building-skills
Build Claude Code Skills Correctly
Creating reliable AI skills requires clear triggers, safe permissions, and valid structure. This skill guides Claude, Codex, and Claude Code users through design, validation, and maintenance.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "building-skills" from https://skillstore.io/skills/c0ntr0lledcha0s-building-skills.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-building-skills/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "building-skills". Create a skill for reviewing Terraform plans.
Expected outcome:
A proposed skill name, trigger-focused description, capability list, resource plan, and validation checklist for Terraform review workflows.
Using "building-skills". Check why my skill is not loading.
Expected outcome:
A review of frontmatter, file placement, naming, description clarity, resource paths, and allowed-tools formatting.
Using "building-skills". Should this workflow be a skill or an agent?
Expected outcome:
A recommendation based on invocation style, context needs, isolation, resource usage, and expected user control.
Security Audit
Medium RiskThe static findings are false positives caused by Markdown code fences, inline code examples, example paths, and validator messages. No prompt injection, credential exfiltration, or malicious command execution was found. The remaining concern is broad pre-approved Write, Edit, and Bash access in a community skill.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (97)
📁 Filesystem access (2)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/c0ntr0lledcha0s-building-skills/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/c0ntr0lledcha0s-building-skills?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/c0ntr0lledcha0s-building-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-building-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-building-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
C0ntr0lledCha0s. (2026). building-skills security audit report (audit version 8) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-building-skills/audits/8BibTeX citation
@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-building-skills-2026,
author = {C0ntr0lledCha0s},
title = {building-skills security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/c0ntr0lledcha0s-building-skills/audits/8},
note = {Author version 2.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "building-skills security audit report (audit version 8)"
version: "2.0.0"
type: report
authors:
- name: "C0ntr0lledCha0s"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/c0ntr0lledcha0s-building-skills/audits/8"
identifiers:
- type: other
value: "skillstore:c0ntr0lledcha0s-building-skills:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Create a New Skill
Plan a skill directory, write SKILL.md guidance, choose resources, and validate the result before use.
Standardize Existing Skills
Review frontmatter, naming, descriptions, allowed-tools, and resource references against Claude Code conventions.
Audit Skill Architecture
Decide whether a workflow should be a skill, agent, or command, then document the right structure.
Try These Prompts
Create a Claude Code skill for [domain]. Include a clear name, auto-invocation description, capabilities, and basic resource sections.
Review this skill directory for schema issues, unclear triggers, risky permissions, missing resources, and invalid frontmatter.
Rewrite this skill description so Claude invokes it only for the right tasks. Keep it specific and under the schema limit.
Given this workflow, decide which parts should be skills, agents, or commands. Explain the directory structure and permission model.
Best Practices
- Write descriptions that state exactly when the skill should activate.
- Keep allowed-tools minimal and add write or shell access only when required.
- Validate SKILL.md, resource paths, and examples before sharing a skill.
Avoid
- Do not add a model field to skill frontmatter.
- Do not use vague descriptions that apply to many unrelated tasks.
- Do not grant Bash or write permissions for read-only guidance skills.
Frequently Asked Questions
What does this skill help me build?
Can it decide between a skill, agent, and command?
Does it include a validator?
Does it guarantee a skill is safe?
Can Codex users use this skill?
When should I avoid this skill?
Developer Details
Author
C0ntr0lledCha0sLicense
MIT
Author version
v2.0.0
Skillstore revision
r1
Ref
5ab1d37e83436c6eef84de88573e142b94f2a4ad
Maintenance freshness
7/22/2026
Usage
8 downloads · 335 views
File structure