Skills Guide

Create agentic skills, agents and prompts

VerifiedSafe

Command to design skills and agent/prompt/skill triads with mandatory tech stack, security rules and acceptance criteria, without writing application code.

Download and use
Sby Skills Guide Bot
DevelopmentIntermediate
10/31/2026
Claude CodeCopilotCodex
#skill-authoring#prompt-engineering#agent-configuration#guardrails#code-standards

Recommended for

Backend developerClaude CodeCode reviewFrontend developerCopilotFullstack developer

Automated summary

A Claude Code slash command that scaffolds new skills or agent + prompt + skill triads for an agentic ecosystem, injecting a mandated Vue 3 / FastAPI / PostgreSQL stack and security rules, without writing application code.

Strengths

  • Enforces an upfront scoping step: choose between a standalone SKILL.md, prompt + skill, or agent + prompt + skill after auditing existing customizations.
  • Systematically injects a mandatory tech block, concrete security rules (v-html/XSS, CORS allowlist, Pydantic models, secrets via env vars) and a verifiable acceptance checklist.
  • Makes the division of labour between agent, prompt and skill explicit, with named file paths and propagation from .github to .claude/commands.
  • Ships an output template (context, architecture, steps, acceptance criteria, risks) that keeps generated skills reviewable.

Limitations

  • Tightly coupled to one stack and repo layout (Vue 3/FastAPI/PostgreSQL, .github/agents, .codex-skills), so it is not portable as-is.
  • The promised validation (frontmatter, links, legacy bans) is a manual checklist with no script or automated check.
  • The output template is cut off mid-sentence ("[riesgo real o"), and the path conventions mix several ecosystems (.github, .claude, .codex-skills).
When to use it

Use it when adding or revising a skill, prompt or agent inside a repository that already follows this team's Vue 3 + FastAPI conventions.

When not to use it

Avoid it on projects with a different stack, or when you expect actual application code or automated validation of the generated files.

Security analysis

Safe
Quality score78/100

This is a pure meta-instruction file: it describes how to author new skills/prompts/agents, inject stack and security rules, and produce Markdown documentation. It contains no executable commands, no shell/docker/network invocation, no credential handling, no obfuscated payloads, and no attempts to override the auditor or change roles. File-writing is described at the workflow level only and limited to the repo's own doc directories, so listing it carries no meaningful execution risk.

Findings
  • •No execution primitives present (no bash/curl/network/secret handling); the skill only defines instructions for generating other skill/agent/prompt markdown files.
  • •Minor: it instructs the agent to create/update files across four directories (.github/, .gemini/, .codex-skills/, .claude/commands/) plus AGENTS.md/CLAUDE.md; scope is broad but legitimate and non-destructive.
  • •No prompt-injection or instruction-override attempts detected in the content.
How this analysis is made

Examples

Skill for a billing module
/crear-skill skill para el módulo de facturación: reglas XSS en Vue 3, CORS estricto en FastAPI, validación Pydantic y prohibición de patrones legacy
Full triad for PR review
/crear-skill tríada agent + prompt + skill para revisar pull requests del backend FastAPI, con criterios de aceptación y checklist de seguridad
Audit before creating
/crear-skill revisa .github/agents, .github/prompts y .github/skills y dime si conviene crear una skill nueva o extender una existente para el módulo de autenticación

description: "Crear o evolucionar skills, agentes y prompts del ecosistema agéntico con stack y seguridad obligatorios (sin código de aplicación)" argument-hint: "objetivo, alcance y restricciones de la skill"

Nombre de archivo: crear-skill.md

Ubicación de archivo: .claude/commands/crear-skill.md

Descripción: Comando Claude Code para crear skills y tríadas de customizations en LAS-FOCAS

Crea una skill nueva o una tríada de customizations (agent + prompt + skill). Argumento requerido: $ARGUMENTS (objetivo, alcance y restricciones; por ejemplo: "skill para módulo web con reglas XSS/CORS/Pydantic y anti-legacy").

Restricción principal

Este comando no escribe código de aplicación. Su salida son reglas, prompts, guardrails y criterios para que otros agentes implementen código.

Objetivo

  • estructurar el pedido antes de escribir archivos
  • inspeccionar customizations existentes para evitar duplicaciones
  • definir responsabilidades claras entre agente, prompt y skill
  • inyectar stack, seguridad y calidad de forma obligatoria
  • generar criterios de aceptación verificables

Flujo de trabajo

  1. Determinar si el pedido requiere:
    • solo SKILL.md
    • prompt + skill
    • agent + prompt + skill
  2. Revisar archivos existentes en .github/agents/, .github/prompts/, .github/skills/, .claude/commands/ y AGENTS.md.
  3. Proponer arquitectura mínima y explícita: nombre de carpeta, naming final, archivos a crear o actualizar, responsabilidad de cada archivo.
  4. Inyectar el bloque tecnológico obligatorio, reglas de seguridad y criterios universales.
  5. Crear o actualizar los archivos necesarios en .github/ (fuente de verdad) y propagar a .claude/commands/ si corresponde.
  6. Validar frontmatter, coherencia de descripciones, enlaces y prohibiciones legacy.
  7. Actualizar AGENTS.md y CLAUDE.md si el ecosistema agéntico cambia.

Contexto Tecnológico Obligatorio (inyectar en toda skill de desarrollo)

- Frontend obligatorio: Vue 3 (Composition API) + Vite + TypeScript + CSS modular con tokens.
- Backend obligatorio: FastAPI + Pydantic + SQLAlchemy + Alembic + PostgreSQL.
- Arquitectura obligatoria: SPA pura; comunicación exclusivamente por API REST (JSON) y WebSocket.
- Prohibido para nuevas implementaciones: UI en Vanilla JS, manipulación directa del DOM como patrón principal, templates Jinja para render de frontend.

Reglas de Seguridad Obligatorias (inyectar en toda skill de desarrollo)

  1. XSS en Vue 3: evitar v-html con contenido no confiable; si se usa HTML dinámico, exigir sanitización documentada.
  2. CORS en FastAPI: allowlist estricta; prohibido comodín en producción.
  3. Validación Pydantic: modelos tipados para entrada/salida; rechazo de payloads inválidos.
  4. API y sesión: controles de autenticación/autorización consistentes con el módulo.
  5. Manejo de secretos: uso de variables de entorno, sin hardcodeo ni exposición en logs.

Criterios Universales de Aceptación (inyectar en toda skill)

  • [ ] Arquitectura alineada al stack vigente y sin prácticas legacy
  • [ ] Seguridad aplicada y verificable (XSS, CORS, validación de datos)
  • [ ] Plan de pruebas mínimo y cobertura esperada para módulos nuevos
  • [ ] Logging, observabilidad y manejo de errores definidos
  • [ ] Documentación relacionada actualizada
  • [ ] Dependencias e imágenes versionadas sin comodines ni latest

Separación de responsabilidades

  • Agente (.github/agents/*.agent.md): análisis, diseño, edición y validación.
  • Prompt (.github/prompts/*.prompt.md + .claude/commands/*.md): contrato de entrada, pasos y criterios.
  • Skill (.github/skills/*/SKILL.md + .codex-skills/skills/*/SKILL.md): workflow invocable y reutilizable.

Plantilla mínima de salida

## Contexto
- [hecho relevante]

## Arquitectura propuesta
- [archivo]: [responsabilidad]

## Pasos de implementación
1. [paso]

## Criterios de aceptación
- [ ] [criterio verificable]

## Riesgos o notas
- [riesgo real o no aplica]

Reglas obligatorias

  1. No inventar requisitos ni validaciones no pedidas.
  2. Priorizar referencias y enlaces sobre bloques duplicados.
  3. Mantener nombres consistentes con rutas y convención del repo.
  4. Prohibir explícitamente directivas legacy en toda skill de desarrollo nueva.
  5. Todas las salidas deben quedar en .md y en español.
  6. Propagar cambios a los tres entornos: .github/, .gemini/, .codex-skills/ y .claude/commands/.

Salida esperada

  1. Arquitectura propuesta.
  2. Archivos creados o actualizados con ubicación explícita.
  3. Contexto tecnológico obligatorio inyectado.
  4. Criterios universales de aceptación cubiertos.
  5. Documentación relacionada actualizada o pendiente explicitada.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/create-agentic-skills-agents-and-prompts-mvhm5m30/download' --output '.skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30/SKILL.md.part' && mv '.skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30/SKILL.md.part' '.skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

This file does not provide a usable name/description header for this native procedure. It remains available to download and inspect; use the manual method below.

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/create-agentic-skills-agents-and-prompts-mvhm5m30/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

React Hook Form Best Practices

Development

Master React Hook Form: avoid anti-patterns, manage subscriptions, and handle reset, dirty state, and controlled inputs correctly.

Claude CodeCursorWindsurf+2intermediateSafe 108,623
Skills Guide Bot

Emotion to Mantine Migration

Development

Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports.

Claude CodeCursorWindsurf+1intermediateSafe 48,981
Skills Guide Bot

Scope Creep Detector

Development

Analyzes git diffs against a stated intent to detect scope creep, unrelated files, broad PRs, and oversized changes, then suggests keep, split, or justify actions.

Claude CodeCursorCodexintermediateSafe 135,015
Skills Guide Bot