-up authoring session. The scaffold overlay is left uncommitted (GitHub's repo creation makes only its own initial commit): the owner reviews, commits, pushes. Reference: . If invoked as /create-skill-repo , $ARGUMENTS is [idea].
When NOT to use
- Writing or fixing a skill inside an existing repo →
add-skill(or that repo's
bundled copy).
- Turning a research pack into skills →
skill-from-research(it calls this
skill when a new repo is actually needed).
- Improving the scaffold itself → edit
assets/template/in a skillskit checkout
(changes affect future repos only).
Workflow
- Derive the four inputs from the user's request; ask only if genuinely absent:
name: kebab-case repo name. Single skill → the skill's name
(icon-designer); collection → a plural theme (python-skills).
description: one professional, benefit-led sentence with plain category
keywords — it becomes the GitHub repo description, README intro, and plugin manifest. ≤ ~250 chars, no hype words.
idea: the user's high-level intent, 1–4 sentences, as literally as
possible — it seeds .local/PROMPT.md for the in-repo authoring session.
gitignore: the GitHub.gitignoretemplate matching the skills' dominant
technology (Python default — the scaffold's own tooling is Python).
- Scaffold (deterministic — always via the script, never hand-copy or raw
gh):
``bash python3 "${CLAUDE_SKILL_DIR}/scripts/scaffold.py" \ --description "" --idea "" [--gitignore ] ` Options: --owner (default: the authenticated gh user), --public (default private), --topics extra1,extra2 (added to agent-skills,claude-code,skills,skills-sh), --dest DIR (default: cwd), --local-only (offline: folder + git init, no GitHub; requires --owner), --keep-on-fail. The script validates inputs (including that the seeded .local/PROMPT.md goal fits 4000 characters — shorten the idea if it fails), checks gh auth (needs the workflow` scope), refuses names taken locally or on GitHub, validates the scaffold, and cleans up the local clone on failure. It NEVER runs git commit/push (the owner does) and never deletes remote repos — on failure it prints the exact cleanup command instead.
- Verify: success ⇔ the script's final line is
SCAFFOLD OK:(exit 0).
On failure, read its report, fix the cause (never by weakening the generated repo's scripts/validate_skills.py), and re-run.
- Hand off — tell the user exactly:
`` cd && claude # then paste the contents of .local/PROMPT.md (starts with /goal) ` Mention: the repo shell is live (private) on GitHub but the scaffold is uncommitted — review, commit, push (exact commands are in the script output); .local/ is gitignored — drop research packs/sources there before starting; publishing to skills.sh later runs via the repo's bundled /publish-repo`.
Output spec
New folder / under the current directory: a clone of the freshly created GitHub repo (private, MIT, tech .gitignore merged with the template's), overlay left uncommitted for owner review, validator passing, repo topics set, .local/PROMPT.md filled with the idea (≤4000 chars, enforced), no leftover {{PLACEHOLDER}} tokens anywhere.
Gotchas
- Requires an authenticated
gh(gh auth login) with theworkflowscope; the
script prints the exact gh auth refresh command if missing.
- Names must match
^[a-z0-9]+(-[a-z0-9]+)*$and must not contain
"claude"/"anthropic" (reserved by the skills spec); free locally and on GitHub.
--gitignorevalues are case-sensitive GitHub template names
(gh api gitignore/templates); the script pre-checks them.
- The template ships its gitignore as
_gitignore(a live one inside skill
assets would be applied by the host repo's git); the script restores the real name during overlay — don't "fix" it in the assets.
.local/PROMPT.mdis personal and machine-local — no committed copy exists in
generated repos.
Files
scripts/scaffold.py— the deterministic scaffolder (stdlib only).assets/template/— the complete repo scaffold that gets overlaid.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Paldom
- Source: Paldom/skillskit
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.