AI engineering

8 published SKILL.md files: contents, history, and licenses

chat.dev editorial32 min read
Eight published SKILL.md files grouped by package structure

This directory covers eight public SKILL.md files and their repository records as checked July 30, 2026.

Repository, commit, file, package, and license records used for each directory entry

1. Anthropic skills/skill-creator/SKILL.md

  • Exact file and repository: The file is anthropics/skills/skills/skill-creator/SKILL.md. Its repository is anthropics/skills. The repository describes itself as Anthropic's implementation of skills for Claude and links to the Agent Skills standard.

  • Owner and maintainer: Anthropic publishes and maintains the repository. Its README divides the collection into example skills and document skills. It identifies skill-creator as an example skill. The repository also contains a plugin marketplace manifest for Claude Code distribution.

  • Publication history: The file is present in the repository's initial commit, 37292f37, dated October 15, 2025. October 2025 commits reorganized the example directories. December 2025 commits moved example skills under the current skills/ layout. Commit 1ed29a03 on February 6, 2026 updated skill-creator and made scripts executable. Commit 3d595115 on February 24, 2026 exported another version. Commit b0cbd3df on March 6, 2026 removed an ANTHROPIC_API_KEY requirement from the description optimizer.

  • File length and frontmatter: The checked raw file contains 485 lines, 5,138 whitespace-delimited words, and 33,168 bytes. Its YAML frontmatter contains a name and a description. The name is skill-creator. The description assigns the file to skill creation and revision work. The body begins with # Skill Creator.

  • Body sections: The first-level and second-level body sections cover communication with the user, creating a skill, report structure, commit-message format, running and evaluating test cases, improving the skill, blind comparison, description optimization, Claude.ai instructions, Cowork instructions, and reference files. The creation section has subsections for capturing intent, interviewing and researching, writing SKILL.md, a skill-writing guide, writing style, and test cases. The evaluation section has five numbered steps: start paired runs, draft assertions, capture timing, grade and open the viewer, and read feedback. The description-optimization section has four numbered steps covering query generation, user review, optimization, and application of the selected description.

  • Stated purpose: The file tells an agent to create a new skill or revise an existing one. It asks for the target capability, trigger context, output format, and a decision about evaluation cases. It assigns all trigger guidance to the frontmatter description. The body states that the description is the primary triggering mechanism and instructs the author to include the task and the conditions under which the skill applies.

  • Package model described by the file: The file defines a skill as a directory with a required SKILL.md and optional bundled resources. It describes three loading levels. Metadata remains available for discovery. The body enters context when the skill activates. Bundled files are read or executed when the workflow calls for them. The body names scripts/, references/, and assets/ as resource types. It gives a target of fewer than 500 lines for the entry file and asks authors to move additional detail into directly linked files.

  • Creation workflow: The agent asks what the skill must enable, when it must trigger, which output format applies, and whether test cases are appropriate. It then interviews the user about edge cases, input formats, success criteria, dependencies, and examples. The writing instructions cover frontmatter, directory layout, procedural text, examples, references, and executable resources. The file asks the agent to use imperative language and to state why a step exists when the reason affects execution.

  • Evaluation workflow: For a new skill, the baseline run receives the same task without a skill. For an existing skill, the instructions create a snapshot and use that older package as the baseline. The file assigns paired tasks to agents in the same turn. It uses an iteration directory with per-evaluation subdirectories for with_skill, without_skill, or old_skill outputs. It stores evaluation prompts, input files, expected outputs, assertions, timing, token counts, grader results, and user feedback in structured files.

  • Assertions and grading: The file asks for objective assertions when outputs permit them. It tells the agent to draft assertions while evaluation runs are still in progress. It distinguishes objective checks from qualitative review. A grader reads output files and produces structured results. The workflow aggregates scores and opens a review viewer. User feedback from the viewer is read before the next edit.

  • Blind comparison: The advanced comparison section uses a comparator that receives two outputs without being told which one used the skill. The comparator selects a result and explains the choice. An analyzer then reads comparisons across cases and reports recurring differences. The body separates this process from assertion grading.

  • Description optimization: The file tells the agent to generate positive trigger queries and near-miss negative queries. The user reviews those queries before the optimization loop runs. The optimizer evaluates candidate descriptions repeatedly and returns a selected description plus train and validation results. The final step applies the description to frontmatter. The March 2026 history entry concerns the script used in this part of the package.

  • Referenced files and package contents: The checked directory contains 18 tracked files. They are LICENSE.txt, SKILL.md, three specialized agent files, one review asset, two viewer files, one schema reference, and nine Python files under scripts/. The specialized agents are agents/grader.md, agents/comparator.md, and agents/analyzer.md. references/schemas.md documents evaluation data structures.

  • Scripts and generated material: scripts/run_eval.py runs evaluations. aggregate_benchmark.py aggregates results. generate_report.py produces reports. improve_description.py runs description evaluation. quick_validate.py checks a skill directory. package_skill.py creates a package. run_loop.py coordinates repeated evaluation. utils.py and __init__.py support the scripts. The viewer directory contains generate_review.py and viewer.html; the assets directory contains eval_review.html.

  • Runtime and tool references: The body refers to Claude Code, Claude.ai, Cowork, subagents, a present_files tool, filesystem operations, Python scripts, and browser-based review. It includes separate instructions for Claude.ai and Cowork because those environments handle file presentation and evaluation differently.

  • File-presentation instructions: The Claude.ai section uses downloadable files and browser links for evaluation review. The Cowork section describes file handoff through a workspace and includes a note about reviewing output in the browser. The present_files section is conditional on that tool being available and names a package file plus an evaluation report as presentation outputs.

  • Distribution record: The repository README documents adding anthropics/skills as a Claude Code plugin marketplace. It provides commands for the document-skills and example-skills plugins. The same README says the example skills are available to paid Claude.ai plans and links to Claude API instructions for prebuilt and custom skills.

  • License and reuse terms: The directory includes LICENSE.txt containing the Apache License 2.0. The license grants rights to reproduce, prepare derivative works, publicly display, sublicense, and distribute the licensed work under its conditions. Distributed copies must include the license, mark modified files, retain applicable notices, and include a supplied NOTICE file when one applies. The license includes patent-license and contribution provisions.

  • Primary sources: SKILL.md, repository README, initial commit, February 2026 export, March 2026 optimizer change, schema reference, and license.

2. OpenAI skills/.system/skill-creator/SKILL.md

  • Exact file and repository: The file is openai/skills/skills/.system/skill-creator/SKILL.md. Its repository is openai/skills.

  • Owner and maintainer: OpenAI publishes the repository. The repository README now marks the catalog as deprecated and directs readers to openai/plugins and the Codex plugin authoring guide. The history below describes the file in the deprecated catalog.

  • Publication history: Commit 7c6f995f on December 18, 2025 added skill-creator. Commit 59c17ec added short descriptions to system skills on the same date. A December 19 commit changed the maximum skill-name length. January 2026 commits revised the file, removed zipped .skill packaging, and added agents/openai.yaml. Commit 4ab6e0f on February 9, 2026 removed stale references.

  • File length and frontmatter: The checked raw file contains 368 lines, 2,583 whitespace-delimited words, and 18,664 bytes. Its YAML contains name, description, and a metadata map with a short description. The name is skill-creator. The description assigns the file to creation and updates of skills for Codex.

  • Body sections: The body has sections titled About Skills, Core Principles, Skill Creation Process, and several embedded examples. Core Principles contains Concise is Key, Set Appropriate Degrees of Freedom, Anatomy of a Skill, and Progressive Disclosure Design Principle. Skill Creation Process contains naming plus six steps: understand the skill with examples, plan reusable contents, initialize, edit, validate, and iterate.

  • Stated purpose: The file defines skills as packages of instructions, scripts, references, and assets that give Codex repeatable workflows, tool integrations, domain knowledge, and reusable resources. It tells Codex to create or update such a package. It uses concrete user examples to identify inputs, outputs, actions, dependencies, and reusable material before file generation.

  • Instruction detail levels: The “degrees of freedom” section maps three kinds of instruction to task conditions. High freedom uses text directions when several approaches are valid. Medium freedom uses pseudocode or configurable scripts when a preferred pattern exists. Low freedom uses specific scripts or narrow steps when the operation is fragile and variation has a cost. The section illustrates these levels with examples.

  • Directory model: SKILL.md is required. The file describes YAML frontmatter and a Markdown body. It documents agents/openai.yaml as interface metadata. It assigns reusable executable code to scripts/, background and reference material to references/, and output resources such as templates, images, fonts, and starter code to assets/. It tells the author to omit extra package documentation files such as README.md, installation guides, quick references, and changelogs.

  • Progressive-disclosure details: The body states approximate context sizes for three levels: about 100 words for discovery metadata, fewer than 5,000 words for the body after activation, and task-specific bundled resources. It instructs authors to keep references one link away from SKILL.md. It asks for a table of contents in references longer than 100 lines. For references longer than 10,000 words, it asks the entry file to provide search patterns. The source places each item in either the body or a reference and warns against duplication across both.

  • Initialization workflow: The file directs Codex to use scripts/init_skill.py. The initializer accepts a skill name, destination path, optional resource directories, and interface values. It creates the directory, a SKILL.md template, optional resource folders, and agents/openai.yaml. The instructions then replace template material with the requested workflow.

  • Naming rules: The naming section permits lowercase letters, digits, and hyphens. It assigns a maximum length of 64 characters, asks for a verb-led phrase when one describes the task, and requires the directory name to match the skill name. It also lists generic names and reserved terms among naming cases to avoid.

  • Interface metadata workflow: references/openai_yaml.md defines fields used by the OpenAI interface. scripts/generate_openai_yaml.py generates the file from explicit --interface values. The body names display_name, short_description, and default_prompt. It says icon and brand-color fields are included only when supplied.

  • Validation workflow: The file directs the agent to run scripts/quick_validate.py on the finished directory. The final step repeats use of the skill on real tasks and edits the package based on observed results. The package does not contain the multi-agent comparator, grader, benchmark aggregation, or HTML review files present in Anthropic's current package.

  • Embedded examples: The body includes a PDF-processing example with quick-start and advanced-feature references. It also includes a DOCX example that separates creation and editing material. These examples demonstrate direct links from the entry file to focused references. Heading counts from the raw Markdown include headings inside these fenced examples, so the file's line count is a more stable size measure than a simple count of heading markers.

  • Referenced files and package contents: The checked directory contains seven files: LICENSE.txt, SKILL.md, agents/openai.yaml, references/openai_yaml.md, scripts/generate_openai_yaml.py, scripts/init_skill.py, and scripts/quick_validate.py. No assets/ directory is included in this system skill.

  • Runtime and dependencies: The instructions assume Codex, Python for bundled scripts, filesystem write access for package creation, and an interface that reads agents/openai.yaml. The body distinguishes agent-facing instructions from UI-facing metadata. It also says scripts can execute without loading their entire contents into the model context.

  • Distribution record: The repository README says .system skills were automatically installed in the latest Codex version during the catalog's active period. It documented installation of curated and experimental skills through skill-installer. The current deprecation notice replaces those catalog instructions with links to OpenAI's plugin repository and documentation.

  • License and reuse terms: LICENSE.txt contains the Apache License 2.0. Its grant, notice, modification, redistribution, patent, and contribution provisions apply to the files covered by that license. The repository's deprecated status affects distribution guidance, not the text of the license file.

  • Primary sources: SKILL.md, repository README and deprecation notice, initial file commit, latest checked file-specific commit, openai_yaml reference, initializer, validator, and license.

3. Anthropic skills/pdf/SKILL.md

  • Exact file and repository: The file is anthropics/skills/skills/pdf/SKILL.md. Its repository is anthropics/skills.

  • Owner and maintainer: Anthropic publishes the repository and the PDF directory. The repository README places PDF beside the DOCX, PPTX, and XLSX document packages. It says those four packages power document capabilities in Claude and are published as source-available reference implementations.

  • Publication history: A PDF package appears in the October 15, 2025 initial repository commit. October and December commits moved it as the document skills and example skills were reorganized. Commit 4e6907a3 on February 3, 2026 updated the PDF, DOCX, XLSX, and PPTX skills together.

  • File length and frontmatter: The checked raw file contains 314 lines, 1,007 whitespace-delimited words, and 8,072 bytes. Its frontmatter names the skill pdfs, describes PDF manipulation tasks, and identifies its license as proprietary with full terms in LICENSE.txt. The body title is PDF Processing Guide.

  • Body sections: The file contains Overview, Quick Start, Python Libraries, Command-Line Tools, Common Tasks, Quick Reference, and Next Steps. The Python section covers pypdf, pdfplumber, and ReportLab. The command-line section covers Poppler's pdftotext, qpdf, and optional pdftk. Common Tasks covers OCR, watermarks, image extraction, and password protection. Several heading markers appear inside code fences because the examples contain shell comments.

  • Stated purpose: The description covers reading text and tables, creating PDFs, combining and splitting files, rotating pages, adding watermarks, creating new documents, filling forms, adding passwords, extracting images, and applying OCR. The body begins with command examples for reading and extracting text, then groups additional operations by library or command.

  • Python workflows: The pypdf examples merge files, split pages, read metadata, rotate pages, and apply encryption. The pdfplumber examples extract text with layout and find tables page by page. A table-settings example supplies vertical and horizontal strategies plus tolerance values. ReportLab examples create a canvas, draw text and lines, save a file, and build multi-page documents with Platypus.

  • ReportLab character handling: The file has a subsection for subscripts and superscripts. It states that built-in ReportLab fonts can render some Unicode subscript and superscript characters as black boxes. Its examples use ReportLab's <sub> and <super> markup. This note appears in the source body next to the creation examples.

  • Command-line workflows: The Poppler examples use pdftotext for ordinary extraction, layout-preserving extraction, and page ranges. qpdf examples cover merge, page selection, rotation, and password removal. pdftk examples cover merge, page burst, and rotation when that program is available. The Quick Reference section maps tasks to libraries and commands.

  • Quick Reference table: The table maps text extraction to pdfplumber or pdftotext, table extraction to pdfplumber, page merging and splitting to pypdf or qpdf, PDF creation to ReportLab, command-line manipulation to qpdf, scanned-document OCR to ocrmypdf, and form work to the separate forms reference.

  • OCR and image workflows: The OCR example names pytesseract and pdf2image, converts pages to images, runs OCR on each page, and writes accumulated text. Image extraction uses Poppler's pdfimages. The watermark example creates or opens a watermark page and merges it onto every page in another document.

  • Referenced files and package contents: The checked directory contains 12 tracked files. Besides SKILL.md and LICENSE.txt, it includes forms.md, reference.md, and eight Python scripts. The body sends form work to forms.md and additional API material to reference.md.

  • Bundled scripts: The scripts are check_bounding_boxes.py, check_fillable_fields.py, convert_pdf_to_images.py, create_validation_image.py, extract_form_field_info.py, extract_form_structure.py, fill_fillable_fields.py, and fill_pdf_form_with_annotations.py. Their filenames cover page-boundary checks, form detection, rendering, validation imagery, field inspection, structure extraction, field filling, and annotation-based filling.

  • Dependencies named by the package: The body names pypdf, pdfplumber, ReportLab, Poppler utilities, qpdf, pdftk, pytesseract, and pdf2image. The scripts import their own Python dependencies. Native command availability depends on the host environment. The body supplies package names and example install commands for several tools.

  • Distribution record: The repository README says the PDF, DOCX, PPTX, and XLSX packages power Claude's document capabilities. It gives Claude Code commands for installing the document-skills plugin. It also states that published implementations can differ from behavior delivered in Claude.

  • License and reuse terms: skills/pdf/LICENSE.txt uses Anthropic's proprietary terms. The terms provide a copyright notice and grant specified rights connected to Anthropic products and services. They differ from the Apache 2.0 terms in the skill-creator directory. The repository README labels the document packages source-available and not open source. The Markdown, references, and bundled scripts fall under the directory's stated terms unless a file carries a different notice.

  • Primary sources: SKILL.md, repository README, initial repository commit, February 2026 document-package update, forms reference, API reference, and license.

4. obra skills/systematic-debugging/SKILL.md

  • Exact file and repository: The file is obra/superpowers/skills/systematic-debugging/SKILL.md. Its repository is obra/superpowers.

  • Owner and maintainer: The repository is published under Jesse Vincent's obra account and accepts contributions. The MIT license carries a 2025 Jesse Vincent copyright notice. The README describes Superpowers as a software-development methodology composed of skills and initial instructions.

  • Publication history: The current path appears in commit 9c9547c on October 16, 2025, whose message says skills returned to the primary plugin after Claude Code added first-class skill support. October commits standardized names and cross-references. December commits consolidated debugging techniques and changed descriptions. Commit 90e1721 on May 24, 2026 changed wording that interacted with a Claude Code keyword scanner. July 5 commits changed related-skill blocks and removed social-proof language, including c74782e.

  • File length and frontmatter: The checked raw file contains 283 lines, 1,430 whitespace-delimited words, and 9,465 bytes. Its YAML has a name and description. The name is systematic-debugging. The description assigns the file to bugs, test failures, and unexpected behavior before proposing fixes.

  • Body sections: The body contains Overview, The Iron Law, When to Use, The Four Phases, Red Flags, signals from the human partner, Common Rationalizations, Quick Reference, When Process Reveals “No Root Cause,” and Supporting Techniques. The four phase subsections are Root Cause Investigation, Pattern Analysis, Hypothesis and Testing, and Implementation.

  • Stated purpose: The file instructs an agent to find a root cause before changing code. It lists test failures, production bugs, unexpected behavior, performance problems, build failures, and integration problems as triggers. It also lists time pressure, previous unsuccessful fixes, and incomplete understanding as conditions under which the same process applies.

  • Phase 1 workflow: Root Cause Investigation starts with reading the complete error, stack trace, line numbers, error codes, and related logs. It asks the agent to reproduce the problem consistently, record exact steps, and note whether the result is intermittent. It then checks recent changes, diffs, dependencies, configuration, and environment differences.

  • Boundary evidence workflow: For systems with several components, the file asks for diagnostic information at each boundary. Its example records data entering and leaving each layer, configuration propagation, and state. The procedure identifies the first boundary where observed values differ from expected values. The phase also links to backward data-flow tracing.

  • Phase 2 workflow: Pattern Analysis asks for a working example in the same repository, a complete reading of reference implementations, a list of differences, and a list of dependencies and assumptions. The instructions state that small differences must remain on the list until tested.

  • Phase 3 workflow: Hypothesis and Testing asks for one statement that names the suspected cause and the evidence for it. The agent changes one variable and runs the smallest test that can disprove the hypothesis. A failed test returns the workflow to a new hypothesis. The file tells the agent to state when it does not understand a component and to gather information before continuing.

  • Phase 4 workflow: Implementation begins with a failing automated test when one can be created. The agent applies one change, runs the new test, and runs the surrounding test suite. If the fix fails, the process returns to investigation. After three or more unsuccessful fixes, the file calls for a discussion of architecture and coupling before another attempt.

  • Stop phrases and rationalizations: The Red Flags and Common Rationalizations sections list phrases associated with skipping evidence, stacking changes, bypassing tests, assuming a pattern, or postponing investigation. The file instructs the agent to stop and return to the process when those phrases occur. A separate section lists user messages that indicate the agent has moved away from the stated process.

  • No-root-cause section: The section titled When Process Reveals "No Root Cause" covers environmental, timing, and external causes. It assigns documentation of the completed investigation, monitoring, logging, and failure handling to cases where the available evidence does not identify one deterministic code defect.

  • Referenced files and package contents: The checked directory contains 11 files. Besides SKILL.md, it includes CREATION-LOG.md, condition-based-waiting.md, condition-based-waiting-example.ts, defense-in-depth.md, root-cause-tracing.md, find-polluter.sh, test-academic.md, and three pressure-test files. The body links supporting techniques from its final section.

  • Testing records: docs/testing.md describes project-level skill testing. The three pressure-test files in the directory present scenarios in which an agent receives reasons to skip parts of the workflow. The creation log records development notes for the skill. find-polluter.sh and test-academic.md support investigation of test pollution.

  • Distribution record: The repository README lists installation instructions for Claude Code, Antigravity, Codex App, Codex CLI, Cursor, Factory Droid, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi. It names official marketplace availability for Claude and Codex. RELEASE-NOTES.md records repository releases and compatibility changes.

  • License and reuse terms: The repository uses the MIT License. The license permits use, copying, modification, merger, publication, distribution, sublicensing, and sale. Copies or substantial portions must carry the copyright and permission notice. The license includes an “as is” warranty disclaimer.

  • Primary sources: SKILL.md, repository README, current-path commit, May 2026 wording change, July 2026 change, creation log, testing documentation, release notes, and license.

5. Vercel skills/react-best-practices/SKILL.md

  • Exact file and repository: The file is vercel-labs/agent-skills/skills/react-best-practices/SKILL.md. Its repository is vercel-labs/agent-skills.

  • Owner and maintainer: Vercel Labs publishes the repository. The file's frontmatter identifies Vercel Engineering as the author. The package's metadata.json also names Vercel Engineering as the organization and dates the package to January 2026.

  • Publication history: Commit d4ce761 on January 13, 2026 added react-best-practices. January 14 commits updated the imported package, added build scripts and evaluations, and named Vercel. January 15 commits added author and version metadata and synchronized package versioning with validation. Later commits added or changed individual rules. The latest checked path-specific commit is 2bf1e08 on May 29, 2026, with the message “add new rule.”

  • File length and frontmatter: The checked raw SKILL.md contains 149 lines, 948 whitespace-delimited words, and 7,251 bytes. Frontmatter fields include name, description, license, and metadata for author and version. The license field says MIT. The metadata version is 1.0.0.

  • Body sections: The body contains When to Apply, Rule Categories by Priority, Quick Reference, How to Use, and Full Compiled Document. Quick Reference has eight numbered categories: Eliminating Waterfalls, Bundle Size Optimization, Server-Side Performance, Client-Side Data Fetching, Re-render Optimization, Rendering Performance, JavaScript Performance, and Advanced Patterns.

  • Stated purpose: The description assigns the package to performance guidance for React and Next.js. It lists writing, reviewing, and refactoring components or pages; data fetching; bundle size; and performance work. The body directs the agent to read individual rule files for details and refers to a compiled document.

  • Rule index: The checked index lists 70 rule identifiers. Each identifier corresponds to one Markdown file under rules/. Six rules cover async waterfalls. Six cover bundle size. Eleven cover server performance. Four cover client data fetching. Seventeen cover rerender behavior. Ten cover rendering. Twelve cover JavaScript operations. Four cover advanced patterns.

  • Priority labels: The source labels async waterfalls and bundle size CRITICAL; server performance HIGH; client data fetching MEDIUM-HIGH; rerendering and rendering MEDIUM; JavaScript LOW-MEDIUM; and advanced patterns LOW. These labels are part of the source file's category headings.

  • Async and bundle entries: Async identifiers include async-cheap-condition-before-await, async-defer-await, async-parallel, async-dependencies, async-api-routes, and async-suspense-boundaries. Bundle identifiers include bundle-barrel-imports, bundle-analyzable-paths, bundle-dynamic-imports, bundle-defer-third-party, bundle-conditional, and bundle-preload.

  • Server and client entries: Server identifiers cover authentication for server actions, React cache, LRU cache, serialized props, static input/output, shared module state, parallel fetching, nested fetching, and post-response work. Client identifiers cover SWR request deduplication, global event listeners, passive listeners, and versioned local-storage data.

  • Rerender and rendering entries: Rerender identifiers cover deferred reads, memoized components, default object values, dependencies, derived state, functional updates, lazy initialization, effect placement, transitions, deferred values, refs, and inline components. Rendering identifiers cover SVG wrappers, content-visibility, static JSX, SVG precision, hydration, React Activity, conditional output, useTransition, resource hints, and script loading.

  • JavaScript and advanced entries: JavaScript identifiers cover DOM style batching, maps and sets, cached lookups and function results, storage reads, combined iterations, length checks, early exits, regular expressions, min/max loops, immutable sorting, flatMap, and idle callbacks. Advanced identifiers cover effect-event dependencies, handler refs, one-time initialization, and a useLatest pattern.

  • Individual rule format: rules/_template.md provides fields for a title, impact, explanation, incorrect example, correct example, and references. The source rule files use stable filenames matching identifiers from the index. The body says each rule contains an explanation, examples, and context.

  • Package metadata: metadata.json records version 1.0.0, organization Vercel Engineering, and date January 2026. It contains an abstract and a reference list with React, Next.js, SWR, better-all, node-lru-cache, and two Vercel engineering articles. This metadata file is separate from the YAML in SKILL.md.

  • Referenced files and package contents: The checked directory contains 76 files. They are SKILL.md, AGENTS.md, README.md, metadata.json, _sections.md, _template.md, and 70 rule files. AGENTS.md is the compiled form referenced by the body.

  • Build and synchronization records: The January 2026 history includes changes described as copying build scripts and evaluations, adding versioning, and synchronizing version values with build and validation scripts. Those build files are outside the checked skill directory in the repository structure. The package keeps atomic rule sources and a compiled AGENTS.md.

  • Distribution record: The repository README lists the package in its skills collection and identifies the collection as following the Agent Skills format. It exposes a skills.sh installation badge and instructions for installing skills from the repository.

  • License and reuse terms: The file's YAML declares MIT. The checked repository tree does not contain a standalone LICENSE file at the root or inside skills/react-best-practices. The frontmatter declaration is therefore the package's license statement in this revision. External references and linked third-party code retain their own terms.

  • Primary sources: SKILL.md, repository README, initial package commit, latest checked index commit, rule template, compiled document, and metadata.

6. Trail of Bits entry-point-analyzer/SKILL.md

  • Exact file and repository: The file is trailofbits/skills/plugins/entry-point-analyzer/skills/entry-point-analyzer/SKILL.md. Its repository is trailofbits/skills.

  • Owner and maintainer: Trail of Bits publishes and maintains the repository. Its README calls the project the Trail of Bits Skills Marketplace and describes it as a collection for security analysis, testing, and development workflows.

  • Publication history: The file entered the repository in commit 695119c on January 14, 2026, the initial release of the marketplace. Commit aa9dd93 on January 23, 2026 changed Move references. Commit debfb29 on April 28, 2026 changed allowed-tools to a space-delimited string matching the Agent Skills specification.

  • File length and frontmatter: The checked raw file contains 247 lines, 1,259 whitespace-delimited words, and 9,593 bytes. Its frontmatter contains a name, description, and allowed-tools. The name is entry-point-analyzer. The description names supported smart-contract languages and the state-changing entry-point task.

  • Body sections: Sections include When to Use, When NOT to Use, Scope, Workflow, Slither Integration, Language Detection, Access Classification, Output Format, Filtering, Analysis Guidelines, Common Role Patterns by Protocol Type, Rationalizations to Reject, and Error Handling.

  • Stated purpose: The file directs an agent to enumerate externally callable functions that can change state in a smart-contract codebase. It assigns the task to the start of a security review, access-control mapping, privileged-operation inventory, and audit-flow discovery. It excludes vulnerability detection, exploit proof-of-concept writing, gas analysis, ordinary code, and read-only functions.

  • Supported languages: The file covers Solidity, Vyper, Solana Rust, Move for Aptos, Move for Sui, TON, and CosmWasm. Its language-detection table maps file extensions and syntax to references. Solidity and Vyper use .sol and .vy; Rust-based Solana and CosmWasm projects use .rs plus framework clues; Move uses .move; TON uses its own language and file patterns.

  • Workflow: The six steps detect languages, use available tools, locate contract files, extract entry points, classify access, and generate a report. A user-supplied directory filter narrows file discovery. The body instructs the agent to state the filter in the report.

  • Slither workflow: For Solidity, the file first checks for Slither. It gives a command to run the entry-points printer. The output fields named in the body include contract, function, visibility, and modifiers. The agent uses the output as an initial inventory and cross-checks access control against source. When Slither is absent or compilation fails, the workflow switches to the Solidity reference and manual analysis.

  • Access classes: The source defines Public (Unrestricted), Role-Restricted, and Contract-Only categories. Role examples include admin, owner, governance, guardian, operator, manager, minter, pauser, keeper, relayer, lender, and borrower. It names onlyRole, hasRole, explicit sender comparisons, and language-specific ownership assertions as patterns. Ambiguous restrictions receive the source label Restricted (review required). Contract-only examples include token-receiver callbacks, swap callbacks, flash-loan callbacks, and cross-contract hooks.

  • Output fields: The report template includes project name, date, scope, languages, summary counts, tables for each access category, ambiguous restrictions, contract-only points, warnings, and a list of files analyzed. Function rows contain function name, file and line, visibility, access control, and notes. The file-list section records a state-changing entry-point count per file.

  • Analysis instructions: The body says to inspect every in-scope contract file, exclude read-only methods, record inherited access controls, list modifiers and decorators, and note callbacks, initialization functions, emergency controls, upgrade functions, and value-transfer operations. Its error section says parse failures and unsupported syntax must remain visible in the report.

  • Protocol-role table: The source includes role examples by protocol type. DeFi examples include governance, guardian, keeper, and fee roles. Token examples include minter, burner, pauser, and blacklister. Bridge examples include relayer, validator, and guardian. NFT examples include minter, royalty, and marketplace roles.

  • Referenced files and package contents: The checked skill directory contains 10 files: SKILL.md, agents/openai.yaml, assets/trail-of-bits-mark.svg, and seven language references. The references are solidity.md, vyper.md, solana.md, move-aptos.md, move-sui.md, ton.md, and cosmwasm.md.

  • Tools and permissions declared: The frontmatter lists tools in a space-delimited allowed-tools string. The package refers to file search, file reads, shell commands, and Slither. The April 2026 commit changed serialization of this field. agents/openai.yaml supplies client-specific metadata outside the base SKILL.md.

  • Distribution record: The marketplace README documents Claude Code installation with /plugin marketplace add trailofbits/skills. It also documents Codex marketplace installation and says Codex can load the Claude marketplace format. The README lists entry-point-analyzer among the repository's security plugins.

  • License and reuse terms: The repository uses Creative Commons Attribution-ShareAlike 4.0. The license requires attribution and identifies conditions for sharing adaptations. Distributed adaptations must use the same license or a compatible license permitted by CC BY-SA 4.0. The license text also describes indication of modifications and links to the license.

  • Primary sources: SKILL.md, repository README, initial marketplace commit, Move-reference change, allowed-tools change, Solidity reference, and license.

7. MicrosoftDocs skills/azure-functions/SKILL.md

  • Exact file and repository: The file is MicrosoftDocs/Agent-Skills/skills/azure-functions/SKILL.md. Its repository is MicrosoftDocs/Agent-Skills.

  • Owner and maintainer: Microsoft publishes the repository under its MicrosoftDocs GitHub organization. The repository describes the collection as Azure Agent Skills created from Microsoft Learn documentation. The file's frontmatter records a generator rather than an individual author.

  • Publication history: The first checked commit for this path is b2129c5 on January 27, 2026. The checked path history contains 49 commits through July 27, 2026. Most commit messages record scheduled documentation generation. The latest checked entry is 118821d on July 27, 2026, whose message records a July 26 generation from an Azure DevOps source branch to GitHub main.

  • File length and frontmatter: The checked raw file contains 310 lines, 3,345 whitespace-delimited words, and 40,320 bytes. Frontmatter fields include the skill name, description, and a metadata map. Metadata identifies docs2skills/1.0.0 and a generation timestamp. The name is azure-functions.

  • Body sections: The body contains How to Use This Skill and Category Index. The category index routes to Troubleshooting, Best Practices, Decision Making, Architecture and Design Patterns, Limits and Quotas, Security, Configuration, Integrations and Coding Patterns, and Deployment. Each category contains a table of Microsoft Learn page titles and URLs.

  • Stated purpose: The description assigns the skill to Azure Functions. It includes triggers, bindings, hosting plans, scaling, deployment, networking, security, configuration, monitoring, runtime versions, and troubleshooting. It excludes requests primarily about App Service, Logic Apps, Container Apps, and AKS.

  • Retrieval workflow: The body instructs the agent to choose a page from the category table and retrieve its current contents. It names mcp_microsoftdocs:microsoft_docs_fetch as the preferred tool and asks for Markdown with a from=learn-agent-skill query parameter. It names fetch_webpage as a fallback and uses a Markdown accept parameter. When the Microsoft documentation tool is absent, the file links to the Microsoft Docs MCP installation guide.

  • Freshness field: The body tells the agent to compare the metadata generation date with the current date. When the generated file is more than three months old, it directs the agent to display an update notice for the repository version. This instruction applies to the local index. The workflow still retrieves the selected Microsoft Learn page at task time.

  • Category index facts: Troubleshooting includes pages for runtime failures, storage, trigger synchronization, diagnostics, Java and Python diagnostics, networking, portal editing, and Durable Functions. Best Practices includes performance, reliability, security, storage, connection management, event-driven scaling, Java, and Python pages. Decision Making includes hosting plans, runtime versions, programming models, migration paths, cost comparisons, and comparisons with AWS Lambda.

  • Architecture and limits facts: Architecture and Design Patterns includes event-driven and serverless architecture pages plus Durable Functions patterns. Limits and Quotas includes hosting limits, Flex Consumption limits, scaling behavior, concurrency, and language support. Security includes identity, networking, access restrictions, key management, authentication, and securing storage connections.

  • Configuration facts: Configuration covers application settings, host configuration, local settings, runtime versions, deployment slots, networking, custom handlers, language versions, Python settings, Java settings, Node.js settings, PowerShell settings, and monitoring configuration. Integrations and Coding Patterns covers triggers and bindings for HTTP, timers, queues, blobs, Event Hubs, Service Bus, Cosmos DB, Kafka, SignalR, Event Grid, Dapr, SQL, RabbitMQ, SendGrid, and Twilio.

  • Deployment facts: Deployment links cover package deployment, run-from-package, build options, deployment technologies, GitHub Actions, Azure Pipelines, containers, Kubernetes, Azure Arc, zip deployment, and troubleshooting. Titles and destinations come from Microsoft Learn.

  • URL count: The checked file contains 241 web-address occurrences and 237 unique web-address strings. Four repeated destinations account for the difference. These counts describe the July 30, 2026 file snapshot and can change after a generator run.

  • Referenced files and package contents: The skills/azure-functions directory contains one tracked file, SKILL.md. Its references are remote Microsoft Learn pages rather than sibling Markdown files. The repository contains other Azure skill directories and plugin manifests outside this directory.

  • Generator and repository workflow: The frontmatter names docs2skills/1.0.0. Commit messages record the source and target used for generated updates. The repository README describes Microsoft Learn material as the source corpus and says the project precompiles documentation into skill indexes. The Git history shows recurring generated updates during 2026.

  • Distribution record: The repository README documents plugin installation for VS Code, Claude Code, and Codex, plus manual installation paths for several clients. It says the repository ships native plugin manifests and a collection of more than 193 Azure skills at the checked README revision. The README names GitHub Copilot, Cursor, Gemini CLI, OpenCode, Antigravity, and AdaL CLI among supported clients.

  • License and reuse terms: The repository's license file assigns CC BY 4.0 to documentation and MIT to code. CC BY 4.0 allows sharing and adaptation with attribution, a license link, and an indication of changes. MIT permits use and distribution of code with preservation of its notice. Microsoft Learn pages linked by the generated file have their own page notices and repository records.

  • Primary sources: SKILL.md, repository README, first checked path commit, July 2026 generation commit, Microsoft Docs MCP installation guide, and repository license.

8. NVIDIA skills/skill-card-generator/SKILL.md

  • Exact file and repository: The file is nvidia/skills/skills/skill-card-generator/SKILL.md. Its repository is nvidia/skills.

  • Owner and maintainer: NVIDIA publishes the catalog. The generated card included with this package identifies NVIDIA as the owner. The repository README says skills are maintained in product repositories and mirrored into the catalog by an automated synchronization pipeline.

  • Publication history: The first checked catalog commit for the path is 1287d43 on May 28, 2026, a catalog synchronization commit that names Skill Card Generator. Commit 2a23a90 on June 30, 2026 synchronized it again. The generated self-card lists source version 7cc9bf6 and gives June 30, 2026 as its commit date.

  • File length and frontmatter: The checked raw SKILL.md contains 131 lines, 852 whitespace-delimited words, and 6,429 bytes. Its frontmatter contains name, description, license, compatibility text, metadata, and a permissions map. The name is skill-card-generator. The license field says CC-BY-4.0 AND Apache-2.0.

  • Permission declaration: The frontmatter's permission map lists read, write, and shell scopes. It limits reads to a target skill directory and this package's references and scripts. It limits writes to the target skill directory and /tmp. It limits shell execution to discover_assets.py, render_card.py, and validate_submission.py. The body repeats these path constraints and excludes .env, credential files, hidden authentication directories, and unrelated repository files.

  • Body sections: The body contains Purpose, Prerequisites, Instructions, Available Scripts, Examples, Limitations, Troubleshooting, and Files in this skill. The instructions are a ten-step ordered list. The scripts section is a three-row table. The troubleshooting section is a problem, cause, and action table.

  • Stated purpose: The description assigns the file only to generating or updating a governance card for an existing skill directory. The body includes new cards, refreshes after source changes, and preparation for legal, safety, or owner review. It excludes general skill explanation, skill comparison, creation of the source skill, cards for models or datasets, signing, publication, approval, and replacement of human legal or safety review.

  • Prerequisites: The body requires Python 3, Jinja2, a target directory containing SKILL.md or skill.md, write access for temporary context JSON and the rendered card, and the declared file and command permissions. The target path comes from $ARGUMENTS or the current directory.

  • Discovery workflow: The agent reads SKILL.md, resolves the target, and runs scripts/discover_assets.py. The body tells the agent to begin with the script's structured signal summary. When output is truncated, it reads selected files or excerpts instead of loading the entire target.

  • Context-data workflow: The agent builds a JSON context from the discovery result and targeted file contents. Credential data has two fields: whether a key or credential is required and the credential type. The instructions say to derive these fields from source-skill prose, use the controlled vocabulary in the style guide, and omit credential values, assignments, and raw environment-variable names. Unsupported fields receive the marker HUMAN-REQUIRED.

  • Rendering workflow: scripts/render_card.py accepts a context JSON path, a Jinja template, and an output path. It validates the context and renders the card. The agent then reviews VERIFY and SELECT markers, resolves supported items, and runs scripts/validate_submission.py. The final check searches for unresolved Jinja expressions or statements.

  • Troubleshooting table: The table covers missing target SKILL.md, absent Jinja2, truncated discovery output, schema-validation errors, unresolved markers, and unrendered template syntax. Each row names an observed problem, a source condition, and the corresponding workflow action. The validation script rejects cards that retain VERIFY or SELECT.

  • Stated output constraints: The body's Limitations section says the output remains a draft for human review. It says discovery is limited to local files and visible repository metadata. It says schema validation checks the shape of fields rather than the truth of legal or safety claims. It also says catalog entries for risks and limitations are starting points from which irrelevant items must be removed. These statements are part of the published file.

  • Referenced files and package contents: The checked directory contains 14 tracked entries. They include SKILL.md, BENCHMARK.md, a generated self-card, a signature file, evaluation data, a Jinja template, a style guide, JSON risk and limitation catalogs, three scripts, and two files whose names identify card and license material.

  • Template and reference files: references/style-guide.md defines fields and vocabulary. references/skill-card.md.j2 defines the rendered Markdown layout. references/catalog/limitations.json and references/catalog/risks.json contain candidate statements. The body lists these files under “Files in this skill.”

  • Self-card record: skill-card.md identifies NVIDIA as owner, lists the dual license, describes the output as Markdown files and analysis, says no API key is required, names the style guide and template, and reports the evaluation agents. It also identifies source version 7cc9bf6.

  • Benchmark setup: BENCHMARK.md gives June 30, 2026 as the evaluation date. It names the external NVSkills-Eval profile, the astra-sandbox environment, 11 tasks, one attempt per task, and a 50% pass threshold. The task set contains eight positive activation cases and three negative cases. The evaluated agents are claude-code and codex.

  • Published benchmark dimensions: The report lists Security, Correctness, Discoverability, Effectiveness, and Efficiency. For Claude Code, the published skill-assisted scores are 91%, 86%, 77%, 83%, and 69%. For Codex, they are 55%, 85%, 83%, 88%, and 76%. The report prints baseline changes in parentheses for each dimension when available. It states that each task had one attempt.

  • Static findings in the report: Tier 1 passed with two low-severity findings. Both concern unexpected files at the skill root: Skill Card Generator Card and Skill Card Generator License. Tier 2 did not run or produced no findings according to the report. The report records an overall PASS verdict.

  • Distribution record: The NVIDIA repository README identifies the repository as an official catalog and documents installation through the skills CLI. It gives separate examples for Claude Code and Codex. The README says the catalog mirrors skills from product repositories and documents update and listing commands.

  • License and reuse terms: The package declares CC BY 4.0 and Apache 2.0. The package includes license material in its directory, and the repository uses these licenses for documentation and code. CC BY 4.0 requires attribution, a license link, and an indication of modifications for shared or adapted material. Apache 2.0 includes copyright, notice, modification, redistribution, contribution, and patent provisions. A generated card can cite a target skill governed by separate terms.

  • Primary sources: SKILL.md, repository README, first checked catalog commit, June 2026 synchronization commit, benchmark report, generated self-card, style guide, template, discovery script, renderer, and submission validator.