Skills creating-skills

📦

creating-skills

Name: creating-skills
Author: Asmayaseen

Content revision r2 High Risk ⚡ Contains scripts⚙️ External commands📁 Filesystem access

Create Effective Agent Skills

Designing reliable Agent Skills requires clear triggers, focused instructions, reusable resources, and validation. This skill provides a practical workflow and local scripts for that process.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "creating-skills" from https://skillstore.io/skills/asmayaseen-creating-skills.md and its manifest at https://skillstore.io/api/skills/asmayaseen-creating-skills/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-creating-skills.md Signed manifest GET /api/skills/asmayaseen-creating-skills/manifest Signed lockfile GET /api/skills/asmayaseen-creating-skills/lockfile

Test it

Using "creating-skills". Create a skill for reviewing pull requests.

Expected outcome:

Recommended name: reviewing-pull-requests
Trigger scope: code review requests with a repository or patch
Resources: focused review checklist and optional repository-specific references

Using "creating-skills". Why does my document skill activate for format conversion?

Expected outcome:

The description needs a clear exclusion for conversion tasks and narrower triggers for document creation or tracked-change editing.

Using "creating-skills". Validate my existing skill before release.

Expected outcome:

Frontmatter and name checks completed
Resource layout reviewed for progressive disclosure
Packaging blocked because the bundled validation dependency is missing

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

The eval and shell-execution alerts are false positives caused by prose, Markdown code fences, and inline code formatting. However, the activation reference promotes coercive prompt injection. The initializer permits path escape, and the packager can include files reached through symlinks.

Files scanned

919

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

references/skill-activation.md:15-23 references/skill-activation.md:53-59

Prompt Injection Attempt Detected

The guide says “Force Claude to explicitly evaluate each skill” and supplies “MANDATORY” and “CRITICAL” directives. It recommends injecting coercive instructions on every user prompt to manipulate model behavior.

The document explicitly recommends forced activation prompts and aggressive wording to make instructions harder for the model to ignore.

Medium

scripts/init_skill.py:205-215 scripts/init_skill.py:287-294

Unvalidated Skill Name Allows Path Escape

The initializer joins an unchecked skill_name to the output path before creating files. Absolute names or dot segments can escape the requested directory.

The CLI value is used directly as a pathlib operand, and no documented name validation is implemented before directory creation.

Medium

scripts/package_skill.py:68-74

Archive Packaging Can Follow File Symlinks

The packager accepts any file reported by is_file and writes it to the archive. A symlink can include file contents outside the selected skill directory.

Path.is_file and ZipFile.write follow file symlinks, while the loop performs no resolved-path containment check.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-creating-skills/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-creating-skills/security.svg)](https://skillstore.io/skills/asmayaseen-creating-skills?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-creating-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-creating-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-creating-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). creating-skills security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-creating-skills/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-creating-skills-2026,
  author = {Asmayaseen},
  title = {creating-skills security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-creating-skills/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "creating-skills security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-creating-skills/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-creating-skills:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

6 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

BrendanShields Recommended

brendanshields-creating-skills

Skillstore Score 79

Evidence Confidence High

Skillstore usage 18

Updated

2026-08-21

BPSAI

bpsai-creating-skills

Skillstore Score 78

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

AgentWorkforce

agentworkforce-creating-skills

Skillstore Score 77

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

Bae-ChangHyun

bae-changhyun-creating-skills

Skillstore Score 71

Evidence Confidence High

Skillstore usage 13

Updated

2026-08-21

Asmayaseen Current

asmayaseen-creating-skills

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 12

Updated

2026-08-21

Awais68

awais68-creating-skills

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build a First Agent Skill

Turn a repeated workflow into a structured skill with clear triggers and reusable resources.

Standardize Team Skills

Apply consistent structure, validation, and review patterns across an internal skill library.

Repair an Existing Skill

Improve activation metadata, reorganize large instructions, and verify required files before release.

Try These Prompts

Scaffold a Skill

Create an Agent Skill named [name] for [workflow]. Ask for missing examples, then scaffold the required files in [directory].

Improve Activation Metadata

Review [skill path] and improve its name and description. Focus on specific trigger conditions, exclusions, and concise wording.

Plan Reusable Resources

Analyze these requests: [examples]. Recommend which logic belongs in SKILL.md, scripts, references, or assets, with reasons.

Audit and Prepare a Skill

Review [skill path] for structure, activation, resource design, validation gaps, and security risks. Fix confirmed issues and report remaining limitations.

Best Practices

Start with concrete user requests before choosing structure or bundled resources.
Keep SKILL.md concise and move detailed material into references.
Validate generated files and test the skill on realistic requests before release.