Skills skill-creator
📦
skill-creator
v1.3.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Create AI Skills From Guided Templates
Creating reusable AI skills requires structure, validation, and clear installation choices. This skill guides planning, scaffolding, packaging, and checks for Claude, Codex, and Claude Code workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "skill-creator" from https://skillstore.io/skills/sickn33-skill-creator.md and its manifest at https://skillstore.io/api/skills/sickn33-skill-creator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "skill-creator". Create a skill for analyzing TypeScript compiler errors.
Expected outcome:
- The assistant asks for target users, trigger phrases, platform support, and preferred installation mode.
- It then creates a named skill folder with instructions, references, scripts, and validation guidance.
Using "skill-creator". Package my existing skill for sharing.
Expected outcome:
- The assistant validates the skill folder before packaging.
- If validation passes, it creates a local distributable archive and reports the output path.
Using "skill-creator". Improve a draft skill before publishing it.
Expected outcome:
- The assistant checks trigger clarity, frontmatter, resource organization, installation steps, and content length.
- It suggests focused changes that make the skill easier to load and safer to install.
Security Audit
High Riskv4 • 7/7/2026 Open versioned report
Most static command and network alerts are false positives from Markdown examples, placeholder URLs, or benign local validation code. Confirmed issues center on global symlink installation into hidden AI agent directories, missing skill-name path validation, and packaging behavior that may include unintended files.
8
Files scanned
1,688
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Unsanitized Skill Name Can Escape Target Directory
The initializer combines the requested path and skill name before creating directories and files, but it does not validate the skill name. A name containing path separators or an absolute path could write the generated skill outside the intended output directory.
The code and documented shell workflow derive filesystem paths from user-controlled skill names without enforcing the stated hyphen-case rules. The resulting operations create directories and write files.
Medium
Misleading Safe Risk Metadata
The skill frontmatter declares risk as safe while the workflow supports global installation through symlinks in hidden agent directories. That mismatch can understate the review needed before installing a community skill.
The safe label is explicit in frontmatter, and later sections instruct global symlink installation into per-user agent configuration paths. The behavior is intentional but security-sensitive.
Medium
Package Archive May Include Symlink Targets
The packaging script recursively writes every file found under the skill folder into an archive. It does not reject symlinks or filter unexpected files, which can leak outside file contents if a skill folder contains symlinked files.
Path.rglob combined with is_file can include symlinked files, and zipfile.write has no visible filter here. The risk depends on packaging a folder that already contains unsafe links or unrelated files.
Capability review items (20)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Hidden file in home directory
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Hidden file in home directory
- [ ] **Global installation** - Create symlinks in `~/.copilot/skills/` (works everywhere)
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Hidden file in home directory
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
ln -sf "$SKILLS_REPO/.github/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
ln -sf "$SKILLS_REPO/.claude/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
ln -sf "$SKILLS_REPO/.codex/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
Symlink creation
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
Medium
Hidden file access
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
- [ ] **Global installation** - Create symlinks in `~/.copilot/skills/` (works everywhere)
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
ln -sf "$SKILLS_REPO/.github/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
"$HOME/.copilot/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
ln -sf "$SKILLS_REPO/.claude/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
"$HOME/.claude/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
ln -sf "$SKILLS_REPO/.codex/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
"$HOME/.codex/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
Hidden file access
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Risk Factors
⚙️ External commands (98)
README.md:45 README.md:48 scripts/init_skill.py:73 scripts/init_skill.py:74 scripts/init_skill.py:84 SKILL.md:42-73 SKILL.md:73-87 SKILL.md:87-89 SKILL.md:89-98 SKILL.md:98-100 SKILL.md:100-105 SKILL.md:105-107 SKILL.md:107-110 SKILL.md:110-122 SKILL.md:122-152 SKILL.md:152-154 SKILL.md:154-157 SKILL.md:157-164 SKILL.md:164-183 SKILL.md:183-185 SKILL.md:185-188 SKILL.md:188-196 SKILL.md:196-200 SKILL.md:200-216 SKILL.md:216-221 SKILL.md:221 SKILL.md:223-224 SKILL.md:224-225 SKILL.md:225-226 SKILL.md:226-227 SKILL.md:227-228 SKILL.md:228-229 SKILL.md:229-231 SKILL.md:231-237 SKILL.md:237-242 SKILL.md:242-269 SKILL.md:269-272 SKILL.md:272-282 SKILL.md:282-287 SKILL.md:287-289 SKILL.md:289-292 SKILL.md:292-299 SKILL.md:299-303 SKILL.md:303-309 SKILL.md:309-312 SKILL.md:312-319 SKILL.md:319-334 SKILL.md:334-336 SKILL.md:336-339 SKILL.md:339-346 SKILL.md:346-351 SKILL.md:351-352 SKILL.md:352-358 SKILL.md:358-377 SKILL.md:377-381 SKILL.md:381-402 SKILL.md:402-406 SKILL.md:406-411 SKILL.md:411-416 SKILL.md:416-418 SKILL.md:418-421 SKILL.md:421-428 SKILL.md:428-432 SKILL.md:432-459 SKILL.md:459-466 SKILL.md:466-473 SKILL.md:473-478 SKILL.md:478-487 SKILL.md:487-492 SKILL.md:492-503 SKILL.md:503-508 SKILL.md:508-516 SKILL.md:516-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-533 SKILL.md:533-534 SKILL.md:534-535 SKILL.md:535-540 SKILL.md:540-541 SKILL.md:541-542 SKILL.md:542-547 SKILL.md:547-552 SKILL.md:552-562 SKILL.md:562-563 SKILL.md:563-564 SKILL.md:564-592 SKILL.md:592-593 SKILL.md:61 SKILL.md:71 SKILL.md:72 SKILL.md:202 SKILL.md:247 SKILL.md:261 SKILL.md:42-73 SKILL.md:200-216 SKILL.md:242-269
🌐 Network access (4)
📁 Filesystem access (38)
README.md:45 README.md:48 README.md:45 README.md:48 README.md:45 README.md:48 scripts/package_skill.py:14 scripts/package_skill.py:68 SKILL.md:352 SKILL.md:408 SKILL.md:409 SKILL.md:410 SKILL.md:509 SKILL.md:552 SKILL.md:52 SKILL.md:56 SKILL.md:65 SKILL.md:352 SKILL.md:384 SKILL.md:385 SKILL.md:391 SKILL.md:392 SKILL.md:398 SKILL.md:399 SKILL.md:408 SKILL.md:409 SKILL.md:410 SKILL.md:509 SKILL.md:552 SKILL.md:48 SKILL.md:61 SKILL.md:408 SKILL.md:409 SKILL.md:410 SKILL.md:384 SKILL.md:391 SKILL.md:398 SKILL.md:552
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-skill-creator/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-skill-creator?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-skill-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-skill-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-skill-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Eric Andrade. (2026). skill-creator security audit report (audit version 4) [Author version 1.3.0]. Skillstore. https://skillstore.io/skills/sickn33-skill-creator/audits/4BibTeX citation
@techreport{eric-andrade-sickn33-skill-creator-2026,
author = {Eric Andrade},
title = {skill-creator security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-skill-creator/audits/4},
note = {Author version 1.3.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-creator security audit report (audit version 4)"
version: "1.3.0"
type: report
authors:
- name: "Eric Andrade"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-skill-creator/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-skill-creator:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
24 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
Joseph OBrien Recommended
89jobrien-skill-creator
Skillstore Score 83
Evidence Confidence High
Skillstore usage 65
Updated
2026-09-09
vercel-labs-skill-creator
Skillstore Score 81
Evidence Confidence High
Skillstore usage 28
Updated
2026-09-09
7spade-skill-creator
Skillstore Score 80
Evidence Confidence High
Skillstore usage 42
Updated
2026-09-09
daviddworetzky-skill-creator
Skillstore Score 79
Evidence Confidence High
Skillstore usage 10
Updated
2026-09-09
bom-98-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 12
Updated
2026-09-09
doyajin174-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 10
Updated
2026-09-09
cesaraugustusgrob-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 9
Updated
2026-09-09
skill-creator
Skillstore Score 76
Evidence Confidence High
Skillstore usage 47
Updated
2026-09-09
cam10001110101-skill-creator
Skillstore Score 75
Evidence Confidence High
Skillstore usage 16
Updated
2026-09-09
astrabit-cpt-skill-creator
Skillstore Score 73
Evidence Confidence High
Skillstore usage 15
Updated
2026-09-09
zhanlincui-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 316
Updated
2026-09-09
barissozen-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 15
Updated
2026-09-09
abdullahmalik17-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 13
Updated
2026-09-09
langchain-ai-skill-creator
Skillstore Score 67
Evidence Confidence High
Skillstore usage 22
Updated
2026-09-09
daothihuong2111-skill-creator
Skillstore Score 67
Evidence Confidence High
Skillstore usage 12
Updated
2026-09-09
benderfendor-skill-creator
Skillstore Score 66
Evidence Confidence High
Skillstore usage 27
Updated
2026-09-09
92bilal26-skill-creator
Skillstore Score 50
Evidence Confidence High
Skillstore usage 14
Updated
2026-09-09
Eric Andrade Current
sickn33-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 47
Updated
2026-09-09
artemisai-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 19
Updated
2026-09-09
davila7-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated
2026-09-09
azeem-2-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-09-09
davila7-skill-development
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-09-09
composiohq-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-09-09
chinchillaenterprises-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-09-09
Skillstore Score
Why this score Evidence Confidence: Medium 77
Architecture
100
Maintainability
87
Content
71
Community
87
Spec Compliance
What You Can Build
Build a Team Skill
Create a reusable skill that captures team workflows, expected prompts, and shared validation rules.
Scaffold a New Agent Workflow
Generate a starting folder, SKILL.md template, and resource directories for a new CLI assistant capability.
Package Skill Knowledge
Turn documentation, workflow patterns, and output examples into a skill that agents can load when needed.
Try These Prompts
Create a Basic Skill
Create a new skill for debugging Python errors. Ask only the essential setup questions first.
Plan Before Creating
Help me design a skill for database migrations. Define triggers, folder structure, references, and validation checks before creating files.
Add Resources and Validation
Create a skill for API documentation generation. Include reference guidance, example output patterns, and validation steps for SKILL.md.
Prepare for Marketplace Review
Review this existing skill for marketplace readiness. Check metadata, trigger clarity, bundled resources, installation steps, and security-sensitive behavior.
Best Practices
- Validate skill names and paths before creating files or installation links.
- Keep SKILL.md concise and move detailed material into referenced files.
- Ask for explicit confirmation before global installation or overwriting an existing skill.
Avoid
- Do not install symlinks into global agent directories without user confirmation.
- Do not package folders that contain secrets, credentials, or unrelated project files.
- Do not rely on placeholder template paths or repository URLs in a finished skill.
Frequently Asked Questions
Which tools does this skill support?
It targets Claude, Codex, Claude Code, and related CLI skill workflows.
Does it create files automatically?
Yes. The initializer can create SKILL.md and example resource folders under a chosen path.
Does it validate security?
No. The validator checks basic structure and metadata, not full security behavior.
Can it install skills globally?
The documentation includes global symlink installation steps for agent skill directories.
Can it package a skill for distribution?
Yes. The package script creates a local .skill archive after validation succeeds.
What should users review before running it?
Review target paths, skill names, bundled files, and any global installation command.
Developer Details
Author
Eric AndradeLicense
MIT
Author version
v1.3.0
Skillstore revision
r1
Ref
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
43 downloads · 245 views
File structure