Skill FactorySAFE
oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.
Overview
oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.
31c3d29836edOBSERVED · 2026-10-12Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| openclaw | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: skill-factory
description: >
Analyze session work and automatically convert reusable patterns into Claude Code skills.
Use when: "세션을 스킬로", "스킬 만들어", "이거 스킬로", "skill factory",
"이 작업 자동화해", "스킬 추출", "make this a skill", "extract skill",
"convert to skill", "스킬 팩토리", "자동 스킬 생성".
Differs from skill-creator (archived) and manage-skills (drift detection):
this skill actively analyzes sessions, checks for duplicates, and creates skills via Agent Teams.
disable-model-invocation: true
argument-hint: "[--dry-run] [--no-team] [--target name] [--scope global|project]"
---
# Skill Factory
Automated pipeline: session analysis -> duplicate check -> skill creation.
Requires: Python 3.8+, bash, git. Agent Teams path requires `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`.
| Existing Skill | Role | skill-factory Difference |
|----------------|------|--------------------------|
| skill-creator (archived) | Manual 6-step guide | Automated pipeline |
| manage-skills | Drift detection (verify-* skills) | Proactive skill generation (manage-skills verifies existing; skill-factory creates new) |
| continuous-learning | Passive pattern extraction | On-demand + team execution |
## Parameter Parsing
Parse `$ARGUMENTS` for flags:
| Flag | Default | Description |
|------|---------|-------------|
| `--dry-run` | false | Analyze and report only, no file creation |
| `--no-team` | false | Run sequentially without Agent Teams |
| `--target` | (auto) | Specific pattern name to extract |
| `--scope` | global | `global` (~/. claude/skills/) or `project` (.claude/skills/) |
If no arguments, run full auto-detection pipeline.
## Phase 1: Session Analysis
Collect what happened in this session:
```bash
# Uncommitted changes
git diff HEAD --name-only 2>/dev/null
# Recent commits on current branch
git log --oneline -20 2>/dev/null
# Branch diff from main
git diff main...HEAD --name-only 2>/dev/null
```
From collected changes, identify **candidate patterns** - repeatable workflows that appeared:
1. **Multi-step sequences** - 3+ actions performed in consistent order
2. **Tool combinations** - Specific tools used together (e.g., Grep + Read + Edit)
3. **Domain procedures** - File types or directories accessed with specific operations
4. **Repeated transformations** - Same type of change applied to multiple files
If `--target` is specified, focus analysis on that named pattern only.
For each candidate, produce a JSON entry (internal, not shown to user):
```json
{
"name": "pattern-name",
"description": "What was done repeatedly",
"files": ["path/a.ts", "path/b.ts"],
"steps": ["Step1", "Step2", "Step3"],
"step_count": 3
}
```
Present findings to user:
```
Session Analysis Complete
Candidate Patterns Found: N
1. [pattern-name] - "Description of what was done repeatedly"
Files: path/a.ts, path/b.ts (N files)
Steps: Step1 -> Step2 -> Step3
2. [pattern-name] - "Description"
...
Which patterns should become skills? (select or 'all')
```
Wait for user selection before proceeding.
## Phase 2: Similarity Check
For each selected pattern, check against existing inventory.
**Step 1: Scan inventory**
```bash
bash $HOME/.claude/skills/skill-factory/scripts/scan-inventory.sh --scope all > /tmp/sf-manifest.json
```
**Step 2: Score similarity**
```bash
python3 $HOME/.claude/skills/skill-factory/scripts/similarity-scorer.py \
--candidate "<pattern description>" \
--candidate-name "<pattern-name>" \
--manifest /tmp/sf-manifest.json \
--top 3
```
**Step 3: Apply decision logic** (see [references/decision-tree.md](references/decision-tree.md))
Present results to user:
```
Similarity Check Results
Pattern: "pdf-batch-edit"
Top match: nano-pdf (score: 0.72) -> MERGE
Recommendation: Extend nano-pdf with batch operations
Pattern: "config-updater"
Top match: init-project (score: 0.45) -> UPDATE
Recommendation: Add config-update subsection to init-project
Pattern: "api-load-test"
Top match: e2e (score: 0.24) -> CREATE
Recommendation: Create new skill
Action for each pattern? (CREATE / UPDATE / MERGE / SKIP)
```
Wait for user decision per pattern.
## Phase 3: Blueprint
For each CREATE/UPDATE/MERGE decision, design the skill structure.
### CREATE Blueprint
Select template type from [references/skill-templates.md](references/skill-templates.md):
- **Workflow** for sequential processes
- **Task/Tool** for operation collections
- **Reference** for domain knowledge
- **Verification** for automated checks
Generate blueprint:
```
Blueprint: api-load-test
Type: Workflow
Scope: global (~/.claude/skills/)
Structure:
api-load-test/
├── SKILL.md (~200 lines)
│ ├── Frontmatter: name, description with triggers
│ ├── Overview
│ ├── Prerequisites
│ ├── Workflow (4 steps)
│ └── Output Format
└── scripts/
└── run-load-test.sh
Key sections:
1. Target URL configuration
2. Load profile definition
3. Test execution
4. Results analysis
Approve this blueprint? (y/n/edit)
```
Wait for user approval.
### UPDATE Blueprint
For UPDATE verdicts (score 0.3-0.6), plan a lightweight addition to the existing skill:
```
UPDATE Blueprint: config-updater -> init-project
Target skill: ~/.claude/skills/init-project/SKILL.md
Action: Add subsection "## Config Update" with steps
Estimated diff: +20-40 lines in existing SKILL.md
```
### MERGE Blueprint
For MERGE verdicts (score 0.6-0.8), plan a significant extension of the existing skill:
```
MERGE Blueprint: pdf-batch-edit -> nano-pdf
Target skill: ~/.claude/skills/nano-pdf/SKILL.md
Sections to add: "## Batch Operations" (new workflow section)
Scripts to add: scripts/batch-process.sh
Estimated diff: +60-100 lines in SKILL.md, +1 script
```
## Phase 4: Execution
Two paths based on `--no-team` flag and Agent Teams availability.
Check Agent Teams availability:
```bash
[ "${CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS:-0}" = "1" ] && echo "teams" || echo "no-team"
```
If `--no-team` is set or env var is missing/0, Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
31c3d29836edfull audit observations/trust-audit/skill/sangrokjung__skill-factory.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 31c3d29836ed | SAFE | B | 89 | first audit |
Questions
What does the Skill Factory skill do?
oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.
Is Skill Factory safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Skill Factory access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Skill Factory work with?
Its documentation mentions claude-code and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (31c3d29836ed), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.