agentic-actions-audito…
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use…
Create new skills (SKILL.md files), modify and improve existing skills, and design skill descriptions for accurate triggering. Use when the user wants to create a new skill from scratch, edit an existing skill, optimize a skill's description, or convert a workflow they just
$ npx -y skills add waybarrios/opencode-power-pack --skill skill-creator --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/skill-creatorContext preview
The summary Claude sees to decide when to auto-load this skill.
Create new skills (SKILL.md files), modify and improve existing skills, and design skill descriptions for accurate triggering. Use when the user wants to create a new skill from scratch, edit an existing skill, optimize a skill's description, or convert a workflow they just
name: skill-creator description: Create new skills (SKILL.md files), modify and improve existing skills, and design skill descriptions for accurate triggering. Use when the user wants to create a new skill from scratch, edit an existing skill, optimize a skill's description, or convert a workflow they just demonstrated into a reusable skill. license: Apache-2.0 (modified; see UPSTREAMS.json)
A skill for creating new skills and iteratively improving them.
At a high level, the process of creating a skill goes like this:
Your job when using this skill is to figure out where the user is in this process and help them progress through the stages. If they say "I want to make a skill for X", help narrow down what they mean, write a draft, try a few realistic prompts, and iterate. If they already have a draft, jump straight to testing and iterating.
If the user just says "vibe with me, no formal evals", do that.
Skill-creator is liable to be used by people across a wide range of familiarity with coding jargon. Pay attention to context cues:
It is fine to briefly clarify a term when in doubt.
Start by understanding what the user wants. The current conversation may already contain the workflow to capture (e.g., they say "turn this into a skill"). If so, extract answers from the conversation history first — the tools used, the sequence of steps, corrections made, the input/output formats observed. The user can fill the gaps and confirm.
Ask:
1. What should this skill enable the model to do? 2. When should this skill trigger? (what user phrases / contexts) 3. What is the expected output format? 4. Should we set up test cases to verify the skill works? Skills with objectively verifiable outputs (file transforms, data extraction, code generation, fixed workflow steps) benefit from test cases. Skills with subjective outputs (writing style, art) often do not. Suggest the appropriate default but let the user decide.
Proactively ask about edge cases, input/output formats, example files, success criteria, and dependencies. Wait to write test prompts until this is ironed out.
If the platform supports parallel sub-tasks, research in parallel (search docs, find similar skills, check best practices).
Based on the interview, fill in:
Then write the body.
skill-name/
├── SKILL.md (required)
│ ├── YAML frontmatter (name, description required)
│ └── Markdown instructions
└── Bundled resources (optional)
├── scripts/ — Executable code for deterministic / repetitive tasks
├── references/ — Docs loaded into context as needed
└── assets/ — Files used in output (templates, icons, fonts)Skills use a three-level loading system:
1. **Metadata** (name + description) — always in context, ~100 words. 2. **`SKILL.md` body** — in context whenever the skill triggers; aim for under 500 lines. 3. **Bundled resources** — loaded as needed; unlimited size; scripts can execute without loading.
**Key patterns:**
**Domain organization:** when a skill supports multiple domains/frameworks, organize by variant:
cloud-deploy/
├── SKILL.md (workflow + selection)
└── references/
├── aws.md
├── gcp.md
└── azure.mdThe model reads only the relevant reference file.
Skills must not contain malware, exploit code, or any content that could compromise system security. A skill's contents should not surprise the user given its description. Do not create misleading skills or skills designed to facilitate unauthorized access, data exfiltration, or other malicious activities. Roleplay-style skills are fine.
**Defining output formats** — use a clear template:
## Report structure ALWAYS use this exact template: # [Title] ## Executive summary ## Key findings ## Recommendations
**Examp
54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more.
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use…
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate…
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future…
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair…
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive…
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and…