skills/team/skill-creator/SKILL.md
Create, modify, and audit AI agent skills in this toolkit. Use when scaffolding a new SKILL.md from the 5-section lean layout, revising an existing skill to fix structural defects, or scoring a skill against the 10-dimension rubric. Trigger phrases: "create skill", "new skill", "scaffold skill", "write skill", "revise skill", "update skill", "score skill", "audit skill quality". Do NOT use when the goal is to run a skill (invoke the skill directly); do NOT use when the goal is to create an agent definition (use AGENTS.md conventions).
npx skillsauth add michaelalber/ai-toolkit skill-creatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Precision in instructions is not pedantry — it is the difference between a tool that does what you intend and one that does what you said." -- adapted from Fred Brooks, "The Mythical Man-Month"
A skill is a reusable, invocable instruction set for an AI agent. Its quality is measured by one
criterion: does it cause the agent to behave correctly, reliably, and without ambiguity? Beautiful
prose is worthless if the skill triggers on the wrong prompts, fails to stop when it should, or
produces inconsistent outputs. Full-template skills use the 5-section lean layout — Core
Philosophy, Workflow, State Block, Output Template, Integration — and push all depth (principle
tables, discipline rules, anti-patterns, error recovery, code/report templates) to references/,
loaded just-in-time. Every always-loaded section is a per-invocation token tax.
Non-Negotiable Constraints:
references/ directory with ≥ 2 supporting files before it is complete.references/, never more inline sections.Full principle table, discipline rules, anti-patterns, and error recovery live in
references/conventions.md.
Mode: CREATE — scaffold a new skill
LOAD Read a lean gold standard: skills/team/cargo-package-scaffold/SKILL.md (domain
scaffolder) or skills/team/qraspi-skeleton/SKILL.md (phase driver). Note the 5-section
structure, description format, and reference-pointer pattern.
INTAKE Ask: one-sentence purpose? trigger phrases? negative triggers (Do NOT use when)?
how many workflow modes (1 simple, 2-3 multi-mode)?
DRAFT Write the 5 sections from references/skill-template.md. Fold Critical/High principles
into Non-Negotiable Constraints. Create references/conventions.md (full principle
table, WRONG/RIGHT discipline rules, anti-patterns, error recovery) + a templates
reference. Leave stubs where content is unknown.
DESCRIBE Write the description LAST: ≤ 1024 chars, third person, sentence 1 = what it does,
sentence 2 = "Use when…", plus a "Do NOT use when…" negative trigger.
VERIFY [ ] 5 sections present [ ] description has a "Do NOT use when…" clause
[ ] state block XML tag unique (grep skills/) [ ] SKILL.md ≤ 200 lines
[ ] references/ has ≥ 2 files, each named by a pointer in Output Template
[ ] conventions.md has the 10-row principle table, ≥ 3 WRONG/RIGHT rules,
≥ 8-row anti-patterns table, ≥ 3 error-recovery scenarios
REPORT Skill path, sections complete, line count, references count, issues found.
Mode: REVISE — fix an existing skill
LOAD/PATCH Read the target + a gold standard; identify defects via the rubric. Patch minimally;
never change the state block tag; move inline depth to references rather than deleting.
Migrating a legacy 10-section skill: see the recovery steps in conventions.md.
VERIFY Run the CREATE checklist; confirm no regressions and the state tag is unchanged.
REPORT Revision diff summary (references/templates.md).
Mode: SCORE — audit against the rubric
Load references/scoring-rubric.md; score each of 10 dimensions 1–5 with evidence; classify
(≥45 EXEMPLARY · 35–44 PASS · 25–34 REVISE · <25 DEPRECATE); emit the scorecard (templates.md).
Exit criteria: CREATE — all 5 sections present, ≤ 200 lines, unique state tag, ≥ 2 references with the depth offloaded, description with a negative trigger. REVISE — defects patched, no regressions, state tag unchanged. SCORE — full scorecard with a verdict and severity-ranked issues.
<skill-creator-state>
mode: create | revise | score
target_skill: [skills/<name>/SKILL.md or "new"]
sections_complete: [N]/5
line_count: [N]
references_count: [N]
state_tag_unique: true | false
last_action: [what was just done]
next_action: [what should happen next]
</skill-creator-state>
references/skill-template.md.references/templates.md.references/scoring-rubric.md.references/conventions.md.| Skill | Relationship |
|-------|-------------|
| spec-coach | For creating agent definitions, PRDs, or Spec Kit files, or any interactive spec design session — use it instead of this skill, which targets SKILL.md files. |
| cargo-package-scaffold / qraspi-skeleton | The lean gold standards. Read one before scaffolding or revising. |
| automated-code-review | Run after creating or revising a skill to quality-check the new content against project conventions. |
| session-context | Use at the start of a revision session to understand what changed in the skills suite since last time. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".