Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Docs

ASecurity

A skill is `skills/<category>/<id>/SKILL.md`, plus a `manifest.json` beside it, plus `references/` and `scripts/` when they earn their place. Keep the layers apart. A skill says **how to perform one specialized thing**. It does not say who is responsible (a role), what external system exists (an MCP), or how several capabilities combine into one repeatable run (a recipe). A skill teaches; it never authorizes.

46 stars
0 votes
0 copies
0 views
Added 9/22/2026
ai-agentsgodatabasefrontendbackenddevopssecurity

Works with

mcp

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add nahid-sparktales/agent-dispatcher --skill docs --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Docs?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Docs
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nahid-sparktales-docs/badge)](https://www.skillsdirectory.com/skills/nahid-sparktales-docs)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
adding-a-skill.md
# Adding a skill

A skill is `skills/<category>/<id>/SKILL.md`, plus a `manifest.json` beside it, plus
`references/` and `scripts/` when they earn their place.

Keep the layers apart. A skill says **how to perform one specialized thing**. It does not say who
is responsible (a role), what external system exists (an MCP), or how several capabilities combine
into one repeatable run (a recipe). A skill teaches; it never authorizes.

## The two files

`SKILL.md` carries **standard Agent Skills frontmatter and nothing else** — `name` and
`description`, plus `allowed-tools` if the skill really runs commands. Keeping it standard is what
lets the skill be installed and read by any Agent Skills runtime, not only this pack.

```
---
name: browser-verification
description: One or two sentences that say what this does AND when it fires, in trigger language a
  model can match against a request. Mention what it is NOT for. This is the only part loaded
  during discovery, so it does the whole job of getting the skill chosen or skipped.
---
```

`manifest.json` carries everything this pack needs and the Agent Skills format has no field for:

```json
{
  "id": "browser-verification",          // must match the directory name
  "capability": "verification.browser",  // from the taxonomy below
  "category": "quality",                 // must match the parent directory
  "use_when": "The trigger, one sentence.",
  "not_for": "The neighbouring skill this one cedes — what keeps near-misses out.",
  "task_signals": ["blank screen", "does it render"],  // 3-7 short phrases a USER would write
  "verifies": true,                      // true only for procedures that prove work
  "tools": ["playwright", "workspace"],  // ids from catalog/mcp.json — availability, not permission
  "references": ["references/driving-the-browser.md"],
  "scripts": [],
  "provenance": "local"
}
```

`build.py` fails if an id, category, capability, tool id or referenced file does not line up, and
if `task_signals` is missing or empty.

### Writing `task_signals`

These are the lexical half of discovery: matched against a request, never read as prose. Three to
seven phrases, lowercase, at most five words each.

Write them in the vocabulary of the **request**, not of the skill — `"blank screen"`, not
`"rendered-output verification"`. Make them *discriminate*: read the `not_for` line of every
sibling in the same category and drop any phrase that would fire for one of them instead.
`tests/test_build.py` rejects a phrase shared by more than two skills, because a signal that fires
everywhere routes nothing.

## The body

Procedural, not encyclopedic. A skill earns its place by telling an agent what to do next, in what
order, and how to know it worked.

- **When this fires** — concrete, including when it does not.
- **Procedure** — numbered steps in running order. Each step is an action with its discipline
  attached, not a topic heading.
- **Checklist** — what must be true before this is done, written so it can be walked.
- **Failure handling** — what to do when a step fails, and what not to conclude from it.
- **Evidence** — what to report so a reader can tell the work happened. Name the artifact (a
  command's output, a screenshot, a diff), not the claim.

Do not write "you are an expert at X". Do not restate a role's working method. Do not pad a thin
skill to look substantial — if it is four steps, it is four steps. Aim for 60–150 lines; push
long background material into `references/` so it loads only when that part is needed.

## Progressive disclosure

Three levels, and the build enforces the shape:

1. **Discovery** — `INDEX.md` and the `description` line. This is all an agent sees while deciding.
2. **The skill** — `SKILL.md`, read only once the agent has chosen it.
3. **References and scripts** — read only when a step calls for that specific piece.

Never write a skill that assumes all of it will be in context. One to five skills is a normal task.

## Capability taxonomy

Used for routing and aliasing, so several skills can provide the same capability and a role or
recipe can ask for the capability rather than a repository name. Keep it shallow — two or three
segments:

```
research.*        product.*       design.*        frontend.*
backend.*         database.*      devops.*        security.*
quality.*         ai.*            data.*          knowledge.*
verification.*
```

A namespace exists once a skill declares it. The build rejects a role or recipe asking for a
capability no skill provides, so adding a new top-level prefix means adding the skill that supplies
it in the same change.

## When to split, when to merge

Split when two things have **different activation conditions** — an agent must choose between
them, so they cannot share a trigger. Merge when they always fire together and the procedure runs
straight through. A skill that only restates a role's boundaries is not a skill; delete it.

## Before adding an external skill instead

Check `catalog/external-skills.json` first. If a maintained official skill already covers the
capability, reference it there rather than writing a local duplicate — and record the fallback, so
an agent without it installed still has a path. Write a local skill when no adequate external one
exists, or when the external one cannot be relied on (unmaintained, unclear licence, single-drop
repository).

Attribution

nahid-sparktalesnahid-sparktales
View sourceMore from nahid-sparktales →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Caveman

Ultra-compressed communication mode that cuts output tokens while keeping technical accuracy. Levels: lite, full, ultra and the wenyan variants. Use for /caveman, "caveman mode", "talk like caveman", "be brief" or "less tokens".

1066601 votes

Hyperplan

Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...

686011 votes

Mcp Code Execution

Routes multi-tool workflows through MCP servers for large datasets and pipelines. Use when Bash tool overhead is limiting throughput on data-heavy tasks.

3351 votes

catchup

Recovers the conversation and failed tool calls of a previous Codex, Claude Code, Antigravity, Cline, Copilot CLI, Cursor, DeepSeek Harness, Kimi, OpenCode, Pi Agent, or ZCode session. Use when the user says "catch up", "what did the last session do", "get me up to speed", "I switched agents", asks to recover/summarize a previous session before continuing, or asks to diagnose or report a catchup failure. Do NOT use for the current conversation, git history, or any non-agent log.

651 votes

math-skill

A comprehensive mathematical reasoning skill for AI assistants — handles arithmetic to research-level problems with rigorous step-by-step reasoning, systematic verification, and transparent uncertainty handling

381 votes
View all in ai-agents →