skill-factory

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capa...

Security Scan

The skill is internally consistent with its stated purpose (a guide to logging learnings and errors), but its runtime instructions direct the agent to write and promote project-level files which can expose sensitive data or alter repository behavior — review and constrain what gets logged before using.

Purpose & Capability

The name/description (skill-factory / guide for creating skills) aligns with the SKILL.md: guidance about logging learnings, errors, feature requests and promoting useful items into project docs is coherent for a self-improvement / skill-authoring helper.

Instruction Scope

The instructions tell the agent to log errors, user corrections, API failures, feature requests, and other learnings into markdown files under `.learnings/` and to promote broadly applicable items into repo-level docs (CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, TOOLS.md, etc.). This is within the stated purpose but has two risks: (1) it will persist arbitrary user-provided or tool output content to disk (which can include secrets or PII) and (2) it explicitly directs promotion to project-wide files which can change repo/agent behavior. The SKILL.md does not include safeguards (redaction, filtering, approval flow) or limits on what to log.

Install Mechanism

Instruction-only skill with no install steps, no downloads, and no code files — lowest install risk.

Credentials

The skill requests no environment variables, credentials, or config paths. The absence of requested secrets is proportionate to its stated purpose. Note: despite no creds being requested, the instructions could cause sensitive data to be written to disk if the agent logs inputs that contain secrets.

Persistence & Privilege

always:false and no special privileges are requested, but the instructions explicitly recommend modifying/promoting content to repository-level files. That behavior gives the skill the practical ability to persist changes that affect other agents or project documentation; consider requiring manual review/approval before promotion.

Assessment

This skill is a coherent guide for logging learnings, but it will tell the agent to write potentially sensitive content into repository files and to promote entries into project-level documents. Before installing or enabling it: (1) decide where logs should live (private sandbox vs project repo), (2) implement or require redaction/filtering of secrets/PII, (3) require human review/approval before promoting changes to CLAUDE.md/AGENTS.md/.github files, and (4) restrict write permissions or run the skill in an isolated workspace if you do not want repo-wide changes.

Self-Improvement Skill

Log learnings and errors to markdown files for continuous improvement. Coding agents can later process these into fixes, and important learnings get promoted to project memory.

Quick Reference

Situation	Action
Command/operation fails	Log to .learnings/ERRORS.md
User corrects you	Log to .learnings/LEARNINGS.md with category correction
User wants missing feature	Log to .learnings/FEATURE_REQUESTS.md
API/external tool fails	Log to .learnings/ERRORS.md with integration details
Knowledge was outdated	Log to .learnings/LEARNINGS.md with category knowledge_gap
Found better approach	Log to .learnings/LEARNINGS.md with category best_practice
Simplify/Harden recurring patterns	Log/update .learnings/LEARNINGS.md with Source: simplify-and-harden and a stable Pattern-Key
Similar to existing entry	Link with **See Also**, consider priority bump
Broadly applicable learning	Promote to CLAUDE.md, AGENTS.md, and/or .github/copilot-instructions.md
Workflow improvements	Promote to AGENTS.md (OpenClaw workspace)
Tool gotchas	Promote to TOOLS.md (OpenClaw workspace)
Behavioral patterns	Promote to SOUL.md (OpenClaw workspace)