Create CliCAUTION
Scripts for agents, shared between my repositories.
Overview
Scripts for agents, shared between my repositories.
e7b2fa5dbb6fOBSERVED · 2026-10-21What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: create-cli description: "CLI UX/spec: args, flags, help, output, errors, config, dry-run." --- # Create CLI Design CLI surface area (syntax + behavior), human-first, script-friendly. ## Do This First - Read `agent-scripts/skills/create-cli/references/cli-guidelines.md` and apply it as the default rubric. - Upstream/full guidelines: https://clig.dev/ (propose changes: https://github.com/cli-guidelines/cli-guidelines) - Ask only the minimum clarifying questions needed to lock the interface. ## Clarify (fast) Ask, then proceed with best-guess defaults if user is unsure: - Command name + one-sentence purpose. - Primary user: humans, scripts, or both. - Input sources: args vs stdin; files vs URLs; secrets (never via flags). - Output contract: human text, `--json`, `--plain`, exit codes. - Interactivity: prompts allowed? need `--no-input`? confirmations for destructive ops? - Config model: flags/env/config-file; precedence; XDG vs repo-local. - Platform/runtime constraints: macOS/Linux/Windows; single binary vs runtime. ## Deliverables (what to output) When designing a CLI, produce a compact spec the user can implement: - Command tree + USAGE synopsis. - Args/flags table (types, defaults, required/optional, examples). - Subcommand semantics (what each does; idempotence; state changes). - Output rules: stdout vs stderr; TTY detection; `--json`/`--plain`; `--quiet`/`--verbose`. - Error + exit code map (top failure modes). - Safety rules: `--dry-run`, confirmations, `--force`, `--no-input`. - Config/env rules + precedence (flags > env > project config > user config > system). - Shell completion story (if relevant): install/discoverability; generation command or bundled scripts. - 5–10 example invocations (common flows; include piped/stdin examples). ## Default Conventions (unless user says otherwise) - `-h/--help` always shows help and ignores other args. - `--version` prints version to stdout. - Primary data to stdout; diagnostics/errors to stderr. - Add `--json` for machine output; consider `--plain` for stable line-based text. - Prompts only when stdin is a TTY; `--no-input` disables prompts. - Destructive operations: interactive confirmation + non-interactive requires `--force` or explicit `--confirm=...`. - Respect `NO_COLOR`, `TERM=dumb`; provide `--no-color`. - Handle Ctrl-C: exit fast; bounded cleanup; be crash-only when possible. ## Templates (copy into your answer) ### CLI spec skeleton Fill these sections, drop anything irrelevant: 1. **Name**: `mycmd` 2. **One-liner**: `...` 3. **USAGE**: - `mycmd [global flags] <subcommand> [args]` 4. **Subcommands**: - `mycmd init ...` - `mycmd run ...` 5. **Global flags**: - `-h, --help` - `--version` - `-q, --quiet` / `-v, --verbose` (define exactly) - `--json` / `--plain` (if applicable) 6. **I/O contract**: - stdout: - stderr: 7. **Exit codes**: - `0` success - `1` generic failure - `2` invalid usage (parse/validation) - (add command-specific codes only when actually useful) 8. **Env/config**: - env vars: - config file path + precedence: 9. **Examples**: - ... ## Notes - Prefer recommending a parsing library (language-specific) only when asked; otherwise keep this skill language-agnostic. - If the request is “design parameters”, do not drift into implementation.
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (5)
skills/autoreview
skills/behavior-validator
skills/birdclaw
skills/crabbox
skills/discrawl
Gates applied: no_behavioural_pass.
e7b2fa5dbb6ffull audit observations/trust-audit/skill/steipete__create-cli.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-21 | e7b2fa5dbb6f | CAUTION | B | 89 | first audit |
Questions
What does the create-cli — steipete/agent-scripts skill do?
Scripts for agents, shared between my repositories.
Is create-cli — steipete/agent-scripts safe to install?
With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can create-cli — steipete/agent-scripts access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (e7b2fa5dbb6f), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.
Add this badge to your README
Shows this page's audit result and links back to it. It updates when the audit does.
[](https://modelsatlas.com/skills/steipete/create-cli/)
Not your listing, or something out of date? Claim or update your listing.