skill-creator
Create, improve, and audit AI agent skills. 14 structural patterns, deterministic scoring. Use when building or reviewing skills. NOT for agents, MCP servers, or running skills.
skill-creator
Create, improve, and audit AI agent skills. 14 structural patterns, deterministic scoring. Use when building or reviewing skills. NOT for agents, MCP servers, or running skills.
Quick Start
Install:
npx skills add github:wyattowalsh/agents --skill skill-creator -y -g --agent antigravity --agent claude-code --agent codex --agent crush --agent cursor --agent gemini-cli --agent github-copilot --agent grok --agent opencodeUse: /skill-creator <mode> [name]
Works with Claude Code, Gemini CLI, OpenCode, and other agentskills.io-compatible agents.
What It Does
Section titled “What It Does”Create, improve, and audit AI agent skills. Every skill follows 14 proven structural patterns.
| $ARGUMENTS | Action | Example |
|---|---|---|
create <name> / new <name> | Develop (new) | /skill-creator create my-analyzer |
create <name> --from <source> | Develop (new, from exemplar) | /skill-creator create my-analyzer --from wargame |
improve <name> / improve <path> | Develop (existing) | /skill-creator improve design |
plan <name> / plan <path> | Plan (existing) | /skill-creator plan review |
plan --all / plan repo | Plan (repo-wide) | /skill-creator plan --all |
audit <name> | Audit | /skill-creator audit review |
audit <name> --security | Security Audit | /skill-creator audit review --security |
audit --all | Audit All | /skill-creator audit --all |
eval <name> | Eval | /skill-creator eval review |
benchmark <name> | Benchmark | /skill-creator benchmark review |
compare <old> <new> | Compare | /skill-creator compare review-v1 review-v2 |
optimize-description <name> | Optimize Description | /skill-creator optimize-description review |
dashboard | Dashboard | /skill-creator dashboard |
package <name> / package --all | Package | /skill-creator package wargame |
| Natural language skill idea | Auto: Develop (new) | "tool that audits Python type safety" |
| Skill name + modification verb | Auto: Develop (existing) | "refactor the wargame skill" |
| Path to SKILL.md | Auto: Develop (existing) | skills/wargame/SKILL.md |
| ”MCP server” / “agent” / “run” | Refuse + redirect | — |
| Empty | Gallery | /skill-creator |
Quick Start
Section titled “Quick Start”uv run python skills/skill-creator/scripts/scaffold_skill.py <name> # Scaffold from templateuv run python scripts/check.py # Validate from skill directoryuv run python skills/skill-creator/scripts/audit.py skills/<name>/ # Score qualityuv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run # Portability checkSkill Development
Section titled “Skill Development”Unified process for creating new skills and improving existing ones. Load references/workflow.md for the full procedure.
| Step | New Skill | Existing Skill |
|---|---|---|
| 1. Understand | Define use cases, scope, patterns | Audit + understand user’s intent |
| 2. Plan | Structure, description, frontmatter | Gap analysis + improvement plan (approval gate) |
| 3. Scaffold | scaffold_skill.py <name> | Skip |
| 4. Build | Write/edit body, references, scripts, templates, evals | Same |
| 5. Validate | scripts/check.py + audit.py | Same |
| 6. Iterate | Test, identify issues, loop to Step 4 | Same |
Score a skill using deterministic analysis + AI review. Load references/audit-guide.md.
Audit All
Section titled “Audit All”Comparative ranking of all repository skills. Load references/audit-guide.md § Audit All.
Package
Section titled “Package”Package skills into portable ZIP files for Claude Code Desktop import. Load references/packaging-guide.md for ZIP structure, manifest schema, portability checks, and cross-agent compatibility.
uv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run # Check before emitting a ZIPuv run python skills/skill-creator/scripts/package.py skills/<name>/ # Single skill → <name>-v<version>.skill.zipCore Principles
Section titled “Core Principles”Conciseness is respect — The context window is shared. Every line competes with the agent’s working memory. Earn every line or delete it.
Progressive disclosure — Frontmatter for discovery (~100 tokens), body for dispatch (<5K tokens), references for deep knowledge (on demand), scripts/templates for execution (never loaded).
Self-exemplar — This skill follows every pattern it teaches. When in doubt, look at how skill-creator applies it.
Critical Rules
Section titled “Critical Rules”- Run
uv run python scripts/check.pyfrom the target skill directory before declaring any skill complete - Re-run
uv run python scripts/check.pyafter changing evals and before declaring the skill complete - Run
uv run python scripts/audit.pyafter every significant SKILL.md change - Never create a skill without a dispatch table — it is the routing contract
- Never create a dispatch table without an empty-args handler — unrouted input is a bug
- Every reference file must appear in the Reference File Index — orphan refs are invisible
- Every indexed reference must exist on disk — phantom refs cause agent errors
- Body must stay under 500 lines (below frontmatter) — move detail to references
- Description must include “Use when” trigger phrases AND “NOT for” exclusions
- Names must be kebab-case, 2-64 chars, no consecutive hyphens, no reserved words
- Scripts use argparse + JSON to stdout — no custom output formats
- Templates are self-contained HTML with no external dependencies
- Do NOT call repo-specific docs generators directly — delegate to docs-steward
- Do NOT create agents or MCP servers — refuse gracefully and redirect
- Improving existing skills requires presenting an improvement plan and getting user approval before implementing changes
- Audit mode is read-only — never modify the skill being audited
- Update evals when dispatch behavior or modes change — stale evals are invisible bugs
plan <name>andplan --allare read-only planning modes — never edit during planning- Repo-wide or multi-skill requests require a ranked plan and standalone refinement-plan output before any implementation begins
- Runtime-projected Stop hooks must include a
stop_hook_activeguard — recursive hook loops are implementation bugs - Source-ground new skills in real workflow evidence; generic best-practice generation starts as
needs-evidence - Benchmark meaningful changes against
without_skillorold_skillbefore claiming behavioral improvement - Security-governance findings can block release even when static quality score is A
- Choose an explicit permission posture for every skill that uses scripts, hooks, tools, network, credentials, or writes
- Use OpenSpec before changing public eval schema, validation behavior, hook policy, packaging semantics, or generated-doc workflows
- Do not run live installs, live behavioral evals, browser launches, or command-file injection from Plan, Audit, or Security Audit modes
Canonical terms (use these exactly throughout):
- Modes: “Develop (new)”, “Develop (existing)”, “Plan (existing)”, “Plan (repo-wide)”, “Audit”, “Security Audit”, “Audit All”, “Eval”, “Benchmark”, “Compare”, “Optimize Description”, “Dashboard”, “Package”, “Gallery”
- Steps (Development): “Understand”, “Plan”, “Scaffold”, “Build”, “Validate”, “Iterate”
- Grade scale: “A” (90-100), “B” (75-89), “C” (60-74), “D” (40-59), “F” (<40)
- Patterns: “dispatch-table”, “reference-file-index”, “critical-rules”, “canonical-vocabulary”, “scope-boundaries”, “classification-gating”, “scaling-strategy”, “state-management”, “scripts”, “templates”, “hooks”, “progressive-disclosure”, “body-substitutions”, “stop-hooks”
- Audit dimensions: “frontmatter”, “description”, “dispatch-table”, “body-structure”, “pattern-coverage”, “reference-quality”, “critical-rules”, “script-quality”, “portability”, “conciseness”, “canonical-vocabulary”, “evaluation-coverage”, “validation-contract”, “security-governance”
Scaling Strategy
Section titled “Scaling Strategy”Use maximum verified independence, not maximum agent count. Load references/orchestration-graph.md for the full graph contract.
| Scope | Strategy | Parallelism |
|---|---|---|
| Small | Single-skill edit: inline sequential edit + validation | Lead only |
| Medium | Single-skill multi-surface edit: stabilize body contract, then split references/evals/scripts by owned file | 2-5 disjoint lanes |
| Large | Skill cluster or repo-wide plan: inventory, rank, shard by skill or surface, add judge lane | One worker per owned shard |
| Large | Public workflow/schema/tooling change: OpenSpec first, then workers behind explicit dependencies | Spec, implementation, verifier, docs-steward lanes |
| Large | Behavioral eval/benchmark program: static gates first, then opt-in eval runner/report lanes | Trigger, output, safety, report, judge lanes |
Every lane must define inputs, owned paths, output artifact, validation command, and accounting state before dispatch. Same-file edits, generated docs, hooks, packaging semantics, and schema decisions are serialized unless an explicit lock/arbiter protocol exists.
Repo-Wide / Multi-Skill Planning
Section titled “Repo-Wide / Multi-Skill Planning”Use plan <name> for an existing-skill refinement plan without editing and plan --all or plan repo for a ranked repo-wide planning pass.
Required planning output:
- baseline audit summary
- highest-value findings
- explicit file targets
- expected score impact
- approval gate before any edits
For repo-wide planning, produce a ranked queue plus one standalone refinement plan per promoted skill or skill cluster. Do not edit any skill until the user approves the plan.
Load references/refinement-plan.md when producing the standalone refinement-plan packet.
Security Audit
Section titled “Security Audit”Audit a skill as an executable supply-chain asset. Load references/security-governance.md.
Required output:
- security surface inventory
- source/sink threat model
- permission posture
- hook/script/template/reference findings
- adversarial eval recommendations
- risk tier:
low,medium,high, orblocked
Security Audit is read-only. Do not install third-party skills, run untrusted scripts, or modify the audited skill.
Eval / Benchmark / Compare / Optimize Description
Section titled “Eval / Benchmark / Compare / Optimize Description”Behavioral proof complements static audit scoring. Load references/evidence-and-benchmarking.md.
| Mode | Purpose |
|---|---|
| Eval | Review or author trigger, output, regression, safety, and portability eval cases |
| Benchmark | Plan or run opt-in with-skill vs without-skill measurement for a skill |
| Compare | Plan or run opt-in old-skill vs new-skill measurement for an improvement |
| Optimize Description | Test trigger and near-miss negative queries, then revise the description from evidence |
Default to read-only planning unless the user explicitly approves live eval runs and the target workspace. Store behavioral run artifacts outside committed skills/ source.
Dashboard
Section titled “Dashboard”Render visual creation process monitor or audit quality dashboard. Load references/audit-guide.md § Dashboard.
Auto-detects mode from data: phases field → process monitor; skills array → audit overview.
Gallery (Empty Arguments)
Section titled “Gallery (Empty Arguments)”Present skill inventory with scores and available actions.
Run uv run python scripts/audit.py --all --format table, display results, offer mode menu.
Runtime Hook Projection
Section titled “Runtime Hook Projection”This portable skill source does not embed skill-scoped hooks frontmatter. Repo-managed hook policy lives in config/hook-registry.json and is projected into supported harness settings by the repository sync/rendering workflow.
Runtime-projected hook enforcement for this skill should preserve these behaviors:
SKILL.mdedits triggervalidate_skill.pyevals/*.jsonedits triggervalidate_evals.py- hook-bearing skill/settings edits trigger
validate_hooks.py - Stop hooks validate dirty skill-definition, eval, and hook surfaces before exit
- Stop hooks exit immediately when hook input has
stop_hook_active: trueto avoid recursive loops
Packaged skills must not depend on repo-root commands such as uv run python scripts/verify.py .... Keep executable hook commands in runtime-specific config, not in portable skill frontmatter.
State Management
Section titled “State Management”Creation progress persists at ~/.{gemini\|copilot\|codex\|claude}/skill-progress/<name>.json. Read/write via scripts/progress.py. Survives session restarts. Use --state-dir to override the default location.
Validation Contract
Section titled “Validation Contract”Run from this skill directory before declaring changes complete:
uv run python scripts/check.pyCompletion criteria:
uv run python scripts/check.pyexits 0.- No portable-CLI violations remain under this skill directory.
| Field | Value |
|---|---|
| Source Type | repo-owned |
| Display Source | github:wyattowalsh/agents |
| Source Kind | repo |
| Installability | portable command |
| Review State | reviewed |
| Target Agents | antigravity, claude-code, codex, crush, cursor, gemini-cli, github-copilot, grok, opencode |
| Field | Value |
|---|---|
| Name | skill-creator |
| License | MIT |
| Version | 2.0.0 |
| Author | wyattowalsh |
| Field | Value |
|---|---|
| Model | opus |
| Argument Hint | [mode] [name] |
| Field | Value |
|---|---|
| Compatibility | Requires Python 3.13+; optional uv for project tooling; optional Node.js/npm for install commands; hook support varies by agent client. |
Related Skills
Section titled “Related Skills”Full SKILL.md
---name: skill-creatordescription: >- Create, improve, and audit AI agent skills. 14 structural patterns, deterministic scoring. Use when building or reviewing skills. NOT for agents, MCP servers, or running skills.argument-hint: "<mode> [name]"model: opuslicense: MITcompatibility: "Requires Python 3.13+; optional uv for project tooling; optional Node.js/npm for install commands; hook support varies by agent client."metadata: author: wyattowalsh version: "2.0.0"---# Skill Creator
Create, improve, and audit AI agent skills. Every skill follows 14 proven structural patterns.
**Scope:** Skills only. NOT for creating agents (use `agent-conventions`), building MCP servers (`/mcp-creator`), or running existing skills. This repo uses raw `SKILL.md` format committed directly to `skills/`.
## Dispatch
| $ARGUMENTS | Action | Example || ----------------------------------- | ---------------------------- | -------------------------------------------------- || `create <name>` / `new <name>` | Develop (new) | `/skill-creator create my-analyzer` || `create <name> --from <source>` | Develop (new, from exemplar) | `/skill-creator create my-analyzer --from wargame` || `improve <name>` / `improve <path>` | Develop (existing) | `/skill-creator improve design` || `plan <name>` / `plan <path>` | Plan (existing) | `/skill-creator plan review` || `plan --all` / `plan repo` | Plan (repo-wide) | `/skill-creator plan --all` || `audit <name>` | Audit | `/skill-creator audit review` || `audit <name> --security` | Security Audit | `/skill-creator audit review --security` || `audit --all` | Audit All | `/skill-creator audit --all` || `eval <name>` | Eval | `/skill-creator eval review` || `benchmark <name>` | Benchmark | `/skill-creator benchmark review` || `compare <old> <new>` | Compare | `/skill-creator compare review-v1 review-v2` || `optimize-description <name>` | Optimize Description | `/skill-creator optimize-description review` || `dashboard` | Dashboard | `/skill-creator dashboard` || `package <name>` / `package --all` | Package | `/skill-creator package wargame` || Natural language skill idea | Auto: Develop (new) | `"tool that audits Python type safety"` || Skill name + modification verb | Auto: Develop (existing) | `"refactor the wargame skill"` || Path to SKILL.md | Auto: Develop (existing) | `skills/wargame/SKILL.md` || "MCP server" / "agent" / "run" | Refuse + redirect | — || Empty | Gallery | `/skill-creator` |
### Auto-Detection Heuristic
If no explicit mode keyword is provided:
1. Path ending in `SKILL.md` or directory under `skills/` → **Develop (existing)**2. Existing skill name + modification verb (improve, refactor, enhance, update, fix, rewrite, optimize, polish, revise, change) → **Develop (existing)**3. `--from <source>` in arguments → **Develop (new, from exemplar)**4. "benchmark", "A/B", "with skill", "without skill", "old skill", "new skill" → **Benchmark** or **Compare**5. "trigger", "false positive", "false negative", "description fires" → **Optimize Description**6. "security", "supply chain", "malicious", "unsafe", "permission", "hook" → **Security Audit**7. New capability description ("I want to build...", "tool that...", "skill for...") → **Develop (new)** — derive name, confirm before scaffolding8. "MCP server", "agent", "run" → refuse gracefully and redirect9. Ambiguous → ask the user which mode they want
## Quick Start
```bashuv run python skills/skill-creator/scripts/scaffold_skill.py <name> # Scaffold from templateuv run python scripts/check.py # Validate from skill directoryuv run python skills/skill-creator/scripts/audit.py skills/<name>/ # Score qualityuv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run # Portability check```
## Skill Development
Unified process for creating new skills and improving existing ones. Load `references/workflow.md` for the full procedure.
| Step | New Skill | Existing Skill || ------------- | --------------------------------------------------------- | ----------------------------------------------- || 1. Understand | Define use cases, scope, patterns | Audit + understand user's intent || 2. Plan | Structure, description, frontmatter | Gap analysis + improvement plan (approval gate) || 3. Scaffold | `scaffold_skill.py <name>` | Skip || 4. Build | Write/edit body, references, scripts, templates, evals | Same || 5. Validate | `scripts/check.py` + `audit.py` | Same || 6. Iterate | Test, identify issues, loop to Step 4 | Same |
## Scaling Strategy
Use maximum verified independence, not maximum agent count. Load `references/orchestration-graph.md` for the full graph contract.
| Scope | Strategy | Parallelism ||-------|----------|-------------|| Small | Single-skill edit: inline sequential edit + validation | Lead only || Medium | Single-skill multi-surface edit: stabilize body contract, then split references/evals/scripts by owned file | 2-5 disjoint lanes || Large | Skill cluster or repo-wide plan: inventory, rank, shard by skill or surface, add judge lane | One worker per owned shard || Large | Public workflow/schema/tooling change: OpenSpec first, then workers behind explicit dependencies | Spec, implementation, verifier, docs-steward lanes || Large | Behavioral eval/benchmark program: static gates first, then opt-in eval runner/report lanes | Trigger, output, safety, report, judge lanes |
Every lane must define inputs, owned paths, output artifact, validation command, and accounting state before dispatch. Same-file edits, generated docs, hooks, packaging semantics, and schema decisions are serialized unless an explicit lock/arbiter protocol exists.
## Repo-Wide / Multi-Skill Planning
Use `plan <name>` for an existing-skill refinement plan without editing and `plan --all` or `plan repo` for a ranked repo-wide planning pass.
Required planning output:
1. baseline audit summary2. highest-value findings3. explicit file targets4. expected score impact5. approval gate before any edits
For repo-wide planning, produce a ranked queue plus one standalone refinement plan per promoted skill or skill cluster. Do not edit any skill until the user approves the plan.
Load `references/refinement-plan.md` when producing the standalone refinement-plan packet.
## Audit
Score a skill using deterministic analysis + AI review. Load `references/audit-guide.md`.
## Security Audit
Audit a skill as an executable supply-chain asset. Load `references/security-governance.md`.
Required output:
1. security surface inventory2. source/sink threat model3. permission posture4. hook/script/template/reference findings5. adversarial eval recommendations6. risk tier: `low`, `medium`, `high`, or `blocked`
Security Audit is read-only. Do not install third-party skills, run untrusted scripts, or modify the audited skill.
## Audit All
Comparative ranking of all repository skills. Load `references/audit-guide.md` § Audit All.
## Eval / Benchmark / Compare / Optimize Description
Behavioral proof complements static audit scoring. Load `references/evidence-and-benchmarking.md`.
| Mode | Purpose ||------|---------|| Eval | Review or author trigger, output, regression, safety, and portability eval cases || Benchmark | Plan or run opt-in with-skill vs without-skill measurement for a skill || Compare | Plan or run opt-in old-skill vs new-skill measurement for an improvement || Optimize Description | Test trigger and near-miss negative queries, then revise the description from evidence |
Default to read-only planning unless the user explicitly approves live eval runs and the target workspace. Store behavioral run artifacts outside committed `skills/` source.
## Dashboard
Render visual creation process monitor or audit quality dashboard. Load `references/audit-guide.md` § Dashboard.
Auto-detects mode from data: `phases` field → process monitor; `skills` array → audit overview.
## Gallery (Empty Arguments)
Present skill inventory with scores and available actions.Run `uv run python scripts/audit.py --all --format table`, display results, offer mode menu.
## Package
Package skills into portable ZIP files for Claude Code Desktop import. Load `references/packaging-guide.md` for ZIP structure, manifest schema, portability checks, and cross-agent compatibility.
```bashuv run python skills/skill-creator/scripts/package.py skills/<name>/ --dry-run # Check before emitting a ZIPuv run python skills/skill-creator/scripts/package.py skills/<name>/ # Single skill → <name>-v<version>.skill.zip```
## Runtime Hook Projection
This portable skill source does not embed skill-scoped `hooks` frontmatter. Repo-managed hook policy lives in `config/hook-registry.json` and is projected into supported harness settings by the repository sync/rendering workflow.
Runtime-projected hook enforcement for this skill should preserve these behaviors:
- `SKILL.md` edits trigger `validate_skill.py`- `evals/*.json` edits trigger `validate_evals.py`- hook-bearing skill/settings edits trigger `validate_hooks.py`- Stop hooks validate dirty skill-definition, eval, and hook surfaces before exit- Stop hooks exit immediately when hook input has `stop_hook_active: true` to avoid recursive loops
Packaged skills must not depend on repo-root commands such as `uv run python scripts/verify.py ...`. Keep executable hook commands in runtime-specific config, not in portable skill frontmatter.
## State Management
Creation progress persists at `~/.{gemini|copilot|codex|claude}/skill-progress/<name>.json`. Read/write via `scripts/progress.py`. Survives session restarts. Use `--state-dir` to override the default location.
## Reference File Index
| File | Content | Read When || --------------------------------- | ------------------------------------------------------------------------------------ | -------------------------------------------------- || `references/workflow.md` | Unified skill lifecycle process for new and existing skills | Develop (new), Develop (existing), Eval, Benchmark || `references/refinement-plan.md` | Standalone refinement-plan contract for existing-skill and repo-wide planning output | Plan (existing), Plan (repo-wide) || `references/audit-guide.md` | Audit procedure, Audit All, Dashboard rendering, Gallery, grade thresholds | Audit, Audit All, Dashboard, Gallery || `references/proven-patterns.md` | 14 structural patterns with examples from repo skills | Step 4 (Build), gap analysis || `references/best-practices.md` | Anthropic guide + superpowers methodology + cross-agent awareness | Step 2 (Plan), Step 4 (Build), description writing || `references/frontmatter-spec.md` | Full field catalog, invocation matrix, decision tree | Step 3 (Scaffold), frontmatter configuration || `references/packaging-guide.md` | ZIP structure, manifest schema, portability checks, import instructions | Package || `references/evaluation-rubric.md` | 13 weighted scoring dimensions normalized to 100, grade thresholds, pressure testing | Audit (pressure testing), scoring targets || `references/evidence-and-benchmarking.md` | Lifecycle packet, behavioral evals, benchmark artifacts, trigger optimization | Eval, Benchmark, Compare, Optimize Description || `references/security-governance.md` | Threat model, third-party intake, permission posture, hook/script safety | Security Audit, Step 2 (Plan), Package || `references/runtime-compatibility.md` | Portable and runtime-specific fields, install paths, graceful degradation | Step 3 (Scaffold), Package, Security Audit || `references/orchestration-graph.md` | Parallel lane graph, ownership, accounting, locks, judge layer | Scaling Strategy, repo-wide plans |
Read reference files as indicated by the "Read When" column above. Do not rely on memory or prior knowledge of their contents.
## Core Principles
**Conciseness is respect** — The context window is shared. Every line competes with the agent's working memory. Earn every line or delete it.
**Progressive disclosure** — Frontmatter for discovery (~100 tokens), body for dispatch (<5K tokens), references for deep knowledge (on demand), scripts/templates for execution (never loaded).
**Self-exemplar** — This skill follows every pattern it teaches. When in doubt, look at how skill-creator applies it.
## Validation Contract
Run from this skill directory before declaring changes complete:
```bashuv run python scripts/check.py```
Completion criteria:
1. `uv run python scripts/check.py` exits 0.2. No portable-CLI violations remain under this skill directory.
## Critical Rules
1. Run `uv run python scripts/check.py` from the target skill directory before declaring any skill complete2. Re-run `uv run python scripts/check.py` after changing evals and before declaring the skill complete3. Run `uv run python scripts/audit.py` after every significant SKILL.md change4. Never create a skill without a dispatch table — it is the routing contract5. Never create a dispatch table without an empty-args handler — unrouted input is a bug6. Every reference file must appear in the Reference File Index — orphan refs are invisible7. Every indexed reference must exist on disk — phantom refs cause agent errors8. Body must stay under 500 lines (below frontmatter) — move detail to references9. Description must include "Use when" trigger phrases AND "NOT for" exclusions10. Names must be kebab-case, 2-64 chars, no consecutive hyphens, no reserved words11. Scripts use argparse + JSON to stdout — no custom output formats12. Templates are self-contained HTML with no external dependencies13. Do NOT call repo-specific docs generators directly — delegate to docs-steward14. Do NOT create agents or MCP servers — refuse gracefully and redirect15. Improving existing skills requires presenting an improvement plan and getting user approval before implementing changes16. Audit mode is read-only — never modify the skill being audited17. Update evals when dispatch behavior or modes change — stale evals are invisible bugs18. `plan <name>` and `plan --all` are read-only planning modes — never edit during planning19. Repo-wide or multi-skill requests require a ranked plan and standalone refinement-plan output before any implementation begins20. Runtime-projected Stop hooks must include a `stop_hook_active` guard — recursive hook loops are implementation bugs21. Source-ground new skills in real workflow evidence; generic best-practice generation starts as `needs-evidence`22. Benchmark meaningful changes against `without_skill` or `old_skill` before claiming behavioral improvement23. Security-governance findings can block release even when static quality score is A24. Choose an explicit permission posture for every skill that uses scripts, hooks, tools, network, credentials, or writes25. Use OpenSpec before changing public eval schema, validation behavior, hook policy, packaging semantics, or generated-doc workflows26. Do not run live installs, live behavioral evals, browser launches, or command-file injection from Plan, Audit, or Security Audit modes
**Canonical terms** (use these exactly throughout):
- Modes: "Develop (new)", "Develop (existing)", "Plan (existing)", "Plan (repo-wide)", "Audit", "Security Audit", "Audit All", "Eval", "Benchmark", "Compare", "Optimize Description", "Dashboard", "Package", "Gallery"- Steps (Development): "Understand", "Plan", "Scaffold", "Build", "Validate", "Iterate"- Grade scale: "A" (90-100), "B" (75-89), "C" (60-74), "D" (40-59), "F" (<40)- Patterns: "dispatch-table", "reference-file-index", "critical-rules", "canonical-vocabulary", "scope-boundaries", "classification-gating", "scaling-strategy", "state-management", "scripts", "templates", "hooks", "progressive-disclosure", "body-substitutions", "stop-hooks"- Audit dimensions: "frontmatter", "description", "dispatch-table", "body-structure", "pattern-coverage", "reference-quality", "critical-rules", "script-quality", "portability", "conciseness", "canonical-vocabulary", "evaluation-coverage", "validation-contract", "security-governance"