knowledge/skill-creator/SKILL.md
Design, create, update, and package Agent Skills following the open AgentSkills specification (agentskills.io). Use when asked to create a new skill, improve an existing skill, scaffold a skill directory, validate a SKILL.md, or package a skill into a distributable .skill file.
npx skillsauth add aeondave/malskill skill-creatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Guidance for creating and maintaining high-quality Agent Skills that work across all AI agents.
A skill is a self-contained folder that gives any AI agent specialized knowledge, workflows, and tools for a specific domain. Skills use the open AgentSkills specification.
skill-name/
├── SKILL.md # Required — frontmatter + instructions
├── scripts/ # Optional — executable code agents can run
├── references/ # Optional — docs loaded on demand into context
└── assets/ # Optional — templates, images, data files used in output
The context window is shared. Every token in a skill competes with the user's request, conversation history, and other skills. Challenge every sentence: does the agent actually need this? Prefer short examples over verbose explanations.
Design for staged loading:
name + description onlySKILL.md body (soft target: ~500 lines of substantive content)scripts/, references/, assets/Move detail to references/ so the agent loads only what it needs.
The line target is a guideline, not a hard limit and not enforced by the validator. Count only substantive prose, examples, and tables — exclude link-only sections such as ## Reference Files, ## Scripts, ## Assets, and the trailing ## Resources index. A skill with 30 reference links does not need to be split just because its file length grows; what matters is that the agent's working context stays focused. Split only when the body itself becomes hard to navigate or repeats material that belongs in a reference.
Skills are executed by different AI agents (Claude, Gemini, Codex, etc.). Write instructions in imperative form. Never hardcode a product name inside the skill body; say "the agent" instead.
Prefer explaining why a behavior matters over stacking rigid rules. Agents have strong theory of mind — when they understand the reasoning, they generalize better than when they follow mechanical constraints. If you find yourself writing ALWAYS or NEVER in caps, reframe as a rationale instead.
Gather concrete usage examples before writing anything. If the conversation already contains a workflow the user wants to capture, extract intent from it first — tools used, step sequence, corrections made, input/output formats observed. Only ask for what the conversation does not already answer; bias toward action.
When updating an existing skill, read the current SKILL.md first, then inspect only the scripts, references, or assets touched by the requested change. Identify three things before editing: what already works, what is stale, and what must remain stable (usually the skill's name, folder, and core activation scope).
Key questions (ask at most two at a time):
For a new skill, conclude with 3–5 representative usage examples. For an update, conclude with a clear statement of what changes, what stays, and what success looks like after the edit.
For offensive, research, or workflow skills, also identify likely failure pressure: time pressure, confidence, sunk cost, scanner authority, scope creep, destructive shortcuts, and overclaiming. These become evaluation scenarios later.
For each example, ask: what would an agent need to execute this repeatedly?
| Resource type | Use when |
|---|---|
| scripts/ | Same code is rewritten each time; deterministic output required |
| references/ | Agent needs detailed docs, schemas, or policies at runtime |
| assets/ | Output includes templates, images, or boilerplate the agent copies |
Produce a short resource plan before writing any code.
For a new skill, run the init script to scaffold the directory:
python scripts/init_skill.py <skill-name> --path <output-dir>
# With optional resource dirs and example placeholders:
python scripts/init_skill.py <skill-name> --path <output-dir> --resources scripts,references,assets --examples
The script creates the skill folder, a SKILL.md template with TODO placeholders, and optionally example files in each resource directory.
For an existing skill, do not re-scaffold it. Edit in place, or copy it to a writable location first if needed. Preserve the folder name and name field unless the user explicitly wants a rename or repositioning.
Note: Use the absolute path to this skill-creator's
scripts/directory.
Required fields only; no extras:
---
name: my-skill # lowercase, hyphens, max 64 chars, matches folder name
description: "Single coherent paragraph covering what it does + when to use it; max 1024 chars."
---
Optional fields (add only when meaningful):
license: MIT
compatibility: Requires Python 3.11+, git
metadata:
author: your-org
version: "1.0"
allowed-tools: Bash(python:*) Read # experimental
Description rules:
Example:
"Helps with PDFs.""Extract text and tables from PDF files, fill PDF forms, merge and split PDFs. Use when the user asks about PDFs, document extraction, form filling, or page manipulation — even if they don't say 'PDF' explicitly."Write step-by-step instructions the agent follows. Common structural patterns:
| Pattern | Best for | |---|---| | Workflow-based | Sequential processes with clear steps | | Task-based | Tool collections with distinct operations | | Reference/guidelines | Standards, policies, brand guides | | Capabilities-based | Integrated systems with interrelated features |
Mix patterns as needed. Always end with a Resources section listing what is in scripts/, references/, and assets/ and when to use each file.
Writing guidance:
scripts/)# requires: package comment or a requirements.txtreferences/)SKILL.md with a note on when to load themSKILL.md and a reference fileassets/)assets/project-template/)Do not create: README.md, CHANGELOG.md, INSTALLATION_GUIDE.md, or any file that documents the skill creation process rather than the skill's domain. Every file must justify its presence to an agent executing the skill.
Before declaring a new or majorly refactored skill done, test whether it changes agent behavior under realistic pressure. Do not quiz the agent on the skill text; simulate situations where it would be tempted to skip the workflow, overclaim evidence, broaden scope, or take a shortcut. Also test whether natural prompts trigger the skill when the user does not name it directly.
Use references/pressure-testing-skills.md when the skill controls safety, evidence, scope, debugging discipline, research quality, or multi-step execution. Use references/skill-triggering-tests.md when the risk is under-triggering, over-triggering, or weak descriptions.
Validate:
python scripts/quick_validate.py <path/to/skill-folder>
# Or the official CLI (if installed):
skills-ref validate <path/to/skill-folder>
Fix all errors. Resolve all TODO markers before packaging.
Package:
python scripts/package_skill.py <path/to/skill-folder>
# Optional output dir:
python scripts/package_skill.py <path/to/skill-folder> ./dist
The packager validates first, then creates <skill-name>.skill (a zip file). Output path is printed on success.
Install the packaged skill using your agent platform's install mechanism (CLI/UI). If your platform supports scopes, prefer workspace/repo scope while iterating.
After installation, reload skills (if required by the platform), then run one representative example from Step 1 and verify:
For updates, full reinstall is usually unnecessary — validate with quick_validate.py, then test the changed behavior with one representative prompt.
After real usage, revisit:
descriptionSKILL.md getting hard to navigate (ignoring link/index sections)? → Move detail into references/scripts/Iteration mindset: Generalize from specific feedback — a fix for one test prompt should improve all similar prompts, not just that one. Resist adding narrow patches; instead find the underlying instruction gap and address it. Challenge every line: if removing it doesn't hurt outputs, delete it.
pdf-extractor, gh-address-commentsname field exactlycode-review, rotate-pdf, deploy-awsgh-, linear-, jira-| Script | Purpose |
|---|---|
| scripts/init_skill.py | Scaffold a new skill directory with template |
| scripts/package_skill.py | Validate + zip a skill into a .skill file |
| scripts/quick_validate.py | Standalone SKILL.md frontmatter validator |
| scripts/check_changed_files.py | Safe changed-file newline and git diff --check hygiene checks |
data-ai
Scoped routing: Linux operator; hosts, sessions, users, services, packages, logs, containers, SSH, network paths, privilege evidence.
development
Offensive methodology for ICS/OT/SCADA environments in authorized industrial penetration testing and red team operations. Use when assessing PLCs, RTUs, HMIs, engineering workstations, historians, or field devices running Modbus, DNP3, EtherNet/IP, S7comm/S7+, Profinet, IEC 60870-5-104, BACnet, or OPC-UA. Covers passive OT network enumeration, protocol-level device interrogation, PLC coil/register read-write attacks, HMI session exploitation, historian and engineering workstation compromise, and safe escalation rules for critical infrastructure scope. Does not cover: general IT network exploitation (network-technique), physical hardware interfaces UART/JTAG/SPI (hardware-technique), wireless sensor network attacks (wireless-technique), RF/SDR signal analysis (hardware-ctf or wireless-technique), or CTF-framed ICS lab tasks (ics-ctf).
tools
Offensive methodology for authorized game security assessments, game client security research, and game-adjacent penetration testing in real-world engagements. Use when assessing game clients for cheating vulnerabilities, testing anti-cheat effectiveness, auditing game server protocols for score manipulation or economic fraud, reverse engineering game DRM or license validation, analyzing game save file protection, or assessing game mod/plugin security. Covers: process memory scanning and manipulation (Cheat Engine methodology), game binary reversing for license and DRM bypass, game network protocol analysis and packet replay, anti-cheat mechanism analysis, save file format reversing and tampering, speed hack and value injection techniques. Does NOT cover: CTF game challenges (game-ctf), game engine source code auditing (web-exploit-technique or vuln-search-technique for the backend), or general binary exploitation (pwn-ctf or reversing-technique).
development
Auth assessment: hardware/embedded methodology; UART/JTAG/SWD/SPI/I2C, firmware extraction, boot/debug paths, embedded OS evidence.