knowledge/skill-creator/SKILL.md
Design, create, update, and package Agent Skills following the open AgentSkills specification (agentskills.io). Use when asked to create a new skill, improve an existing skill, scaffold a skill directory, validate a SKILL.md, or package a skill into a distributable .skill file.
npx skillsauth add aeondave/malskill skill-creatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Guidance for creating and maintaining high-quality Agent Skills across any AI agent ecosystem.
A skill is a self-contained folder that gives an AI agent specialized knowledge, workflows, and tools for a specific domain. Skills use the open AgentSkills specification.
skill-name/
├── SKILL.md # Required — frontmatter + instructions
├── scripts/ # Optional — executable code agents can run
├── references/ # Optional — docs loaded on demand into context
└── assets/ # Optional — templates, images, data files used in output
The context window is shared. Every token in a skill competes with the user's request. Challenge every sentence: does the agent actually need this to act? Write imperative instructions, not essays. Every skill must directly help the agent act on the task.
Design for staged loading to keep the context clean:
name + description onlySKILL.md body (baseline workflow, routing, and task guidance)scripts/, references/, assets/If a workflow gets deeply specific, move it to references/ so the agent only loads it when that specific subtask triggers.
Skills are executed by different AI agents (Claude, Gemini, Codex, etc.). Never hardcode a product name inside the skill body; say "the agent" instead.
Keep SKILL.md and references/ files stripped of benchmarks, "why we built this" defenses, and generic README material. Only include actionable rules and necessary constraints. Tell the agent what to do and the operational why (e.g., "because command X hangs the service"), not the philosophical why.
Follow these steps to build or refactor a skill:
Gather concrete usage examples first.
SKILL.md first. Identify what works, what is stale, and what must remain stable.Ask: what does an agent need to execute this repeatedly?
scripts/: Use when the same code is rewritten each time or deterministic output is required.references/: Use for specific subtasks, schemas, or guides needed dynamically. They must not fill context with non-actionable material.assets/: Use for boilerplate or templates the agent copies.For a new skill, run the init script:
python scripts/init_skill.py <skill-name> --path <output-dir> --resources scripts,references,assets --examples
For an existing skill, edit in place. Do not re-scaffold.
Required fields only:
---
name: my-skill # lowercase, hyphens, max 64 chars, matches folder name
description: "Single coherent paragraph covering what it does + when to use it; max 1024 chars."
---
Description rules: The description is the primary routing signal. Explicitly array the trigger words, file types, and scenarios. (Weak: "Helps with PDFs." Strong: "Extract text from PDF files, fill PDF forms. Use when the user asks about PDFs or document extraction.")
Write step-by-step instructions. Explain intent so agents can generalize, but keep it lean. Always end with a Resources section listing what is in scripts/, references/, and assets/ and exactly when to load them.
references/)SKILL.md and a reference file.Do not create: README.md, CHANGELOG.md, INSTALLATION_GUIDE.md. Evict any file that doesn't direct agent behavior.
Simulate realistic constraint scenarios (time pressure, authority pressure, sunk cost). Ensure the skill workflow forces the agent to behave correctly (e.g., verifying a scanner finding before claiming it). See references/pressure-testing-skills.md.
# Validate frontmatter
python scripts/quick_validate.py <path/to/skill-folder>
# Package into a .skill archive (validates first)
python scripts/package_skill.py <path/to/skill-folder>
Fix all errors. Resolve all unresolved markers before packaging.
After real usage:
description.references/.pdf-extractor).name field exactly.| Script | Purpose |
|---|---|
| scripts/init_skill.py | Scaffold a new skill directory with template |
| scripts/package_skill.py | Validate + zip a skill into a .skill file |
| scripts/quick_validate.py | Standalone SKILL.md frontmatter validator |
| scripts/check_changed_files.py | Safe changed-file newline and git diff --check hygiene checks |
development
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
development
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
development
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
databases
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.