Skills when-creating-skill-template-use-skill-builder

📦

when-creating-skill-template-use-skill-builder

Name: when-creating-skill-template-use-skill-builder
Author: DNYoussef

v1.0.0 Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access

Build Claude Code Skill Templates

Creating reusable AI skills requires consistent files and metadata. This skill guides Claude Code and Codex through a structured template workflow.

Supports: Claude Codex Code(CC)

📊 71 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-creating-skill-template-use-skill-builder" from https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-creating-skill-template-use-skill-builder.md Signed manifest GET /api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/manifest Signed lockfile GET /api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/lockfile

Test it

Using "when-creating-skill-template-use-skill-builder". A user asks for a skill template for release note generation.

Expected outcome:

A SKILL.md outline with metadata, triggers, phases, and validation criteria.
A README.md quick start section for the release note workflow.
A PROCESS.md workflow summary and diagram plan.

Using "when-creating-skill-template-use-skill-builder". A user provides a workflow and asks for validation guidance.

Expected outcome:

A checklist for YAML validity, required files, documentation completeness, and dry-run behavior.
Warnings to review local commands before execution.
Suggested success metrics for the generated skill.

Using "when-creating-skill-template-use-skill-builder". A team wants a consistent structure for internal AI skills.

Expected outcome:

The skill produces a reusable creation process with naming rules, metadata fields, file expectations, and review checkpoints.

Security Audit

Medium Risk

v9 • 7/5/2026 Open versioned report

Most static findings are false positives caused by Markdown fences, JavaScript template literals, checklist text, and identifiers such as phase.key. The meaningful risk is that the skill guides users to run npx claude-flow@alpha and other local commands, which requires explicit review and safer dependency handling.

Files scanned

746

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:16-17 SKILL.md:155-156 SKILL.md:280-281 SKILL.md:341-343 SKILL.md:473-486 README.md:13-18

Unpinned Alpha CLI Execution Guidance

The skill repeatedly instructs users to run npx claude-flow@alpha commands. Running an unpinned alpha package can execute third-party code during skill generation and validation.

Multiple documented examples use npx claude-flow@alpha and the dependency is declared in the skill. This shows intentional third-party CLI execution guidance, but I found no evidence of exfiltration or malicious payloads.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:329-338

Ruby/shell backtick execution

```bash

The referenced Bash validation block tells the user to run npx js-yaml, dot, and test against local files. These are legitimate validation commands, but they are external process execution and depend on local tooling.

Medium

SKILL.md:341-351

Ruby/shell backtick execution

```bash

The Bash dry-run block invokes npx claude-flow@alpha and branches on shell exit status. Running a community skill command through npx can execute third-party package code.

Medium

SKILL.md:473-479

Ruby/shell backtick execution

```bash

This common pattern instructs users to run npx claude-flow@alpha skill-run with parameters. The command is intentional guidance for external CLI execution, even though it is documented as an example.

Medium

SKILL.md:482-487

Ruby/shell backtick execution

```bash

This Bash example invokes npx claude-flow@alpha skill-builder and writes output into a skills directory. It is useful tooling, but it executes an external package and may modify local files.

Risk Factors

⚙️ External commands (67)

SKILL.md:46-61 SKILL.md:61-64 SKILL.md:64-90 SKILL.md:90-93 SKILL.md:93-107 SKILL.md:107-123 SKILL.md:123-134 SKILL.md:134-144 SKILL.md:144 SKILL.md:146 SKILL.md:152-155 SKILL.md:155 SKILL.md:157 SKILL.md:165 SKILL.md:167 SKILL.md:171-174 SKILL.md:174-184 SKILL.md:184 SKILL.md:186 SKILL.md:189-198 SKILL.md:198-201 SKILL.md:201-208 SKILL.md:216 SKILL.md:220-227 SKILL.md:227-230 SKILL.md:230-236 SKILL.md:239-243 SKILL.md:246-248 SKILL.md:248-264 SKILL.md:264-272 SKILL.md:278-279 SKILL.md:282-283 SKILL.md:287-289 SKILL.md:289-292 SKILL.md:292-294 SKILL.md:294-295 SKILL.md:295-303 SKILL.md:303-306 SKILL.md:306-309 SKILL.md:309-310 SKILL.md:310-311 SKILL.md:311-313 SKILL.md:313-329 SKILL.md:329-338 SKILL.md:338-341 SKILL.md:341-351 SKILL.md:351-354 SKILL.md:354-366 SKILL.md:366-382 SKILL.md:382-386 SKILL.md:386 SKILL.md:390 SKILL.md:393 SKILL.md:397 SKILL.md:400 SKILL.md:405 SKILL.md:406-409 SKILL.md:409-417 SKILL.md:417-420 SKILL.md:420-438 SKILL.md:438-456 SKILL.md:456-468 SKILL.md:468-473 SKILL.md:473-479 SKILL.md:479-482 SKILL.md:482-487 SKILL.md:284

📁 Filesystem access (1)

SKILL.md:334

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-creating-skill-template-use-skill-builder/security.svg)](https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-creating-skill-template-use-skill-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-creating-skill-template-use-skill-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-creating-skill-template-use-skill-builder security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-creating-skill-template-use-skill-builder-2026,
  author = {DNYoussef},
  title = {when-creating-skill-template-use-skill-builder security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-creating-skill-template-use-skill-builder security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-creating-skill-template-use-skill-builder:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Standardize New Skill Scaffolds

Create a repeatable file structure and metadata checklist for new AI skills.

Document Reusable Workflows

Turn a workflow idea into skill documentation, process steps, and expected outputs.

Review Skill Completeness

Check whether a skill draft includes required files, validation steps, and usage guidance.

Try These Prompts

Create a Basic Skill Template

Create a Claude Code skill template for a workflow named [name]. Include purpose, triggers, required files, and validation steps.

Plan Skill Phases

Design the phase structure for a skill that helps with [workflow]. Include objectives, agents, outputs, and success criteria.

Convert Workflow Documentation

Convert these workflow notes into a Claude Code skill package with SKILL.md, README.md, PROCESS.md, and a process diagram outline.

Audit a Generated Skill Draft

Review this generated skill draft for metadata completeness, progressive disclosure, validation coverage, command safety, and marketplace readiness.

Best Practices

Review every generated command before running it locally.
Keep skill names, categories, triggers, and outputs specific to one workflow.
Validate generated files before adding the skill to a shared marketplace.

Avoid

Do not copy generated shell snippets into production without review.
Do not create broad skills that combine unrelated workflows.
Do not publish generated skills without checking metadata and documentation quality.