Agent Skill
2/7/2026

skill-safety-audit

Scan new or updated skills for unsafe or malicious instructions (unknown tools, external installers, credential harvesting) before accepting them into the repository.

P
peterbamuhigire
2GitHub Stars
1Views
npx skills add peterbamuhigire/skills-web-dev

SKILL.md

Nameskill-safety-audit
DescriptionScan new or updated skills for unsafe or malicious instructions (unknown tools, external installers, credential harvesting) before accepting them into the repository.

Skills Repository

This repository is a curated catalog of reusable AI skills: compact execution guides that help agents and humans do higher-quality work with less repeated setup. The skills cover software engineering, AI systems, SaaS operations, security, product work, UX, mobile development, documentation workflows, and canonical finance doctrine.

The catalog is designed to be routed by name. A small active surface keeps skill selection reliable, while deeper references stay available without making every topic an active entrypoint.

Why These Skills Matter

BenefitWhat it gives you
Faster executionReusable workflows reduce repeated prompting and rediscovery.
Better routingClear frontmatter, aliases, and parent skills help agents pick the right guidance.
Higher qualitySkills encode checklists, quality gates, anti-patterns, and evidence expectations.
Safer specializationFinance, security, AI, and platform work keep domain constraints close to implementation guidance.
Portable knowledgeMarkdown, YAML, templates, and scripts work across Windows, Ubuntu, and Debian consumers.
Lower catalog noiseLegacy and narrow topics route through aliases instead of competing as duplicate active skills.

Active Catalog

Active skills are SKILL.md files under these roots:

RootPurpose
skills/Main active catalog for engineering, AI, SaaS, mobile, security, UX, product, and operations.
doctrine/skills/Canonical finance and accounting doctrine for IFRS, controls, close, audit, payroll, inventory, reporting, and finance UX.
00-meta-initialization/SDLC documentation initialization and new-project entrypoints.

Current guardrail baseline:

MetricValue
Active SKILL.md files169
Target active catalog size150-170
Guardrail hard cap200
Duplicate frontmatter names0
Inactive aliases retained as ALIAS.md47

Run the guardrail report with:

python -X utf8 scripts\skill_catalog_guardrails.py --report-only

Skill Domains

DomainExamples
AI and agent systemsAI architecture, RAG, evaluations, model gateways, agent runtime, HITL, governance, observability, cost controls, and AI UX.
Software engineeringArchitecture, APIs, TypeScript, JavaScript, PHP, Python, Node.js, testing, validation, release engineering, and reliability.
SaaS and productMulti-tenancy, entitlements, pricing, billing, onboarding, metrics, sales operations, product discovery, and product-led growth.
Security and complianceWeb app audits, code safety, network security, Linux hardening, DPIA work, and AI security controls.
Frontend and UXReact, Next.js, Tailwind, app GUI design, forms, interaction patterns, accessibility, premium UI, and motion.
MobileAndroid, iOS, Kotlin Multiplatform, mobile persistence, mobile UX, platform capabilities, app quality, and release workflows.
Finance doctrineAccounting engines, finance audits, bank and mobile money reconciliation, close, controls, reporting, IFRS, payroll, inventory, and finance UI patterns.
Documentation and operationsSDLC documentation, project requirements, professional document output, catalog maintenance, skill writing, and update records.

How To Use The Catalog

  1. Start with the active roots above or the overview in docs/overview/README.md.
  2. If an old skill name is mentioned, check docs/skill-routing-index.md or docs/skill-aliases.yml.
  3. Read the selected skill's SKILL.md.
  4. Load only the specific references/, templates/, or scripts/ files the skill tells you to use.
  5. When changing routing, frontmatter, or active skill behavior, update the routing docs and rerun the guardrail report.

Routing And Aliases

The catalog intentionally keeps aliases outside the active skill count. Legacy entrypoints that should no longer compete for routing are retained as ALIAS.md files in their original directories. Their targets are recorded in:

Finance aliases route to doctrine/skills/ first. Root-level finance skills remain active only when they add implementation or orchestration behavior beyond canonical doctrine.

Repository Map

PathRole
docs/Overview docs, architecture, routing policy, plans, analysis, and update records.
scripts/Maintenance checks, including active catalog guardrails.
claude-guides/Claude-specific skill creation and invocation guidance.
book-extractions/Curated source notes and long-form reference material.
blog-posts/Draft educational and marketing content.

Maintenance Rules

  • Do not delete or move skill directories casually.
  • Deactivate legacy entrypoints by renaming SKILL.md to ALIAS.md and adding a route in docs/skill-aliases.yml.
  • Keep finance and accounting doctrine canonical under doctrine/skills/.
  • Keep Markdown files below 500 lines where practical.
  • Use ASCII unless an existing file requires another character set.
  • Preserve user edits and inspect the worktree before modifying files.
  • Record substantive documentation repairs under docs/updates/.

Key Docs

DocumentPurpose
AGENTS.mdShort working rules for coding agents.
docs/overview/PROJECT_BRIEF.mdOne-page project brief.
docs/overview/ARCHITECTURE.mdRepository structure and ownership boundaries.
docs/overview/TECH_STACK.mdTooling, runtime assumptions, and platform notes.
docs/plans/INDEX.mdPlanning document index.
docs/plans/NEXT_FEATURES.mdCurrent priorities and next work.
Skills Info
Original Name:skill-safety-auditAuthor:peterbamuhigire