Agent Skill Creator

Generate production-ready Agent Skills from a single description -- security-scanned, standards-compliant, multi-platform.

The Problem

• Agent Skills are written manually -- inconsistent structure, missing metadata, no validation
• No security scanning -- prompt injection, credential exposure, and memory poisoning go undetected
• No portability -- skills built for one platform don't work on another
• No supply chain transparency -- no inventory of what a skill contains or what it can access
• No open standard -- every platform invents its own format

The Solution

Agent Skill Creator solves this with an 8-phase generation pipeline that takes a description and produces a complete, validated, security-scanned skill package:

• Standards-compliant -- follows the agentskills.io open standard
• Security-first -- 3-layer scanner mapped to OWASP ASI01-10
• Transparent -- every package includes a CycloneDX AI Bill of Materials
• Multi-platform -- packages for Claude Code, OpenClaw, Codex, Copilot, or publish to ClawHub

Quick Start

git clone https://github.com/rotorstar/agent-skill-creator-ts.git
cd agent-skill-creator-ts
pnpm install && pnpm build

# Generate your first skill
pnpm --filter @skill-creator/cli dev generate my-skill \
  -d "Monitor API health endpoints and report uptime" \
  -t reactive

How It Works

graph LR
  A["Description"] --> B["1 Discovery"]
  B --> C["2 Design"]
  C --> D["3 Architecture"]
  D --> E["4 Activation"]
  E --> F["5 Implementation"]
  F --> G["6 Security Scan"]
  G --> H["7 Testing"]
  H --> I["8 Packaging"]
  I --> J["Skill + AI-BOM"]

Loading

#	Phase	What It Does
1	Discovery	Analyzes intent, detects relevant APIs, npm packages, and tools
2	Design	Determines capabilities, autonomy mode, template type, use cases
3	Architecture	Plans directory structure following agentskills.io spec
4	Activation	Normalizes name, engineers description, generates YAML frontmatter
5	Implementation	Generates SKILL.md body, scripts, references, optional HEARTBEAT.md
6	Security	Runs 3-layer security scan (Static + Behavioral + LLM)
7	Testing	Validates structure and spec compliance
8	Packaging	Writes files, generates AI-BOM, creates distributable

Programmatic Usage

import { runPipeline } from '@skill-creator/core/generator'
import { SkillConfigSchema } from '@skill-creator/core/schemas'

const config = SkillConfigSchema.parse({
  name: 'my-skill',
  userDescription: 'Monitor API health endpoints and report uptime statistics',
  templateType: 'reactive',
  outputPath: './output',
  platforms: ['claude-code'],
  autonomyMode: 'reactive',
})

const result = await runPipeline(config, (progress) => {
  console.log(`Phase ${progress.phaseNumber}/8: ${progress.message} (${progress.percentage}%)`)
})

Feature Matrix

Template	Scripts	References	Heartbeat	Cron	Checkpoints	MCP Schemas
reactive	x	x	-	-	-	-
autonomous	x	x	x	x	-	-
workflow	x	x	-	-	x	-
suite	x	x	-	-	-	-
mcp-integration	-	x	-	-	-	x
knowledge	-	x	-	-	-	-

Ecosystem

graph TB
  SPEC["agentskills.io\nOpen Standard"] --> CREATOR["Agent Skill Creator\nGenerate + Scan + Package"]
  CREATOR --> SKILL["Skill Package\n+ AI-BOM"]
  SKILL --> CLAWHUB["ClawHub\nSkill Registry"]
  SKILL --> CC["Claude Code"]
  SKILL --> OC["OpenClaw"]
  SKILL --> CODEX["Codex"]
  SKILL --> COPILOT["Copilot"]
  CLAWHUB --> CC
  CLAWHUB --> OC

Loading

Component	Role	Link
agentskills.io	Open standard for skill format and structure	Spec
Agent Skill Creator	Generate, validate, scan, and package skills	This repo
ClawHub	Skill registry for discovery and distribution	Registry
OpenClaw	Autonomous agent platform with proactive skills	Platform

Security Scanner

graph TD
  A["Skill Files"] --> B["Layer 1\nStatic Analysis"]
  A --> C["Layer 2\nBehavioral Analysis"]
  A --> D["Layer 3\nLLM Inspection"]
  B --> E["OWASP ASI\nMapping"]
  C --> E
  D --> E
  E --> F{"Risk Score\n0-100"}
  F -->|"0-30"| G["Pass"]
  F -->|"31-100"| H["Fail"]

Loading

Layer 1: Static Analysis -- Pattern-based scanning with 30+ detection rules for prompt injection, dangerous shell commands, credential exposure, code execution vectors, and memory poisoning.

Layer 2: Behavioral Analysis -- Dataflow tracing across skill files. Analyzes permission patterns, tool usage chains, inter-agent communication, and cascading failure paths.

Layer 3: LLM Inspection -- Uses Claude to detect deceptive instructions that bypass regex patterns. Covers social engineering, trust exploitation, and rogue agent behavior. Requires API key; disabled by default.

OWASP ASI01-10 Coverage

ID	Threat	Detection Layers
ASI01	Prompt Injection / Goal Hijacking	Static + LLM
ASI02	Tool Misuse	Static + Behavioral
ASI03	Identity & Privilege Abuse	Static
ASI04	Supply Chain Risks	Static
ASI05	Unexpected Code Execution	Static + Behavioral
ASI06	Memory Poisoning	Static + Behavioral
ASI07	Insecure Inter-Agent Communication	Behavioral
ASI08	Cascading Failures	Behavioral
ASI09	Human-Agent Trust Exploitation	LLM
ASI10	Rogue Agents	Behavioral + LLM

Risk Scoring

Score	Level	Passes Validation
0	Safe	Yes
1-10	Low	Yes
11-30	Medium	Yes
31-60	High	No
61-100	Critical	No

Detailed Documentation

Architecture

Monorepo Structure

agent-skill-creator-ts/
  packages/
    core/       @skill-creator/core    Engine: schemas, generator, validator, security, packager
    cli/        @skill-creator/cli     CLI interface (citty + @clack/prompts)
    web/        @skill-creator/web     Next.js 16 dashboard with SSE streaming
  scripts/                             Development utility scripts
  references/                          Spec, patterns, threat model

Package Dependencies

@skill-creator/cli  -->  @skill-creator/core
@skill-creator/web  -->  @skill-creator/core

Tech Stack

Area	Technology	Version
Language	TypeScript (strict)	5.9+
Monorepo	Turborepo + pnpm	2.8+ / 10+
Runtime	Node.js	20+
CLI	citty + @clack/prompts	0.2+ / 1.0+
Web	Next.js + React	16+ / 19+
Styling	Tailwind CSS	4+
Validation	Zod	3.24+
Markdown	remark + unified	15+ / 11+

CLI Commands

Command	Description	Key Flags
init <name>	Create a skill interactively	-d description, -t template, -o output, --no-interactive
generate <name>	Full pipeline: generate + scan + package	-d, -t, -o, --platform, --no-interactive
validate <path>	Validate against agentskills.io spec	--strict, --json
scan <path>	Run 3-layer security scan	--min-severity, --json, --with-bom
package <path>	Package for distribution	-o output, --platform, --no-scan, --no-bom, --json

Template Types

Template	Use Case	Key Feature
reactive	On-demand, user-triggered	Scripts + error handling
autonomous	Proactive with heartbeat/cron	HEARTBEAT.md + scheduling
workflow	Multi-step with checkpoints	Prepare-Propose-Build-Review-Deliver
suite	Multiple related sub-skills	Shared references, orchestration
mcp-integration	MCP server tool schemas	Tool schemas + parameter tables
knowledge	Pure documentation	Markdown only, no scripts

Target Platforms

Platform	Output	Install Location
claude-code	Skill directory	~/.claude/skills/
openclaw	Skill + HEARTBEAT.md	~/.claude/skills/
codex	.skill package	Codex CLI
copilot	.skill package	VS Code
generic	.skill zip	Portable / ClawHub

Web Dashboard

The @skill-creator/web package provides a Next.js 16 dashboard:

• Skill Wizard -- Step-by-step form with SSE streaming progress through all 8 phases
• Security Dashboard -- OWASP ASI01-10 coverage grid, 3-layer scanner overview
• Skill Browser -- Browse and manage generated skills

Routes

Route	Page
/	Dashboard with quick actions and pipeline overview
/skills	Browse generated skills
/skills/new	Create skill wizard with live pipeline progress
/security	OWASP ASI coverage and scanner documentation

API Endpoints

Endpoint	Method	Description
/api/generate/stream	POST	SSE stream of pipeline progress + result
/api/validate	POST	Validate a skill path
/api/scan	POST	Run security scan with AI-BOM

AI Bill of Materials

Every packaged skill includes a CycloneDX-compatible AI-BOM (ai-bom.json) containing:

• Components -- Inventory of SKILL.md, scripts, references with SHA-256 hashes
• Vulnerabilities -- Security findings mapped from the scan report
• Properties -- Skill format, scan layers used, risk level

import { generateAiBom } from '@skill-creator/core/security'

const bom = generateAiBom('./my-skill', securityReport)
// bom.components, bom.vulnerabilities, bom.properties

Schemas

All types are derived from Zod schemas (Single Source of Truth):

Schema	Export Path	Purpose
SkillFrontmatterSchema	@skill-creator/core/schemas	agentskills.io YAML frontmatter
SkillConfigSchema	@skill-creator/core/schemas	Generation pipeline configuration
SecurityReportSchema	@skill-creator/core/schemas	Security scan results
AiBomSchema	@skill-creator/core/schemas	CycloneDX AI-BOM document
TemplateTypeSchema	@skill-creator/core/schemas	Template type enum

import { SkillConfigSchema } from '@skill-creator/core/schemas'
import type { SkillConfig } from '@skill-creator/core/schemas'

// Type is always derived from schema
type SkillConfig = z.infer<typeof SkillConfigSchema>

agentskills.io Spec

Skills follow the agentskills.io open standard:

my-skill/
  SKILL.md          Required: YAML frontmatter + markdown instructions
  HEARTBEAT.md      Optional: Autonomous scheduling (cron)
  scripts/          Optional: Executable code
  references/       Optional: Extended knowledge documents
  assets/           Optional: Static files

Progressive Disclosure

Level	Content	Budget
Metadata	YAML frontmatter	~100 tokens
Body	SKILL.md content	<500 lines, <5000 tokens
Deep	scripts/ + references/	Loaded on demand

Development

pnpm install          # Install dependencies
pnpm build            # Build all packages (Turborepo)
pnpm typecheck        # Type check all packages
pnpm test             # Run tests (Vitest)
pnpm clean            # Clean build artifacts

# Web dashboard
pnpm --filter @skill-creator/web dev

# CLI commands
pnpm --filter @skill-creator/cli dev <command>

Script	Description
pnpm init-skill	Initialize a new skill
pnpm validate-skill	Validate a skill
pnpm security-scan	Run security scan
pnpm package-skill	Package a skill

Contributing

See CONTRIBUTING.md for development setup, coding standards, and how to add new security rules or templates.

Security

For vulnerability reporting and scanner scope details, see SECURITY.md.

License

MIT