create-skill
Single entry for authoring, auditing, and optimizing Codex skills under .codex/skills/NAME. Three lanes: Create scaffolds a folder and SKILL.md template; Audit runs deterministic checks over frontmatter, naming, body size, description quality, and reference integrity; Optimize fixes audit findings such as description rewrites, body to references split, frontmatter repair, and name normalization. Use when the operator says create a skill, scaffold a skill, add SKILL.md, audit a skill, check skills, validate skill conformance, optimize a skill, fix a skill description, shrink a skill, or why is this skill not activating.
What this skill does
# create-skill — author, audit, optimize
> **Self-validate after edits.** Any change to this skill's files (SKILL.md, scripts/, references/, templates/, assets/) must be followed by `./scripts/validate.sh` from the skill directory. Hard findings → create-skill Optimize lane.
Router skill. Body holds only what's needed at every activation: lane selection, universal invariants, and pointers. Lane procedure loads on demand from `references/`.
## Entry — pick a lane
First action is `AskUserQuestion`:
| Lane | When to choose | Procedure |
|---|---|---|
| **Create** | New skill — scaffold folder + opinionated template | [references/create.md](references/create.md) |
| **Audit** | Inspect existing skill(s) — deterministic checks | [references/audit.md](references/audit.md) |
| **Optimize** | Hard finding from audit OR activation failure OR oversized body | [references/optimize.md](references/optimize.md) |
Skip the question when the typed prompt names a lane unambiguously:
| Phrase pattern | Lane |
|---|---|
| "create / scaffold / add a skill for X" | Create |
| "audit / check / validate skill(s)" | Audit |
| "optimize / shrink / fix / repair / why isn't X activating" | Optimize |
| anything ambiguous ("work on a skill", "review skills") | **Ask.** |
## Spec at a glance
| Field | Required | Constraint |
|---|---|---|
| `name` | yes | kebab-case `^[a-z][a-z0-9]*(-[a-z0-9]+)*$`, equals directory name |
| `description` | yes | ≤ 1024 chars (spec); local style permits longer for activation precision |
| `allowed-tools` | no | space-separated string or list; minimize |
Full spec + name validation rules + progressive-disclosure budgets: [references/spec.md](references/spec.md).
Description authoring guide + trigger brainstorming: [references/description.md](references/description.md).
Per-check rationale + finding→fix mapping: [references/checklist.md](references/checklist.md).
## Audit at a glance
```bash
python3 .codex/skills/create-skill/scripts/audit.py --all # repo sweep
python3 .codex/skills/create-skill/scripts/audit.py <skill> --strict # cross-runtime gate
python3 .codex/skills/create-skill/scripts/audit.py <skill> --json # machine-readable
```
Exit 0 = clean or soft-only. Exit 1 = hard findings → switch to Optimize lane.
## Hard rules (universal — apply to every lane)
1. **Audit before edit.** Never modify a SKILL.md without running `scripts/audit.py` first. Audit output IS the input to Optimize lane.
2. **Name == directory.** Renaming is coordinated: dir + frontmatter + every cross-reference in one commit.
3. **Body is a router, not a content dump.** Bulk → `references/`. ≤ 5000 tokens (soft warn), ≤ 15000 (hard fail). This skill is the canonical demonstration.
4. **Trigger words are operator words.** Descriptions activate on the vocabulary operators actually type, not internal jargon. See [references/description.md](references/description.md).
5. **`scripts/` is deterministic.** No model-in-the-loop. If the operation needs judgment, it belongs in the body or a reference, not a script.
6. **No skills outside `.codex/skills/`.** AGENTS.md § Surface Ownership names this directory as the canonical home for executable governance.
## Cross-references
- [references/create.md](references/create.md) — Create lane (Preflight / Do / Closeout)
- [references/audit.md](references/audit.md) — Audit lane (commands, output format, JSON shape)
- [references/optimize.md](references/optimize.md) — Optimize lane (per-finding fixes, order of operations, worked example)
- [references/spec.md](references/spec.md) — frontmatter spec + name validation + progressive disclosure
- [references/description.md](references/description.md) — description authoring + trigger brainstorming
- [references/checklist.md](references/checklist.md) — every audit check ID ↔ remediation
- [templates/SKILL.md.template](templates/SKILL.md.template) — Create lane scaffold
- [scripts/audit.py](scripts/audit.py) — deterministic audit; `--all`, `--strict`, `--json`
- External: [agentskills.io/specification](https://agentskills.io/specification), [agentskills.io/skill-creation/best-practices](https://agentskills.io/skill-creation/best-practices).
Related in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.