Skills skills-factory

📦

skills-factory

Name: skills-factory
Author: DaronVee

Content revision r1 Critical 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Build production-ready Claude Code skills

Creating reliable AI skills requires clear structure, validation, and deployment guidance. This skill provides templates, workflows, and scripts for building Claude Code skills with repeatable quality checks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "skills-factory" from https://skillstore.io/skills/daronvee-skills-factory.md and its manifest at https://skillstore.io/api/skills/daronvee-skills-factory/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/daronvee-skills-factory.md Signed manifest GET /api/skills/daronvee-skills-factory/manifest Signed lockfile GET /api/skills/daronvee-skills-factory/lockfile

Test it

Using "skills-factory". I need a skill that helps engineers write migration plans.

Expected outcome:

A suggested skill outline with a focused trigger, required metadata, reference guide list, validation checklist, and first evaluation scenarios.

Using "skills-factory". Check whether my skill is ready to share with my team.

Expected outcome:

Frontmatter review results
Missing reference warnings
Packaging readiness notes
Manual commands to review before execution

Using "skills-factory". Help me evaluate whether this skill triggers at the right time.

Expected outcome:

A test matrix with golden paths, non-trigger cases, edge cases, and criteria for revising the skill instructions.

Security Audit

Critical

v11 • 7/9/2026 Open versioned report

Most static findings are documentation examples for Claude skill installation, validation commands, and official Anthropic API usage. Confirmed risks are limited to user-facing local command guidance, an example recursive delete command, and installer filesystem changes that can overwrite or remove an existing skill directory after confirmation.

Files scanned

5,359

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Critical

references/DEPLOYMENT_GUIDE.md:67

Recursive delete on root/home

rm -rf ~/.claude/skills/my-skill

The documentation includes rm -rf against a home-directory skill path. Although scoped to a sample skill folder, recursive deletion in the user home area is dangerous if copied or modified.

Capability review items (29)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

references/DEPLOYMENT_GUIDE.md:67

Hidden file in home directory

rm -rf ~/.claude/skills/my-skill

The documentation shows a recursive delete command under the user home skill directory. It is example cleanup, but copying it with the wrong target could cause data loss.

Critical

references/DEPLOYMENT_GUIDE.md:67

Hidden file access

rm -rf ~/.claude/skills/my-skill

The documentation shows a recursive delete command under the user home skill directory. It is example cleanup, but copying it with the wrong target could cause data loss.

Medium

references/TROUBLESHOOTING.md:166-177

Ruby/shell backtick execution

Run: `grep -r "TODO: document" src/`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/TROUBLESHOOTING.md:177-182

Ruby/shell backtick execution

Run: `bash scripts/validate_docs.py`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/TROUBLESHOOTING.md:672-673

Ruby/shell backtick execution

Run: `python scripts/validate.py config.yaml`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/TROUBLESHOOTING.md:677-678

Ruby/shell backtick execution

Run: `python ~/.claude/skills/my-skill/scripts/validate.py config.yaml`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/VALIDATION_PATTERNS.md:472-474

Ruby/shell backtick execution

"Run: `npm run lint && npm test`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:60-66

Ruby/shell backtick execution

Run validation: `bash scripts/validate_format.py [document]`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:100-101

Ruby/shell backtick execution

- [ ] All tests passing (`npm test`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:101-102

Ruby/shell backtick execution

- [ ] No linting errors (`npm run lint`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:102-110

Ruby/shell backtick execution

- [ ] Code coverage ≥80% (`npm run coverage`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:110-111

Ruby/shell backtick execution

- [ ] Dependencies updated (`npm audit`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:111-116

Ruby/shell backtick execution

- [ ] No secrets in code (check with `git secrets --scan`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:116-119

Ruby/shell backtick execution

- [ ] Git tag created (`git tag v1.2.3`)

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:119-120

Ruby/shell backtick execution

**All items complete?** Run: `bash scripts/deploy.sh`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:178-180

Ruby/shell backtick execution

4. Run validation: `bash scripts/validate_openapi.py`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:192-194

Ruby/shell backtick execution

4. Validate schema: `bash scripts/validate_graphql_schema.py`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:206-208

Ruby/shell backtick execution

4. Validate: `protoc --lint_out=. *.proto`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:249-265

Ruby/shell backtick execution

1. Run test coverage: `npm run coverage`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:265-273

Ruby/shell backtick execution

4. Run new tests: `npm test [test-file]`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:273-274

Ruby/shell backtick execution

1. Run full coverage again: `npm run coverage`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:348-356

Ruby/shell backtick execution

Run: `bash scripts/validate_config.py`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:363-366

Ruby/shell backtick execution

Run: `openapi-generator generate -i spec.yaml -g typescript-fetch`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:370-371

Ruby/shell backtick execution

**If errors occur:** Check OpenAPI spec validity with `bash scripts/validate_spec.py`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

references/WORKFLOW_PATTERNS.md:457-460

Ruby/shell backtick execution

Run: `npm run build`

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

scripts/package_skill.py:76

Python shutil operations

shutil.rmtree(target_path)

The installer deletes an existing target skill directory before copying a replacement. The path is constrained to skill install locations and requires confirmation, but it can still remove user files under that target.

Medium

scripts/package_skill.py:81

Python shutil operations

shutil.copytree(skill_path, target_path)

The installer copies a user-selected skill directory into Claude skill locations. This is expected behavior, but it modifies filesystem state and should be disclosed.

Medium

SKILL.md:170-186

Ruby/shell backtick execution

- Load scripts when needed: "Run validation: `bash scripts/validate.py`"

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Medium

SKILL.md:262-265

Ruby/shell backtick execution

Team members get skill automatically on `git pull`.

The skill documentation asks users to run local development commands. They are ordinary validation or packaging commands, but marketplace users should review them before execution.

Risk Factors

🌐 Network access (8)

references/DEPLOYMENT_GUIDE.md:273 references/DEPLOYMENT_GUIDE.md:318 references/DEPLOYMENT_GUIDE.md:325 references/DEPLOYMENT_GUIDE.md:486 references/DEPLOYMENT_GUIDE.md:587 references/TROUBLESHOOTING.md:813 references/TROUBLESHOOTING.md:868 references/TROUBLESHOOTING.md:872

📁 Filesystem access (50)

🔑 Env variables (11)

references/DEPLOYMENT_GUIDE.md:274 references/DEPLOYMENT_GUIDE.md:293 references/DEPLOYMENT_GUIDE.md:319 references/DEPLOYMENT_GUIDE.md:326 references/DEPLOYMENT_GUIDE.md:487 references/DEPLOYMENT_GUIDE.md:588 references/TROUBLESHOOTING.md:814 references/TROUBLESHOOTING.md:869 references/TROUBLESHOOTING.md:873 references/VALIDATION_PATTERNS.md:81 references/VALIDATION_PATTERNS.md:85

⚙️ External commands (50)

Detected Patterns

Recursive delete on root/home

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/daronvee-skills-factory/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/daronvee-skills-factory/security.svg)](https://skillstore.io/skills/daronvee-skills-factory?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/daronvee-skills-factory?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/daronvee-skills-factory/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/daronvee-skills-factory.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DaronVee. (2026). skills-factory security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/daronvee-skills-factory/audits/11

BibTeX citation

@techreport{daronvee-daronvee-skills-factory-2026,
  author = {DaronVee},
  title = {skills-factory security audit report (audit version 11)},
  institution = {Skillstore},
  year = {2026},
  number = {11},
  url = {https://skillstore.io/skills/daronvee-skills-factory/audits/11},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skills-factory security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
  - name: "DaronVee"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/daronvee-skills-factory/audits/11"
identifiers:
  - type: other
    value: "skillstore:daronvee-skills-factory:audit:11"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a new team skill

Generate a structured skill with clear instructions, references, and validation steps before sharing it with a team.

Validate an existing skill

Check a skill for frontmatter, references, naming, and packaging issues before distribution.

Package skills for deployment

Prepare a skill folder for Claude Code, Claude Desktop, or API-based distribution using repeatable packaging guidance.

Try These Prompts

Start a basic skill

Help me create a simple Claude Code skill for [task]. Ask me for the goal, target users, and tools before drafting the structure.

Improve skill structure

Review my SKILL.md for clarity, progressive disclosure, required metadata, and missing reference files. Suggest specific edits.

Validate and package

Walk me through validating and packaging this skill. Explain each command before I run it and flag any filesystem changes.

Design an evaluation workflow

Create an evaluation plan for this skill using realistic success cases, edge cases, failure cases, and a second-agent review loop.

Best Practices

Review every generated command before running it, especially commands that copy, delete, or install files.
Keep SKILL.md concise and place detailed workflows in reference files.
Test skills with success, edge, and failure scenarios before sharing them.

Avoid

Do not create broad skills that trigger for unrelated development tasks.
Do not package secrets, private configuration, or local machine paths into shared skills.
Do not rely on packaging alone as proof that the skill is safe or useful.