Agent Skill Forge: idea to publish-ready Skill
Agent Skill Forge — describe it, get a publish-ready Skill + safety audit
Tell it, in plain words, what you want an AI coding agent (Claude Code, Codex, or OpenClaw) to reliably do. You get a complete, ready-to-ship Skill package: a properly structured SKILL.md, an optional matching subagent definition and hooks snippet, a tailored verification checklist, and — the part most authors skip — a security & safety self-audit so you catch leaked secrets, over-broad permissions, and prompt-injection surface before you publish or share it.
This turns "I have an idea for a Skill" into a finished folder you can drop into a repo, hand to a teammate, or submit to a Skill marketplace.
What you get
| Output | What it is |
|---|---|
| SKILL.md | YAML frontmatter (name, description) + a body with purpose, triggers, step-by-step behavior, inputs/outputs, and guardrails. |
| Activation-tuned description | The description rewritten so the host agent actually fires the Skill at the right time — concrete triggers and a "do NOT use when…" boundary, not vague marketing. |
| Subagent definition (optional) | A matching subagent spec with a minimal tool allowlist and a tight activation condition. |
| Hooks snippet (optional) | A ready-to-paste settings.json hook (auto-format on write, block a dangerous command, notify on finish). |
| Verification checklist | 5–8 concrete checks that this Skill triggers, does the job, and fails safely. |
| Security & safety self-audit | A PASS/FLAG report: secret leakage, over-broad permissions, network/exfiltration surface, prompt-injection surface, destructive-command exposure, and over-claiming. |
How to use
- Describe what you want the Skill to do (trigger, inputs, output, target host).
- Say whether you also want a subagent, a hooks guardrail, or just the
SKILL.md. - Read back the plan, confirm, and receive the full package plus the audit.
- Copy the files into
<your-project>/.claude/skills/<name>/(or your host's equivalent) and run the checklist.
Security & safety self-audit
Runs on every package: secret leakage, over-broad permissions, network/exfiltration surface, prompt-injection surface, destructive-command exposure, over-claiming, and unnecessary personal-data handling — each reported PASS or FLAG with a one-line fix.
Notes
- Output is text files you copy into your own project. This tool does not install anything, does not run your Skill, and does not connect to any marketplace or API.
- It uses only the details you provide. Unknowns are marked
[FILL IN], never fabricated. Do not paste real secrets or personal data — describe them as placeholders. - The security audit is assistive only; a PASS is not a certification. You remain responsible for reviewing the final files before publishing or running them.
- Works for Claude Code, Codex, and OpenClaw style agents. No API key required.
（日本語）作りたいエージェントの動作を平易な言葉で説明すると、公開できる状態の Skill 一式（SKILL.md・任意のサブエージェント/フック・検証チェックリスト）を生成し、シークレット漏えい・過剰権限・外部送信・プロンプトインジェクション面のセルフ監査まで行います。貼った情報のみを使用し、不明点は [FILL IN] として創作しません。監査は補助であり認証ではありません。公開・実行前にご自身で最終確認してください。個人情報・APIキーは不要です。
