# write-skill Adopt this skill: https://proskills.md/skills/other/anassahel-agent-labs-skills-write-skill Page: https://proskills.md/skills/other/anassahel-agent-labs-skills-write-skill This document is the public skill bundle for that page. It contains SKILL.md and every helper file the catalog carries. No login is required. ## File: skills/write-skill/SKILL.md size: 3589 sha: b6b64d62286d0d2c62663d7b2199cce350821ef6 upstream: https://github.com/anassahel/agent-labs/blob/main/skills/write-skill/SKILL.md ```text --- name: write-skill description: Draft a new skill, or rewrite an existing one, short and built on leading words. argument-hint: "What should the skill do? (or a path to an existing SKILL.md)" disable-model-invocation: true metadata: author: Anas Sahel version: 1.1.0 # x-release-please-version credits: Method adapted from Matt Pocock's writing-for-agents (https://github.com/mattpocock/skills) --- Write a `SKILL.md` the agent follows the same way every run, in as few lines as it takes. The method is Matt Pocock's [writing-for-agents](https://github.com/mattpocock/skills/tree/main/skills/productivity/writing-for-agents). If the argument is a path to an existing skill, read it: this run is a **rewrite**. ## Steps 1. **Pin the job.** Write two sentences: the skill's job, and its **defining constraint** (the one thing it does differently from the obvious default). Ask the user only for what you cannot infer, in one batch. Done when both sentences exist. 2. **Choose invocation.** User-invoked by default: `disable-model-invocation: true` and a one-line human description. Make it model-invoked only when the agent or another skill must reach it alone; then the description opens with the leading word, then "Use when" and one trigger per distinct case. 3. **Find the leading words.** One to three words the model already knows that carry the behaviour (_tracer bullet_, _frontier_, _seam_, _relentless_). Bold each at first use, then repeat it as a token. Done when every idea that recurs is one word. 4. **Draft the body.** - Ordered steps when the skill has a sequence, flat reference when it does not, both when it needs both. - Every step ends on a checkable **completion criterion**. - State the target behaviour. Keep a prohibition only as a hard guardrail, paired with what to do instead. - Templates go in XML-style tags (``). - What every run needs stays inline. What only some branches need goes to a sibling file, behind one line saying when to read it. - Reuse another skill by calling it ("Call the Skill tool with X"), never by copying its content. 5. **Prune.** Go sentence by sentence and delete the whole sentence when it: - is a **no-op**: the model would do it anyway; - restates the environment (folder layout, scripts, config) or another doc (CLAUDE.md, another skill); - no longer bears on the job. Done when a full pass deletes nothing. 6. **Show.** Present the draft, its line count before and after pruning, and the leading words. Save it only once the user approves, where the user says. ## Frontmatter --- name: description: argument-hint: "" disable-model-invocation: true # user-invoked only metadata: author: Anas Sahel version: 1.0.0 --- `version` is never edited by hand: release-please bumps it from the commits that touch the skill's folder (see the README). A new skill starts at `1.0.0`: keep the release-please marker comment on its `version` line, add a `version.txt`, and register the folder in `release-please-config.json` only: its first release adds it to `.release-please-manifest.json`. ## Rules - No H1 unless the skill has several sections. No em-dashes: use a comma, colon, period or parentheses. - Bold marks a leading word, nothing else. - Past about 100 lines, split by branch or move reference to a sibling file. ``` ## File: skills/write-skill/CHANGELOG.md size: 321 sha: 87356c87f09ac292f792f5dcd827444883ac88b2 upstream: https://github.com/anassahel/agent-labs/blob/main/skills/write-skill/CHANGELOG.md ```text # Changelog ## [1.1.0](https://github.com/AnasSahel/agent-labs/compare/write-skill-v1.0.0...write-skill-v1.1.0) (2026-10-23) ### Features * **spec:** add spec ([#2](https://github.com/AnasSahel/agent-labs/issues/2)) ([dbfbc07](https://github.com/AnasSahel/agent-labs/commit/dbfbc0702f0ca9a7a21ce79e0bc00f13749c2f1e)) ``` ## File: skills/write-skill/version.txt size: 6 sha: 9084fa2f716a7117829f3f32a5f4cef400e02903 upstream: https://github.com/anassahel/agent-labs/blob/main/skills/write-skill/version.txt ```text 1.1.0 ``` ## File: README.md upstream: https://github.com/anassahel/agent-labs/blob/main/README.md ```text # agent-labs Skills and agents for Claude Code. ## Skills - [write-skill](skills/write-skill/SKILL.md): draft a new skill, or rewrite an existing one, short and built on leading words. Method adapted from [Matt Pocock's skills](https://github.com/mattpocock/skills). - [factory-brainstorm](skills/factory-brainstorm/SKILL.md): brainstorm an idea until it's concrete, inside the current project's limits or outside them: rounds of up to 3 questions with recommended answers, then one builder check that ends it, with a trace of every question and answer. Adapted from [obra's superpowers brainstorming](https://github.com/obra/superpowers/blob/main/skills/brainstorming/SKILL.md) and [Matt Pocock's grilling](https://github.com/mattpocock/skills/blob/main/skills/productivity/grilling/SKILL.md). - [factory-plan](skills/factory-plan/SKILL.md): Plan phase. Brainstorm a bug, idea or request into an intent in your words, proposed as `intent/-.md` in a pull request (merge = go, close = no) and tracked in any tracker (GitHub, Linear, Plane, files). Follows the Plan phase of [Anthropic's AI-native SDLC playbook](https://claude.com/resources/articles/the-ai-native-sdlc-playbook). - [factory-design](skills/factory-design/SKILL.md): Design phase. Turn an intent into a spec, what to build and how, in one unattended session: criteria, approach, build order and frames, reviewed while it's written by specialized agents (security by OWASP, risk by EBIOS RM and ISO 27005, privacy by GDPR, and each of your `rules/`), then one pull request: owners answer their questions in its review, and merging it is your approval. Unattended, so a CI job can start it when an intent's pull request is merged: `claude -p "/factory-design "`. Follows the Design phase of [Anthropic's AI-native SDLC playbook](https://claude.com/resources/articles/the-ai-native-sdlc-playbook). - [factory-build](skills/factory-build/SKILL.md): Build phase. Turn an approved spec into code in two halves: a plan (`plan.md`: files, order, risks, the test that proves each criterion), drafted without touching the code and accepted by you (and your tech lead for a riskier change), then the code and its tests in one pass on a branch, done only when build, tests and lint pass and a verifier agent, in a fresh context, has run the app against the spec, with a draft pull request. Departures from the plan update it in the same commit. Follows the Build phase of [Anthropic's AI-native SDLC playbook](https://claude.com/resources/articles/the-ai-native-sdlc-playbook). - [grill-me-live](skills/grill-me-live/README.md): get grilled on an idea while its decision tree grows live in your browser: answer on the page or in chat, and dropped branches fade with everything under them. At the end: a receipt of every decision and a slide deck for the people who were not in the room. Runs a small local server (Node). Interview method from [Matt Pocock's grilling](https://github.com/mattpocock/skills/blob/main/skills/productivity/grilling/SKILL.md). - [sail-fill-campaign](skills/sail-fill-campaign/SKILL.md): fill a SailPoint Identity Security Cloud certification campaign (manager, source owner, search, role composition): deduces the type from what you want to certify, follows your project's written rules and your tenant's existing campaigns, shows every field with where its value comes from, then hands you the `sail` commands to run yourself, or the filled form for the UI. - [grc-router](skills/grc/grc-router/SKILL.md): not sure which GRC skill you need? Ask in your own words: it reads `grc/`, sends the request to the skill that owns it, chains several in the right order (gaps, risks, register, attack chains, committee, policies), and tells you the next step. No grilling. - [grc-grill](skills/grc/grc-grill/SKILL.md): get grilled on a governance, risk or compliance decision, one question at a time, each with a recommended answer cited to a clause (ISO 27001, NIS2, DORA, GDPR), within a question budget (`hard` 10, `light` 5, `none`), then pick the output format. Reads `grc/` first so it never asks what your documents answer, and keeps a trace of who decided what for your auditors. Called by the GRC skills. Method from [Matt Pocock's grilling](https://github.com/mattpocock/skills/blob/main/skills/productivity/grilling/SKILL.md). - [risk-assessment](skills/grc/risk-assessment/SKILL.md): assess a security risk as an EBIOS RM scenario, score it before and after treatment (ISO 27005), map its controls to ISO 27001, NIS2, DORA and GDPR, and record it in `grc/risk-register.md`, with the report in md, html, pdf, pptx, xlsx, csv, json or a Jira issue. - [risk-register](skills/grc/risk-register/SKILL.md): keep `grc/risk-register.md` as the one list of your risks: view and filter it, flag what is overdue, stale or above your risk appetite, update status, owner, due dates and controls, import from a spreadsheet or Jira, and export it with a portfolio heat map. No grilling; new scores go back to risk-assessment. - [committee-report](skills/grc/committee-report/SKILL.md): turn the risk register into a report for a committee or board: posture in one sentence, a heat map of what moved since last time, risks above appetite, fix progress and numbered decisions, as a 7-slide deck by default. After the meeting, records what was decided and updates the register. - [gap-analysis](skills/grc/gap-analysis/SKILL.md): check where you stand against ISO 27001 and any framework mapped to it (NIS2, DORA, GDPR, SOC 2, PCI DSS...), line by line from the fixed files in `frameworks/` so no requirement is skipped: each one met, partial, missing, n/a or unknown with its evidence from `grc/`, then a ranked plan where one fix closes every clause it maps to (legal deadlines first). Shows coverage bars and an Annex A map; xlsx by default, usable as a statement of applicability. - [policy-writer](skills/grc/policy-writer/SKILL.md): write or review a security policy in plain words, each rule traced to an ISO 27001 control, the NIS2, DORA or GDPR clauses in scope, and the register risks it reduces, after a hard grill on scope, owner, approver and the rules that are yours to decide. Shows a coverage map of duties met, gaps and conflicts, keeps `grc/policies/index.md` with review dates, and records the approval. Word document by default. - [attack-chain](skills/grc/attack-chain/SKILL.md): chain risks from the register into one bigger attack, where what the attacker holds after one risk is the way in to the next. Scored by its hardest step and its final impact, so three medium risks can add up to one high; names the one fix that breaks the whole chain and draws it for managers. risk-assessment looks for new chains after every risk. - [vendor-risk](skills/grc/vendor-risk/SKILL.md): assess a supplier or SaaS before signing or at renewal: tier it by how much you depend on it, check its certificates, questionnaire, contract and DPA against what that tier requires, score it as one risk and give a verdict (approve, approve with conditions, reject) with owned, dated conditions. Keeps the vendor list in `grc/vendors/` (DORA register of information fields included) and sends high-risk vendors to the risk register. - [raci-builder](skills/grc/raci-builder/SKILL.md): build a RACI matrix (who does, signs off, is asked, is told) for a security process or the whole programme, each activity tied to an ISO 27001, NIS2, DORA or GDPR duty, after a hard grill on who answers for what. Then checks it for missing or double sign-off, conflicts of interest, empty seats, missing deputies and accountability handed to a supplier. Excel by default. - [audit-evidence](skills/grc/audit-evidence/SKILL.md): keep `grc/evidence/` audit-ready: file each piece of evidence against the ISO 27001 controls it proves, with its hash and expiry date, see which controls are evidenced, stale or missing for ISO 27001, NIS2, DORA or GDPR, catch controls the register calls in place with nothing to prove it, send precise re ```