Skip to content
Back to skills

Improve Skill

CSecurity

Review and improve skills in capability files for agent documents. Use when improving toolReferences, instructions, installScript, implementationReference, and stage checklists.

  • 42 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added May 31, 2026
devopstypescriptpythongoshellbashsqldockerawsgcpazure

Works with

  • cli
  • api

Security analysis

C72/100
  • criticalExfiltrates credentials via HTTP — exact pattern from Snyk ToxicSkills study
  • mediumInstalls packages at runtime which could introduce malicious dependencies
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned May 31, 2026

npx -y skills add diegosouzapw/awesome-omni-skill --skill improve-skill --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Improve Skill?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Improve Skill
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/diegosouzapw-improve-skill/badge)](https://www.skillsdirectory.com/skills/diegosouzapw-improve-skill)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: improve-skill
description: Review and improve skills in capability files for agent documents. Use when improving toolReferences, instructions, installScript, implementationReference, and stage checklists.
---

# Improve Skills for Agent Documents

Review and improve skills in a capability file to produce excellent agent skill
documents. Focus on `toolReferences`, `instructions`, `installScript`,
`implementationReference`, and stage `readChecklist`/`confirmChecklist`
sections.

## When to Use

- Reviewing skills with `agent:` sections in capability files
- Improving tool references for better agent skill documents
- Splitting content across the three progressive disclosure layers
- Improving stage checklists (read-then-do and do-then-confirm)
- Ensuring generated SKILL.md files are useful and complete

## Context

Skills with `agent:` sections generate a skill directory with up to three files
following progressive disclosure:

- `SKILL.md` — Stage checklists + tools + `instructions` (always generated)
- `scripts/install.sh` — From `installScript` field (only when present)
- `references/REFERENCE.md` — From `implementationReference` field (only when
  present)

The template (`products/pathway/templates/skill.template.md`):

- Renders `toolReferences` as a **Required Tools** table automatically
- Renders `instructions` as an **Instructions** section in the SKILL.md body
- Links to `scripts/install.sh` when `installScript` exists
- Links to `references/REFERENCE.md` when `implementationReference` exists

### Progressive Disclosure Fields

| Field                     | Purpose                    | Output Target                         |
| ------------------------- | -------------------------- | ------------------------------------- |
| `toolReferences`          | Required tools (table)     | `<required_tools>` in SKILL.md        |
| `instructions`            | Main workflow guidance     | `## Instructions` section in SKILL.md |
| `installScript`           | Environment setup commands | `scripts/install.sh`                  |
| `implementationReference` | Code examples & reference  | `references/REFERENCE.md`             |

### Schema Fields for Skills

Every skill lives inside a capability YAML file. The complete set of fields for
a skill object:

| Field                     | Required | Type    | Description                                                                           |
| ------------------------- | -------- | ------- | ------------------------------------------------------------------------------------- |
| `id`                      | Yes      | string  | Unique identifier (`snake_case`)                                                      |
| `name`                    | Yes      | string  | Human-readable name                                                                   |
| `isHumanOnly`             | No       | boolean | If true, excluded from agent profiles                                                 |
| `human`                   | Yes      | object  | Human-specific content (`description`, `levelDescriptions`)                           |
| `agent`                   | No       | object  | Agent section (`name`, `description`, `useWhen`, `stages`)                            |
| `toolReferences`          | No       | array   | Required tools with `name`, `description`, `useWhen`, optional `url` and `simpleIcon` |
| `instructions`            | No       | string  | Workflow guidance rendered inline in SKILL.md body                                    |
| `installScript`           | No       | string  | Shell commands exported to `scripts/install.sh`                                       |
| `implementationReference` | No       | string  | Code examples exported to `references/REFERENCE.md`                                   |

**Field ordering in YAML:** Follow the schema order — `id`, `name`,
`isHumanOnly`, `human`, `agent`, `toolReferences`, `instructions`,
`installScript`, `implementationReference`.

**Validation rules** (enforced by `npx fit-map validate`):

- `instructions`, `installScript`, `implementationReference` must be strings
  (use YAML `|` block scalar)
- `implementationReference` must NOT contain `<onboarding_steps>` tags (extract
  to `installScript` instead)
- `toolReferences` entries require `name`, `description`, `useWhen`; `url` and
  `simpleIcon` are optional
- `agent.stages` must use valid stage IDs: `specify`, `plan`, `onboard`, `code`,
  `review`, `deploy`
- Each stage requires `focus` (string), `readChecklist` (array),
  `confirmChecklist` (array)

### Data File Locations

Skills live in capability YAML files in **two** locations that must stay in
sync:

- `data/capabilities/{id}.yaml` — Active installation data
- `products/map/examples/capabilities/{id}.yaml` — Canonical example data

When a capability exists in both locations, update both files. Check with:

```sh
diff data/capabilities/{id}.yaml products/map/examples/capabilities/{id}.yaml
```

## Core Principles

### Progressive Disclosure

Content follows three layers matching the Agent Skills specification:

1. **SKILL.md** (< 200 lines) — Stage checklists, instructions, tool table.
   Loaded when the skill is activated. Keep lean.
2. **scripts/install.sh** (10-30 lines) — Self-contained install script. Loaded
   on demand during onboarding.
3. **references/REFERENCE.md** (50-200 lines) — Code examples, patterns,
   pitfalls. Loaded on demand during implementation.

### Content Splitting Decision Tree

When reviewing content, decide where each piece belongs:

1. **Is it a tool name, URL, or "use when" description?** → `toolReferences`
2. **Is it a numbered workflow step or process guidance?** → `instructions`
3. **Is it a `pip install`, `npm install`, or `set -e` shell command?** →
   `installScript`
4. **Is it a code example, config snippet, or verification command?** →
   `implementationReference`
5. **Is it a pre-work check or quality gate?** → stage `readChecklist` /
   `confirmChecklist`

Some skills only need one or two of the optional fields. Not every skill needs
all three. A skill with no install steps and no code examples is fine with just
`instructions` or even nothing beyond the stage checklists.

### Outcome-Oriented Instructions

The `instructions` field (string, YAML `|` block scalar) provides **step-by-step
workflow guidance** that goes into the SKILL.md body. It should guide the reader
through the main workflow from start to finish.

Ask: _"If I follow these instructions, will I achieve the skill's stated
purpose?"_

**Size guide:** 10-50 lines. Use markdown headings (`## Step 1: ...`) to
structure the flow. No code blocks — those belong in `implementationReference`.

### Install Scripts

The `installScript` field (string, YAML `|` block scalar) contains **only shell
commands** for environment setup. Exported as `scripts/install.sh` with
executable permissions (mode 0o755).

- Plain bash commands, no markdown, no prose
- Start with `set -e` for error handling
- Pin dependency versions where practical
- End with verification commands (e.g. `command -v tool`,
  `python -c "import pkg"`)
- Do NOT include workflow steps, code examples, or explanatory text

**Size guide:** 5-30 lines.

### Implementation Reference

The `implementationReference` field (string, YAML `|` block scalar) contains
**code examples, patterns, and verification steps**. Exported as
`references/REFERENCE.md`.

- Must NOT duplicate tool information (already in `toolReferences`)
- Must NOT contain workflow steps (those go in `instructions`)
- Must NOT contain install commands (those go in `installScript`)
- Must NOT contain `<onboarding_steps>` tags (validation will reject them)
- Should include a **Verification** section with runnable commands
- Should include a **Common Pitfalls** section where relevant

**Size guide:** 30-200 lines. Use markdown headings to organize sections.

### Minimal Essential Tooling

Recommend only the **core tools required** to achieve the skill's outcome. A
focused set of 2-4 essential tools is more valuable than an exhaustive list.

Ask: _"Could someone complete this skill without this tool?"_ If yes, omit it.

### Checklist Manifesto Checklists

Stage checklists exist to **prevent critical failures**, not to be exhaustive
task lists. They should cause the agent to pause, reflect, and ask the user
where relevant.

- **readChecklist** (Read-Then-Do): Critical checks to read **before** starting
  the stage. These gate entry — don't start until every item is satisfied.
- **confirmChecklist** (Do-Then-Confirm): Critical checks to verify **before**
  handing off to the next stage. These gate exit — don't proceed until every
  item is confirmed.

Ask: _"If someone skipped this check, what could go wrong?"_ If the answer is
"something critical fails silently," it belongs in the checklist.

## Process

1. **Identify the capability** to review (ask if not specified)
2. **Read the capability file** from both `data/capabilities/{id}.yaml` and
   `products/map/examples/capabilities/{id}.yaml`
3. **For each skill with an `agent:` section**, review and improve
4. **Study the updated skill** by running `npx fit-pathway skill <name> --agent`
5. **Iterate** until the skill document is clear, complete, and well-structured
6. **Run validation**: `npx fit-map validate`

### Tool References Review

Aim for **2-4 essential tools** per skill. Check that `toolReferences`:

- **Include only tools essential** to achieve the skill's core outcome
- Include the primary tool used in `implementationReference` code samples
- Prefer open source tools and libraries over commercial offerings (exceptions:
  ubiquitous platforms like AWS, GitHub, Azure, GCP are fine)
- Have accurate, concise `description` fields
- Have specific `useWhen` guidance relevant to this skill (not generic)
- Include `url` for official documentation where available
- Include `icon` field where appropriate using Simple Icons names (use `task`,
  `python`, `typescript` as generic fallbacks)

**Exclude:**

- Nice-to-have tools that aren't central to the implementation
- Alternative tools (pick one, don't list options)
- Generic utilities (linters, formatters) unless skill-specific
- Tools mentioned only in passing

### Instructions Review

Check that `instructions`:

- **Follows a logical sequence** using markdown headings (`## Step 1: ...`)
- **Provides clear workflow guidance** from start to finish
- Does NOT contain code examples (those go in `implementationReference`)
- Does NOT contain install commands (those go in `installScript`)
- Does NOT contain tool tables (those go in `toolReferences`)
- Stays under ~50 lines for SKILL.md body budget
- Uses YAML `|` block scalar (not `>` which folds newlines)

### Install Script Review

Check that `installScript` (if present):

- Contains **only shell commands** (no markdown, no prose, no `#` section
  headers)
- Starts with `set -e` for error handling
- Pins dependency versions where practical (e.g. `pip install duckdb==0.10.0`)
- Includes verification commands (e.g. `command -v tool`,
  `python -c "import pkg"`)
- Does NOT contain code examples or workflow steps
- Uses YAML `|` block scalar

### Implementation Reference Review

Check that `implementationReference` (if present):

- **Shows complete, working code** (not fragments or pseudocode)
- **Does NOT contain** tool tables or "Technology Stack" sections
- **Does NOT contain** `<onboarding_steps>` tags (validation will reject them;
  extract to `installScript` instead)
- **Does NOT contain** step-by-step workflow guidance (use `instructions`
  instead)
- **Does NOT contain** `pip install` / `npm install` commands (use
  `installScript` instead)
- **Includes verification** so the reader knows when they've succeeded
- **Includes Common Pitfalls** section where relevant
- Uses YAML `|` block scalar

### Cross-Field Consistency Review

After reviewing individual fields, check cross-field consistency:

- Tools in `implementationReference` code samples appear in `toolReferences`
- Packages in `installScript` match imports in `implementationReference`
- `instructions` workflow references tools that exist in `toolReferences`
- Stage checklists reference tools/packages from the other fields
- No content is duplicated across fields

### Stage Checklists Review

Each stage (`specify`, `plan`, `onboard`, `code`, `review`, `deploy`) has a
`readChecklist` and `confirmChecklist`. Review all stages for the skill.

#### Writing Effective Checklists

**1. Force pause-and-reflect with ASK items**

Use `ASK the user` prefix for items that require information the agent cannot
infer. This forces the agent to stop and gather critical input before
proceeding.

Good examples by stage:

- **specify**:
  `ASK the user what business problem this should solve — get a concrete problem statement`
- **onboard**: `ASK the user for a valid GITHUB_TOKEN with Models access`
- **onboard**:
  `ASK the user for database credentials (connection string, API key)`

Bad: `Configure API keys` (vague, agent may skip or guess)

**2. Be explicit and verifiable**

Each item should be concrete enough that someone can unambiguously determine
whether it's done. Include specific commands, thresholds, or observable
outcomes.

Good: `python -c "import sklearn, pandas, mlflow"` succeeds Bad:
`ML frameworks installed`

Good: `Train/test gap within acceptable range (< 5%)` Bad: `No overfitting`

Good: `All credentials stored in .env file and .env is listed in .gitignore`
Bad: `Environment variables configured`

**3. Include quantified thresholds where possible**

Replace vague quality bars with concrete numbers:

- `gap < 5%` instead of "acceptable range"
- `p50 and p95 latency measured` instead of "latency checked"
- `at least 3× model size available for checkpoints` instead of "sufficient disk
  space"
- `similarity scores > 0.7 indicates good relevance` instead of "good relevance"

**4. Cover security and credentials explicitly**

Every `onboard` checklist should address credentials:

- readChecklist: `ASK the user for [specific credential]`
- confirmChecklist: `All credentials stored in .env — NEVER hardcoded in code`

**5. Cover domain-specific critical risks**

Each skill has unique failure modes. The checklists must explicitly guard
against them:

| Domain        | Critical Risks to Check                                    |
| ------------- | ---------------------------------------------------------- |
| ML models     | Data leakage, overfitting, bias/fairness, class imbalance  |
| RAG systems   | Hallucination, chunk quality, source citation, cost/query  |
| Fine-tuning   | Catastrophic forgetting, VRAM limits, licensing, eval loss |
| Observability | Tracing gaps, missing spans, dashboard verification        |
| Deployment    | Rollback procedures, monitoring, alerting                  |

**6. Match checklist items to stage purpose**

- **specify**: Gather requirements from user, define success criteria
- **plan**: Technical decisions, architecture, evaluation methodology
- **onboard**: Environment setup, credentials, tool installation, data access
- **code**: Implementation, testing, experiment tracking
- **review**: Validation against criteria, edge cases, bias checks
- **deploy**: Production readiness, monitoring, rollback, documentation

#### Checklist Anti-Patterns

| Anti-Pattern                    | Fix                                                |
| ------------------------------- | -------------------------------------------------- |
| Vague items ("check quality")   | Be specific ("retrieval precision@5 > 0.8")        |
| Missing user prompts in onboard | Add `ASK the user for` credential/config items     |
| No verification commands        | Add runnable commands that prove success           |
| Duplicating focus text          | Checklists complement focus, don't repeat it       |
| Too few items (< 4)             | Cover all critical failure modes for the stage     |
| Too many items (> 10)           | Keep only items where skipping causes real failure |
| Generic across skills           | Tailor to the skill's unique domain risks          |
| No security checks              | Add credential storage and .gitignore verification |
| Missing rollback/recovery       | Deploy stage should always cover rollback          |

### Common Problems to Fix (All Sections)

| Problem                       | Fix                                               |
| ----------------------------- | ------------------------------------------------- |
| Too many tools                | Keep only 2-4 essential tools for core outcome    |
| Mixed content in one field    | Split across instructions/installScript/reference |
| `<onboarding_steps>` tags     | Extract to `installScript` field                  |
| Workflow steps in reference   | Move to `instructions` field                      |
| Install commands in reference | Move to `installScript` field                     |
| Tool lists in reference       | Remove (already in `toolReferences`)              |
| Code without context          | Add prose explaining what each section achieves   |
| SKILL.md over 200 lines       | Move code examples to `implementationReference`   |
| Vague checklists              | Add ASK items, commands, and thresholds           |
| Missing ASK items             | Onboard and specify stages need user prompts      |
| No credential checks          | Add .env and .gitignore verification              |

### Good Structure Pattern

````yaml
# In capability YAML file — skill with all three optional fields
- id: data_integration
  name: Data Integration
  human:
    description: ...
    levelDescriptions: ...
  agent:
    name: data-integration
    description: Build robust data pipelines
    useWhen: Working with data ingestion or ETL
    stages:
      onboard:
        focus: Set up data tools and verify data access
        readChecklist:
          - ASK the user for database connection string
          - Install pipeline tools — `pip install duckdb polars`
        confirmChecklist:
          - All packages installed — `python -c "import duckdb, polars"` succeeds
          - All credentials stored in .env — NEVER hardcoded in code
      code:
        focus: Build and test the pipeline
        readChecklist:
          - Read instructions section for workflow steps
          - Read references/REFERENCE.md for code patterns
        confirmChecklist:
          - Pipeline produces expected output shape
          - Error handling covers connection failures
  toolReferences:
    - name: DuckDB
      url: https://duckdb.org/docs
      description: In-process SQL analytics engine
      useWhen: Querying local files or building analytical pipelines
    - name: Polars
      url: https://docs.pola.rs
      description: Fast DataFrame library
      useWhen: Transforming tabular data with lazy evaluation
  instructions: |
    ## Step 1: Explore the Source Data
    Profile the source data to understand schema, volume, and quality.

    ## Step 2: Build the Pipeline
    Create extraction, transformation, and loading stages.

    ## Step 3: Add Validation
    Define data quality expectations and verify output.
  installScript: |
    set -e
    pip install duckdb polars great-expectations
    python -c "import duckdb, polars, great_expectations"
  implementationReference: |
    ## Client Setup
    ```python
    import duckdb
    conn = duckdb.connect(":memory:")
    df = conn.execute("SELECT * FROM 'data.parquet'").pl()
    ```

    ## Verification
    ```python
    assert df.shape[0] > 0, "Pipeline produced no rows"
    assert set(df.columns) >= {"id", "value"}, "Missing required columns"
    ```

    ## Common Pitfalls
    - Forgetting to close DuckDB connections in error paths
    - Not handling NULL values in join keys
````

```yaml
# Skill with instructions only — no install or reference needed
- id: problem_discovery
  name: Problem Discovery
  human: ...
  agent:
    name: problem-discovery
    description: Discover and validate user problems
    useWhen: Starting new feature work or investigating user pain points
    stages: ...
  instructions: |
    ## Discovery Process
    Interview stakeholders and gather evidence before proposing solutions.

    ## Validation
    Confirm the problem exists with data before building anything.
```

### Good Checklist Pattern

```yaml
stages:
  onboard:
    focus: |
      Set up the development environment...
    readChecklist:
      - ASK the user for [specific credential or config needed]
      - ASK the user to confirm [prerequisite environment detail]
      - Install [specific packages] — `pip install pkg1 pkg2`
      - Configure [specific tool] with [specific settings]
      - Verify [specific data/service] is accessible
    confirmChecklist:
      - All packages installed — `python -c "import pkg1, pkg2"` succeeds
      - [Service] running — `curl localhost:port` responds
      - [Credential] configured — `tool whoami` succeeds
      - All credentials stored in .env — NEVER hardcoded in code
      - Dependencies pinned in requirements.txt
```

## Output

1. Summarize issues found
2. Apply fixes directly to the capability file (both locations if applicable)
3. Run `npx fit-map validate` to verify changes

## Memory

> **Keep this section up to date.** After every review or tweak to the skill
> improvement process, add a dated note here. This prevents repeating past
> mistakes and preserves decisions made during reviews. When completing a
> review, check this section first and update it with any new decisions.

### Protected Tools

The following tools have been explicitly identified as critical and **must NOT
be removed** during skill reviews, even if they appear to exceed the 2-4 tool
guideline:

- **GitHub Models** (in `retrieval_augmentation`) — Critical for developer
  experience. Provides free LLM inference via GITHUB_TOKEN with zero cost. Do
  not remove in favour of generic OpenAI references.
- **Playwright** (in `code_quality`) — Critical for end-to-end testing. The
  primary E2E testing framework for verifying full application behavior across
  browsers.
- **Rancher Desktop** (in `full_stack_development`, `devops`) — Critical for
  container runtime on macOS. Provides Docker socket at `/var/run/docker.sock`
  with no licensing concerns. Replaces Colima (which has docker.sock mount
  issues with Supabase).
- **uv** (all Python skills) — Critical for Python package management. Replaces
  pip with 10-50x faster installs, built-in lockfiles, and Python version
  management. Do not revert to pip.
- **mise** (skills with runtime requirements) — Critical for runtime version
  pinning. Each skill provides a mise fragment in implementationReference. Do
  not remove or replace with nvm/pyenv/asdf.
- **just** (skills with dev workflows) — Critical for project-level task
  automation. Each skill provides justfile recipe fragments in
  implementationReference. Do not remove.
- **AWS Step Functions** (in `cloud_platforms`) — Critical for modern serverless
  practices. Essential for orchestrating multi-step workflows with error
  handling, retries, and state management.

### Review Log

- **2026-02-10**: Restored GitHub Models, Playwright, Colima, and Step Functions
  after initial review incorrectly removed them as "nice-to-have". Added this
  Memory section to prevent recurrence.
- **2026-02-11**: DX overhaul — Replaced Colima with Rancher Desktop, pip with
  uv, added mise and just. All Python skills use `uv sync` instead of
  `pip install`. Skills provide composable Docker Compose, justfile, and mise
  fragments in implementationReference for Tier 3 project-level assembly.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…