create-agent-skills
Expert guidance for creating, writing, building, and refining Claude Code Skills. Use when working with SKILL.md files, authoring new skills, improv…
它会碰到什么
逐条看命中(11 条严重或高危)
- 严重
references/api-security.md:70cred-paths3. **Add credential placeholders to `~/.claude/.env`** using profile naming:
- 严重
references/api-security.md:74cred-pathsgrep -q "YOURSERVICE_MAIN_API_KEY=" ~/.claude/.env 2>/dev/null || \
- 严重
references/api-security.md:75cred-pathsecho -e "\n# Your Service - Main profile\nYOURSERVICE_MAIN_API_KEY=\nYOURSERVICE_MAIN_ACCOUNT_ID=" >> ~/.claude/.env
- 严重
references/api-security.md:77cred-pathsecho "Added credential placeholders to ~/.claude/.env - user needs to fill them in"
- 严重
references/api-security.md:178cred-paths**Location:** `~/.claude/.env` (global for all skills, accessible from any directory)
- 严重
references/api-security.md:194cred-pathssource ~/.claude/.env 2>/dev/null || { echo "Error: ~/.claude/.env not found" >&2; exit 1; } - 严重
references/api-security.md:194cred-pathssource ~/.claude/.env 2>/dev/null || { echo "Error: ~/.claude/.env not found" >&2; exit 1; } - 严重
references/api-security.md:202cred-paths3. **Auto-create credential placeholders** - add empty fields to `~/.claude/.env` immediately when creating the skill
- 严重
references/api-security.md:203cred-paths4. **Keep credentials in `~/.claude/.env`** - one central location, works everywhere
- 严重
references/api-security.md:220cred-paths# Check .env exists
- 严重
references/api-security.md:224cred-pathsgrep -q "YOUR_API_KEY=" ~/.claude/.env && echo "API key configured" || echo "API key missing"
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
<essential_principles>
How Skills Work
Skills are modular, filesystem-based capabilities that provide domain expertise on demand. This skill teaches how to create effective skills.
1. Skills Are Prompts
All prompting best practices apply. Be clear, be direct, use XML structure. Assume Claude is smart - only add context Claude doesn't have.
2. SKILL.md Is Always Loaded
When a skill is invoked, Claude reads SKILL.md. Use this guarantee:
- Essential principles go in SKILL.md (can't be skipped)
- Workflow-specific content goes in workflows/
- Reusable knowledge goes in references/
3. Router Pattern for Complex Skills
skill-name/
├── SKILL.md # Router + principles
├── workflows/ # Step-by-step procedures (FOLLOW)
├── references/ # Domain knowledge (READ)
├── templates/ # Output structures (COPY + FILL)
└── scripts/ # Reusable code (EXECUTE)
SKILL.md asks "what do you want to do?" → routes to workflow → workflow specifies which references to read.
When to use each folder:
- workflows/ - Multi-step procedures Claude follows
- references/ - Domain knowledge Claude reads for context
- templates/ - Consistent output structures Claude copies and fills (plans, specs, configs)
- scripts/ - Executable code Claude runs as-is (deploy, setup, API calls)
4. Pure XML Structure
No markdown headings (#, ##, ###) in skill body. Use semantic XML tags:
<objective>...</objective>
<process>...</process>
<success_criteria>...</success_criteria>
Keep markdown formatting within content (bold, lists, code blocks).
5. Progressive Disclosure
SKILL.md under 500 lines. Split detailed content into reference files. Load only what's needed for the current workflow.
</essential_principles>
<intake>
What would you like to do?
- Create new skill
- Audit/modify existing skill
- Add component (workflow/reference/template/script)
- Get guidance
Wait for response before proceeding.
</intake>
<routing>
| Response | Next Action | Workflow |
|----------|-------------|----------|
| 1, "create", "new", "build" | Ask: "Task-execution skill or domain expertise skill?" | Route to appropriate create workflow |
| 2, "audit", "modify", "existing" | Ask: "Path to skill?" | Route to appropriate workflow |
| 3, "add", "component" | Ask: "Add what? (workflow/reference/template/script)" | workflows/add-{type}.md |
| 4, "guidance", "help" | General guidance | workflows/get-guidance.md |
Progressive disclosure for option 1 (create):
- If user selects "Task-execution skill" → workflows/create-new-skill.md
- If user selects "Domain expertise skill" → workflows/create-domain-expertise-skill.md
Progressive disclosure for option 3 (add component):
- If user specifies workflow → workflows/add-workflow.md
- If user specifies reference → workflows/add-reference.md
- If user specifies template → workflows/add-template.md
- If user specifies script → workflows/add-script.md
Intent-based routing (if user provides clear intent without selecting menu):
- "audit this skill", "check skill", "review" → workflows/audit-skill.md
- "verify content", "check if current" → workflows/verify-skill.md
- "create domain expertise", "exhaustive knowledge base" → workflows/create-domain-expertise-skill.md
- "create skill for X", "build new skill" → workflows/create-new-skill.md
- "add workflow", "add reference", etc. → workflows/add-{type}.md
- "upgrade to router" → workflows/upgrade-to-router.md
After reading the workflow, follow it exactly.
</routing>
<quick_reference>
Skill Structure Quick Reference
Simple skill (single file):
---
name: skill-name
description: What it does and when to use it.
---
<objective>What this skill does</objective>
<quick_start>Immediate actionable guidance</quick_start>
<process>Step-by-step procedure</process>
<success_criteria>How to know it worked</success_criteria>
Complex skill (router pattern):
SKILL.md:
<essential_principles> - Always applies
<intake> - Question to ask
<routing> - Maps answers to workflows
workflows/:
<required_reading> - Which refs to load
<process> - Steps
<success_criteria> - Done when...
references/:
Domain knowledge, patterns, examples
templates/:
Output structures Claude copies and fills
(plans, specs, configs, documents)
scripts/:
Executable code Claude runs as-is
(deploy, setup, API calls, data processing)
</quick_reference>
<reference_index>
Domain Knowledge
All in references/:
Structure: recommended-structure.md, skill-structure.md
Principles: core-principles.md, be-clear-and-direct.md, use-xml-tags.md
Patterns: common-patterns.md, workflows-and-validation.md
Assets: using-templates.md, using-scripts.md
Advanced: executable-code.md, api-security.md, iteration-and-testing.md
</reference_index>
<workflows_index>
Workflows
All in workflows/:
| Workflow | Purpose |
|----------|---------|
| create-new-skill.md | Build a skill from scratch |
| create-domain-expertise-skill.md | Build exhaustive domain knowledge base for build/ |
| audit-skill.md | Analyze skill against best practices |
| verify-skill.md | Check if content is still accurate |
| add-workflow.md | Add a workflow to existing skill |
| add-reference.md | Add a reference to existing skill |
| add-template.md | Add a template to existing skill |
| add-script.md | Add a script to existing skill |
| upgrade-to-router.md | Convert simple skill to router pattern |
| get-guidance.md | Help decide what kind of skill to build |
</workflows_index>
<yaml_requirements>
YAML Frontmatter
Required fields:
---
name: skill-name # lowercase-with-hyphens, matches directory
description: ... # What it does AND when to use it (third person)
---
Name conventions: create-, manage-, setup-, generate-, build-*
</yaml_requirements>
<success_criteria>
A well-structured skill:
- Has valid YAML frontmatter
- Uses pure XML structure (no markdown headings in body)
- Has essential principles inline in SKILL.md
- Routes directly to appropriate workflows based on user intent
- Keeps SKILL.md under 500 lines
- Asks minimal clarifying questions only when truly needed
- Has been tested with real usage
</success_criteria>
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。