Skip to content
Back to skills

Docs

ASecurity

Add a skill when a workflow has burned you **twice** — that second fire is the signal that the knowledge needs to live outside someone's head. A skill is cheaper than a wiki page because agents actually load it.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 29, 2026
ai-agentsrustgobashgit

Works with

  • cli

Security analysis

A100/100

Pro scans all 9 files and shows the line behind each finding

Scanned September 29, 2026

npx -y skills add Rvey/agent-engineering-kit --skill docs --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Docs?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Docs
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/rvey-docs/badge)](https://www.skillsdirectory.com/skills/rvey-docs)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Adding a skill

Add a skill when a workflow has burned you **twice** — that second fire is
the signal that the knowledge needs to live outside someone's head. A skill
is cheaper than a wiki page because agents actually load it.

## Where skills live

| Location | Purpose |
|---|---|
| `.agents/skills/<name>/SKILL.md` | Vendored, committed, travels with the repo — the canonical home |
| `.agents/skills/<name>/references/` | Tier-2 detail loaded only when the SKILL.md tier is insufficient |
| Agent-specific dirs (`.claude/skills/`, …) | Optional symlinks/copies for tools that expect their own path |
| Upstream catalogs | Installed per machine via `npx skills add <source>` — not required by the repo |

## Add workflow

1. **Pick the source.** Prefer vendoring a battle-tested upstream skill
   ([addyosmani/agent-skills](https://github.com/addyosmani/agent-skills) is a
   good catalog) over writing from scratch. Browse with
   `npx skills add addyosmani/agent-skills --list`.
2. **Vendor it.** Copy `SKILL.md` into `.agents/skills/<name>/` using the
   skill's own name. Per-skill installs do **not** copy repo-level
   `references/` — copy any checklist the skill needs into its
   `references/` and fix relative links.
3. **Adapt the commands.** Replace upstream commands/paths with your repo's
   real gates. Keep the workflow intact; change the wiring.
4. **Check the frontmatter.** `name` + a `description` that starts with what
   it does and includes "Use when…" triggers. The description is the trigger
   an agent matches against — write it for that decision.
5. **Keep it minimal and verifiable.** Steps a human maintainer would accept,
   plus a verification gate. Delete anything you would not enforce.
6. **Wire it into `AGENTS.md`.** Add a row to the routing table with *when*
   to load it. A skill that is not in the table does not exist.
7. **Smoke-test it.** Give the agent a real task that should trigger it; if
   the agent doesn't load it, the description or the table is wrong — fix
   those, not the agent.
8. **Commit the skill and the table together.** One change, one review.

## Scaffold

```bash
scripts/new-skill.sh my-skill-name
# creates .agents/skills/my-skill-name/SKILL.md with frontmatter + skeleton
```

## Template

```markdown
---
name: my-skill-name
description: "What it does in one line. Use when <trigger 1>, <trigger 2>, or <trigger 3>."
---

# My Skill Name

One paragraph on the philosophy / why this workflow exists.

## When to use

- <concrete trigger>
- <concrete trigger>

## When NOT to use

- <case that belongs to another skill>

## Workflow

1. <step with a deliverable>
2. <step with a deliverable>

## Verification

- <command that proves the work is done>
```

## Rules

- **One skill per workflow.** If two skills both claim "tests", agents flip a
  coin. Merge or rename until ownership is unambiguous.
- **Specific beats generic.** "Batch SSE updates into one commit per chunk"
  beats "write performant code".
- **No frozen commands from another repo.** A command that doesn't exist in
  this repo erodes trust in the whole skill; adapt or delete it.
- **No secrets, no client names, no internal URLs** in a vendored skill.
- **References are the tier-2 escape hatch.** Keep the main file skimmable;
  move long tables and exhaustive checklists into `references/`.
- **Prune.** A skill nobody loads is dead weight. If a workflow stopped
  mattering, delete the skill and its routing row in one commit.

## Attribution

Keep the upstream source note in the `SKILL.md` (and add a row to
`CREDITS.md` when vendoring into a repo that tracks credits). MIT/Apache-2.0
skills can be vendored with attribution; state what you changed.

Files in this skill

  • 01-agent-workflow.md5.9 KB
  • 02-skill-catalog.md2.8 KB
  • 03-verification-gates.md3.4 KB
  • 04-performance-guards.md6.3 KB
  • 05-adding-a-skill.md3.6 KB
  • 06-repo-structure.md6.5 KB
  • 07-loop-enforcement.md5.3 KB
  • 08-troubleshooting.md4.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.