Agent Skills PlatformBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

/agent-skills-platform

Turn my monthly revenue-variance review into a reusable internal skill.
I attached past reports and the source spreadsheets. The decision is whether to
escalate a material variance. It must not modify source data.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: agent-skills-platform
description: >-
  Create cross-platform agent skills from workflow descriptions. Activates when
  users ask to create an agent, automate a repetitive workflow, create a custom
  skill, or need advanced agent creation. Triggers on phrases like create agent
  for, automate workflow, create skill for, every day I have to, daily I need to,
  turn process into agent, need to automate, create a cross-platform skill,
  validate this skill, export this skill, migrate this skill, audit this skill,
  is this skill safe, vet a skill before installing, what does this skill access.
  Supports single skills, multi-agent suites, transcript processing,
  template-based creation, interactive configuration, cross-platform export,
  spec validation, and security auditing of third-party skills before install.
license: MIT
activation: /agent-skills-platform
# Compatibility alias: /agent-skill-creator
metadata:
  author: Francy J G Lisboa
  version: 6.1.0
  created: 2025-10-18
  last_reviewed: 2026-08-11
  review_interval_days: 180
  dependencies:
    - name: GitHub repository transport
      url: https://github.com/FrancyJGLisboa/agent-skills-platform
      type: service
    - name: GitHub raw bootstrap transport
      url: https://raw.githubusercontent.com/FrancyJGLisboa/agent-skills-platform/main/scripts/bootstrap.sh
      type: service
provenance:
  maintainer: Francy J G Lisboa
  version: 6.1.0
  created: 2025-10-18
  source_references:
    - https://github.com/FrancyJGLisboa/agent-skills-platform
    - https://agentskills.io
compatibility: >-
  Works on all platforms supporting the Agent Skills Open Standard (SKILL.md):
  Claude Code, GitHub Copilot CLI, VS Code Copilot, Cursor, Windsurf, Cline,
  OpenAI Codex CLI, Gemini CLI, and more — 17 platforms total.
---
# /agent-skills-platform — Turn Existing Work Into a Reusable Skill

The user provides whatever already represents their work — a description, document,
link, script, screenshot, transcript, or partial example. Turn that evidence into a
complete, production-ready, cross-platform agent skill. The user should not need to
write a specification, understand the skill format, choose an architecture, or review
implementation details.

Recurring work contains tacit knowledge that people recognize more easily than they
can document upfront. Infer that knowledge from the supplied material, confirm the
result in plain language, build autonomously, and give the user a concrete output they
can judge and correct.

## The User Journey

Use this guided-light path by default. Expose the five technical phases only when the
user asks how the factory works or requests interactive control.

1. **Understand** — read the evidence and summarize the question, trigger, supported
   decision, required evidence, and measurable success condition alongside the
   workflow, input, and output. Ask for one confirmation or correction.
2. **Build** — create the skill autonomously. Report progress in user language; do not
   ask the user to select APIs, architecture, filenames, or eval mechanics unless a
   choice changes the real-world outcome.
3. **Check** — run validation, pipeline, security, and eval gates. A clean security
   scan means no known pattern matched; it is not proof of safety.
4. **Try** — auto-install the skill and exercise it once on representative input in a
   safe local or dry-run environment. Show the output and ask whether it matches the
   user's work.

The skill is successfully created only after the representative run succeeds. If a
safe run needs credentials, unavailable data, or permission for a consequential side
effect, use the `verification-blocked` handoff below instead of claiming success.

At creation start, run `python3 scripts/success_ledger.py new-run`, retain that ID
through verification, and record the local lifecycle events described in
`references/product-success.md`. Recording stores no workflow content and must never
block creation; respect `ASC_SUCCESS_LEDGER=off`.

### First-run destination routing

Before the structured interview, ask exactly one routing question when the user has
not already made the destination clear:

> Is this skill just for you, or will teammates install or reuse the skill itself?

- **Just for me** — create, verify, and install a private skill. Do not ask the user
  to create a marketplace or invent owners and approval state.
- **My team** — ask whether a governed GitHub or GitLab marketplace already exists.
  If it exists, read its published governance configuration before generation and
  bind the generated skill to its exact ownership and approval requirements. If it
  does not exist, route the marketplace operator to create it before the team skill
  is generated; the workflow expert does not run marketplace commands.

Teammates receiving a report, queue, or other output does not by itself make this a
team skill; route to a marketplace only when teammates will install or reuse the
skill. This is destination routing, not a technical interview. Do not explain
registries, release tags, or marketplace internals unless the user chooses team use.

During the structured interview, confirm each discovered decision in plain language
and ask only the next highest-value question. Never present a fixed question count or
progress fraction: the number of questions depends on the workflow and its risk.

## Trigger

User invokes `/agent-skills-platform` followed by their input:

```
/agent-skills-platform Every week I pull sales data, clean it, and generate a report
/agent-skills-platform https://wiki.internal/deploy-runbook
/agent-skills-platform See src/invoice_processor.py — turn it into a reusable skill
/agent-skills-platform Here's our API docs: https://api.internal/docs — make a skill for querying inventory
/agent-skills-platform Based on compliance-checklist.pdf, create a skill for SOX audits
/agent-skills-platform --mcp-audit https://github.com/vendor/mcp-server — we pay for this data,

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (2 observation(s))

Network

declared (8 observation(s))

Shell

declared (6 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

A skill is not a document. It ships executable scripts that run with the user's filesystem access and whatever API keys are in their environment, and its instruction body is read by the agent at load

icon.icns

f"m=importlib.import_module({('data_contract_' + cid + '.code.contract_health')!r}); "

"Exfiltration directive",

r"(?i)\b(?:send|post|upload|transmit|forward|exfiltrate)\b[^.\n]{0,60}"

secret = "test-resolver-attestation-secret"

.contract_id

.contract_id

.contract_id

.contract_id

.contract_id

candidates.push(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../scripts"));

- ../../SKILL.md

- ../../SKILL.md

- ../../SKILL.md

SPEC = "skills:\n  - ../../SKILL.md\ntasks:\n  - name: happy\n    prompt: run it\n    activates: [demo]\n"

self.assertIn("Exfiltration directive", self._patterns(result))

@tailwindcss/vite, @tauri-apps/api, @tauri-apps/plugin-dialog, @tauri-apps/plugin-opener, @tauri-apps/plugin-process, @tauri-apps/plugin-updater, clsx, lucide-react

yfinance, pandas, numpy, ta-lib, matplotlib, plotly, pytest, pytest-cov

assets/acme-skill-marketplace-executive.png

assets/acme-skill-marketplace-lifecycle.png

docs/assets/acme-skill-marketplace-lifecycle.png

docs/assets/agent-skills-platform-social-preview.png

Private library? Open "Private repository? Add an access token" under the

"Private repository? Add an access token" and paste a personal access token

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Agent Skills Platform](https://modelsatlas.com/skills/francyjglisboa/agent-skill-creator/badge.svg)](https://modelsatlas.com/skills/francyjglisboa/agent-skill-creator/)

Not your listing, or something out of date? Claim or update your listing.