write-a-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.2

Overview

This skill is mostly a coherent skill-authoring helper, but it asks agents to create persistent future instructions and recommends an unpinned remote install command that users should review carefully.

Install only if you are comfortable with a skill that can help create durable Claude Code instructions. Prefer project-scoped skills over global ones, review every generated SKILL.md before it is written or used, treat pasted remote SKILL.md files as untrusted source material, and avoid running the suggested npx GitHub install command unless you have reviewed and pinned the source you intend to execute.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:58

Finding

Unpinned Third-Party Code Execution Through GitHub-Based npx Installation

Content

View full analysis

` for library skills). ``` ### Technical Analysis The recommended command instructs users to execute a package directly from the mutable `dennisrongo/claude-skills` GitHub repository. It does not pin the source to a reviewed commit SHA, release artifact, or cryptographically verified package version. Because `npx` downloads and executes package code, a later change to the repository can alter the effective payload without changing this audited skill. The `--yes` option also suppresses the normal confirmation prompt, reducing the opportunity for a user to review the package source before execution. This creates a supply-chain trust dependency on the repository account, repository configuration, branch contents, transitive dependencies, and the delivery channel. ### Attack Path 1. An attacker compromises the referenced GitHub repository, a maintainer account, or an upstream dependency used by its CLI. 2. The attacker modifies the package entry point, lifecycle behavior, or installation command on the repository's default branch. 3. A user follows the command generated by this skill: ```bash npx --yes github:dennisrongo/claude-skills install ``` 4. `npx` retrieves the current attacker-controlled repository contents. 5. The malicious package executes with the permissions of the user who invoked the command. 6. The payload can access files, environment variables, credentials, and network resources available to that user. ### Impact Assessment Successful exploitation permits arbitrary code execution under the invoking user's account. The resulting access ...[truncated 399 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:202

Finding

Untrusted External Skill Content Can Be Propagated Without Security Validation

Content

View full analysis

but for our repo" **Claude:** 1. Fetches the URL, reads the source skill. 2. Identifies what to keep (process, description requirements, checklist) and what to adapt (directory structure, README updates, this repo's voice). 3. Scaffolds the adapted version, gets user sign-off, writes the file. ``` ### Technical Analysis The documented workflow permits a user-provided URL to be fetched and used as source material for a locally trusted skill. It does not establish a security boundary between untrusted remote content and executable agent instructions. A remote `SKILL.md` can contain prompt-injection text, commands that download or execute additional payloads, instructions to access credentials, persistent configuration changes, encoded content, or attempts to override higher-priority constraints. The workflow only calls for identifying what to retain and adapt; it does not require URL validation, source pinning, inspection of linked files, or a security review of retained behavior. Although the example states that user sign-off is obtained, approval of a generated draft is not a sufficient control if risky instructions are obscured, indirect, or presented as ordinary workflow steps. ### Attack Path 1. An attacker creates or compromises a remotely hosted `SKILL.md`. 2. The file includes plausible skill content together with unsafe instructions, such as remote command execution, secret-file access, persistence, or instruction-hijacking behavior. 3. The attacker supplies the URL to a user or convinces the user to request a similar skill. 4. The agent ...[truncated 1092 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, a

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The skill is designed to create persistent artifacts in repo-local or global skill directories and update README.md, which changes behavior across future sessions and projects. Persistence is intentional for this skill's function, but it still carries security risk because a malicious or mistaken invocation could install durable instructions that influence later agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: write-a-skill
description: Create a new Claude Code skill — scaffolds a properly-structured `SKILL.md` (with YAML frontmatter, trigger-rich description, workflow, examples, anti-patterns), drops it in the right location (this library's `skills/`, the project's `.claude/skills/`, or the global `~/.claude/skills/`), and — when adding to the `dennisrongo/claude-skills` library — also updates the README table. Use this skill whenever the user says "create a skill", "write a skill", "new skill", "add a skill", "make a skill", "/write-a-skill", or pastes a SKILL.md URL and asks for something similar — even if they don't explicitly say "skill author".
---

# Write a Skill

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says to use this skill whenever the user says phrases like "create a skill," "new skill," "add a skill," or "make a skill," and even broadens activation to pasted SKILL.md URLs with similarity requests. Several of these are common, high-level phrases that could match casual discussion or exploratory requests, increasing the risk of unintended invocation despite the later non-trigger note in the body.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

| Behavior should depend on a condition | A conditional keyed to an observable predicate ("if `X.md` exists, …") | An unconditional rule plus exemption clauses |

   No nuance clauses ("don't X unless it matters" reopens the negotiation) — express a real exception as its own conditional on something observable.
7. **Write the description carefully** — see [Writing the description](#writing-the-description). This is the single highest-leverage part of the file.
8. **Self-review** against the [Review checklist](#review-checklist) before showing the user.
   - **Prove it works (discipline and technique skills).** Re-run the baseline scenario from step 1 in a fresh sub-agent *with* the skill loaded. Complies → done. Finds a new rationalization → add its counter to the table and re-run. A skill you never watched change behavior is documentation, not a skill. Reference-only skills skip this; test retrieval instead (can a fresh agent find the right entry?).
9. **If targeting the library repo, update `README.md`** — add a row to the skills table in alphabetical order with a one-paragraph "what it does" hook matching the existing voice. Verify the row by re-reading the file after the edit.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill instructs use of npx --yes github:dennisrongo/claude-skills install <name>, which pulls and executes remote code from a GitHub repository without pinning to an immutable commit or version. If the upstream repo is compromised or changes unexpectedly, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

**Claude:**

1. Confirms the trigger phrases ("lint this", "fix lint", "/lint-and-stage") via `AskUserQuestion`.
2. Names it `lint-and-stage`, scaffolds `skills/lint-and-stage/SKILL.md` from `_template/`.
3. Fills in the workflow (run `eslint --fix`, run `git add -u`, summarize changed files).
4. Writes a description with all three trigger phrases.
5. Adds a row to `README.md` skills table.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

**Claude:**

1. Detects CWD is not the library repo → targets `./.claude/skills/changeset-reminder/SKILL.md`.
2. Creates `.claude/skills/` if missing.
3. Drafts a tiny skill keyed on `git commit` / "commit" triggers that checks for a changeset file and warns if missing.
4. Does **not** touch the library README.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

- ❌ Hard-coding model names, package versions, or dates that will rot. Resolve at runtime when possible.
- ❌ Putting executable behavior in `SKILL.md` prose when a 10-line script would be deterministic and cheaper.
- ❌ For library skills: drafting the SKILL.md but forgetting to update the README table — the skill is invisible to anyone browsing the repo.
- ❌ Overwriting an existing skill without confirmation when the names collide.
- ✅ Trigger-rich description, imperative workflow, one concrete example, explicit anti-patterns, under 150 lines.

## Notes

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

- The library repo's `_template/SKILL.template.md` is the canonical starting point when working inside `dennisrongo/claude-skills`. It lives outside `skills/` (so `clawhub sync` can't publish it and the installer can't pick it up) — copy it in as `skills/<name>/SKILL.md`.
- When adapting a skill from an external source (e.g. another GitHub repo), credit the inspiration in a `## Notes` line — don't copy verbatim if the voice doesn't match this repo's existing skills.
- Skills installed to `~/.claude/skills/` are picked up by every Claude Code session globally; `.claude/skills/` in a project is scoped to that repo. The library repo's `skills/<name>/` is the *source* — not where Claude reads from at runtime.

Static analysis

No suspicious patterns detected.