Atlas / Skills / sangrokjung / Skill Factory

Skill FactorySAFE

skills/sangrokjung/skill-factory

oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.

Verdict
SAFE
Grade
B
Trust score
89 /100
Version
—
Hosts
2 documented
License
MIT
Stars
855
01

Overview

oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.

Read from source at commit 31c3d29836edOBSERVED · 2026-10-12
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
openclawmentioned
03

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: skill-factory
description: >
  Analyze session work and automatically convert reusable patterns into Claude Code skills.
  Use when: "세션을 스킬로", "스킬 만들어", "이거 스킬로", "skill factory",
  "이 작업 자동화해", "스킬 추출", "make this a skill", "extract skill",
  "convert to skill", "스킬 팩토리", "자동 스킬 생성".
  Differs from skill-creator (archived) and manage-skills (drift detection):
  this skill actively analyzes sessions, checks for duplicates, and creates skills via Agent Teams.
disable-model-invocation: true
argument-hint: "[--dry-run] [--no-team] [--target name] [--scope global|project]"
---

# Skill Factory

Automated pipeline: session analysis -> duplicate check -> skill creation.
Requires: Python 3.8+, bash, git. Agent Teams path requires `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`.

| Existing Skill | Role | skill-factory Difference |
|----------------|------|--------------------------|
| skill-creator (archived) | Manual 6-step guide | Automated pipeline |
| manage-skills | Drift detection (verify-* skills) | Proactive skill generation (manage-skills verifies existing; skill-factory creates new) |
| continuous-learning | Passive pattern extraction | On-demand + team execution |

## Parameter Parsing

Parse `$ARGUMENTS` for flags:

| Flag | Default | Description |
|------|---------|-------------|
| `--dry-run` | false | Analyze and report only, no file creation |
| `--no-team` | false | Run sequentially without Agent Teams |
| `--target` | (auto) | Specific pattern name to extract |
| `--scope` | global | `global` (~/. claude/skills/) or `project` (.claude/skills/) |

If no arguments, run full auto-detection pipeline.

## Phase 1: Session Analysis

Collect what happened in this session:

```bash
# Uncommitted changes
git diff HEAD --name-only 2>/dev/null

# Recent commits on current branch
git log --oneline -20 2>/dev/null

# Branch diff from main
git diff main...HEAD --name-only 2>/dev/null
```

From collected changes, identify **candidate patterns** - repeatable workflows that appeared:

1. **Multi-step sequences** - 3+ actions performed in consistent order
2. **Tool combinations** - Specific tools used together (e.g., Grep + Read + Edit)
3. **Domain procedures** - File types or directories accessed with specific operations
4. **Repeated transformations** - Same type of change applied to multiple files

If `--target` is specified, focus analysis on that named pattern only.

For each candidate, produce a JSON entry (internal, not shown to user):

```json
{
  "name": "pattern-name",
  "description": "What was done repeatedly",
  "files": ["path/a.ts", "path/b.ts"],
  "steps": ["Step1", "Step2", "Step3"],
  "step_count": 3
}
```

Present findings to user:

```
Session Analysis Complete

Candidate Patterns Found: N

1. [pattern-name] - "Description of what was done repeatedly"
   Files: path/a.ts, path/b.ts (N files)
   Steps: Step1 -> Step2 -> Step3

2. [pattern-name] - "Description"
   ...

Which patterns should become skills? (select or 'all')
```

Wait for user selection before proceeding.

## Phase 2: Similarity Check

For each selected pattern, check against existing inventory.

**Step 1: Scan inventory**
```bash
bash $HOME/.claude/skills/skill-factory/scripts/scan-inventory.sh --scope all > /tmp/sf-manifest.json
```

**Step 2: Score similarity**
```bash
python3 $HOME/.claude/skills/skill-factory/scripts/similarity-scorer.py \
  --candidate "<pattern description>" \
  --candidate-name "<pattern-name>" \
  --manifest /tmp/sf-manifest.json \
  --top 3
```

**Step 3: Apply decision logic** (see [references/decision-tree.md](references/decision-tree.md))

Present results to user:

```
Similarity Check Results

Pattern: "pdf-batch-edit"
  Top match: nano-pdf (score: 0.72) -> MERGE
  Recommendation: Extend nano-pdf with batch operations

Pattern: "config-updater"
  Top match: init-project (score: 0.45) -> UPDATE
  Recommendation: Add config-update subsection to init-project

Pattern: "api-load-test"
  Top match: e2e (score: 0.24) -> CREATE
  Recommendation: Create new skill

Action for each pattern? (CREATE / UPDATE / MERGE / SKIP)
```

Wait for user decision per pattern.

## Phase 3: Blueprint

For each CREATE/UPDATE/MERGE decision, design the skill structure.

### CREATE Blueprint

Select template type from [references/skill-templates.md](references/skill-templates.md):
- **Workflow** for sequential processes
- **Task/Tool** for operation collections
- **Reference** for domain knowledge
- **Verification** for automated checks

Generate blueprint:

```
Blueprint: api-load-test

Type: Workflow
Scope: global (~/.claude/skills/)
Structure:
  api-load-test/
  ├── SKILL.md (~200 lines)
  │   ├── Frontmatter: name, description with triggers
  │   ├── Overview
  │   ├── Prerequisites
  │   ├── Workflow (4 steps)
  │   └── Output Format
  └── scripts/
      └── run-load-test.sh

Key sections:
  1. Target URL configuration
  2. Load profile definition
  3. Test execution
  4. Results analysis

Approve this blueprint? (y/n/edit)
```

Wait for user approval.

### UPDATE Blueprint

For UPDATE verdicts (score 0.3-0.6), plan a lightweight addition to the existing skill:

```
UPDATE Blueprint: config-updater -> init-project

Target skill: ~/.claude/skills/init-project/SKILL.md
Action: Add subsection "## Config Update" with steps
Estimated diff: +20-40 lines in existing SKILL.md
```

### MERGE Blueprint

For MERGE verdicts (score 0.6-0.8), plan a significant extension of the existing skill:

```
MERGE Blueprint: pdf-batch-edit -> nano-pdf

Target skill: ~/.claude/skills/nano-pdf/SKILL.md
Sections to add: "## Batch Operations" (new workflow section)
Scripts to add: scripts/batch-process.sh
Estimated diff: +60-100 lines in SKILL.md, +1 script
```

## Phase 4: Execution

Two paths based on `--no-team` flag and Agent Teams availability.

Check Agent Teams availability:
```bash
[ "${CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS:-0}" = "1" ] && echo "teams" || echo "no-team"
```
If `--no-team` is set or env var is missing/0, 
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 31c3d29836edfull audit observations/trust-audit/skill/sangrokjung__skill-factory.json · Report an issue / request a re-scan
05

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-1231c3d29836edSAFEB89first audit
06

Questions

What does the Skill Factory skill do?

oh-my-zsh for Claude Code — 16 agents, 35 commands, 32 skills, 21 safety hooks in one install. v4.0 adds an adversarial review loop: a second agent that never sees the first one's reasoning. MIT.

Is Skill Factory safe to install?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.

What can Skill Factory access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

Which assistants does Skill Factory work with?

Its documentation mentions claude-code and openclaw. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (31c3d29836ed), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement