Meta Skill Writer

Writing Skills

Adapted from the superpowers plugin (MIT).

Overview

Writing skills IS Test-Driven Development applied to process documentation.

Personal skills live in agent-specific directories (~/.claude/skills for Claude Code, ~/.agents/skills/ for Codex)

if there is a skill in the current directory, work on AND test THAT skill, not ~/.claude/skills or ~/.agents/skills/

You write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).

Core principle: If you didn't watch an agent fail without the skill, you don't know if the skill teaches the right thing.

REQUIRED BACKGROUND: You MUST understand bitranox:process-test-driven-development before using this skill. That skill defines the fundamental RED-GREEN-REFACTOR cycle. This skill adapts TDD to documentation.

Official guidance: For Anthropic's official skill authoring best practices, see anthropic-best-practices.md. This document provides additional patterns and guidelines that complement the TDD-focused approach in this skill.

Reference Files

Use the Read tool to load referenced files identified as relevant for full details.

What is a Skill?

A skill is a reference guide for proven techniques, patterns, or tools. Skills help future Claude instances find and apply effective approaches.

Skills are: Reusable techniques, patterns, tools, reference guides

Skills are NOT: Narratives about how you solved a problem once

TDD Mapping for Skills

The entire skill creation process follows RED-GREEN-REFACTOR.

When to Create a Skill

Create when:

• Technique wasn't intuitively obvious to you
• You'd reference this again across projects
• Pattern applies broadly (not project-specific)
• Others would benefit

Don't create for:

• One-off solutions
• Standard practices well-documented elsewhere
• Project-specific conventions (put in project instructions file: CLAUDE.md / AGENTS.md)
• Mechanical constraints (if it's enforceable with regex/validation, automate it - save documentation for judgment calls)

Skill Types

Technique

Concrete method with steps to follow (condition-based-waiting, root-cause-tracing)

Pattern

Way of thinking about problems (flatten-with-flags, test-invariants)

Reference

API docs, syntax guides, tool documentation (office docs)

Directory Structure

skills/
  skill-name/
    SKILL.md              # Main reference (required)
    supporting-file.*     # Only if needed

Flat namespace - all skills in one searchable namespace

Separate files for:

1. Heavy reference (100+ lines) - API docs, comprehensive syntax
2. Reusable tools - Scripts, utilities, templates

Keep inline:

• Principles and concepts
• Code patterns (< 50 lines)
• Everything else

Hub skills with supporting files: When SKILL.md is an index that points to separate reference files, add an explicit instruction in the body (not frontmatter) telling Claude to use the Read tool. This prevents Claude from trying to answer from summary tables alone instead of loading the detailed file.

Use the Read tool to load referenced files identified as relevant for full details.

Only add this for hub/reference skills with supporting files. Self-contained skills (where everything is in SKILL.md) don't need it - the full body is already loaded when invoked.

Upstream doc linking: When hub skills consolidate content from original source documents in subdirectories (e.g., docs/, tutorial/, api/), include a two-tier routing table in SKILL.md:

1. Tier 1 - distilled reference files (same directory as SKILL.md)
2. Tier 2 - original upstream docs (subdirectory paths for deeper detail)

Don't rely on passive > Source: annotations in supporting files - agents treat these as attribution, not as actionable links. The hub must provide an explicit routing table for upstream docs.

## Reference Files

| Topic                                           | Distilled reference | Upstream source (full detail)      |
|-------------------------------------------------|---------------------|------------------------------------|
| Core API - Client, Session, request(), stream() | api-reference.md    | docs/api/full-reference.md         |
| Config - Settings, env vars, pyproject section  | configuration.md    | docs/guides/configuration.md       |
| Tutorials - quickstart, first app, deployment   | quick-start.md      | tutorial/getting-started/README.md |

Use the Read tool to load a distilled reference first.
If it lacks the detail you need, load the upstream source.

The upstream table should work as a comprehensive index so an agent can jump straight to the right file for any specific class, function, or method. Each row needs to list the concrete API symbols the file covers, not just a prose summary.

| Topic                                                   | Upstream source |
|---------------------------------------------------------|-----------------|
| NO Widgets                                              | docs/widgets.md |
| OK Widgets - DataTable, Tree, OptionList, Select, Input | docs/widgets.md |

Building routing tables: For each supporting file, use grep -E '^#{2,3} ' filename.md to extract H2/H3 headings. For tier 1 (distilled reference) rows, list the 3-5 most important headings, class names, or function names as the topic description. If a file covers more than 5 key terms, pick the ones an agent is most likely to search for and add an "etc." or "and more" suffix. For tier 2 (upstream source) rows, list all classes, functions, API endpoints, and key concepts - the upstream column serves as a comprehensive index, so every symbol must be findable through the topic description.

Evaluating routing descriptions: For each row in a routing table, ask: given a realistic user query, could Claude pick the right file from the topic description alone? If two rows sound equally plausible for the same query, the descriptions need more differentiation.

Common failures:

• Topic names too generic ("API", "Config") - Claude can't distinguish files
• Overlapping scope - two files both sound relevant for the same query
• Missing subtopics - key content buried inside a file isn't mentioned in the description

Fix: expand topic descriptions to include 2-3 disambiguating subtopics or keywords.

| Topic                                         | Distilled reference |
|-----------------------------------------------|---------------------|
| NO API                                        | api-reference.md    |
| NO Config                                     | configuration.md    |
| OK Core API - endpoints, auth, rate limits    | api-reference.md    |
| OK Config - env vars, CLI flags, config files | configuration.md    |

Verifying routing tables: After writing a routing table, run two checks to confirm it is both complete and accurate. For two-tier tables, run both checks independently for the distilled reference column and the upstream source column:

1. Coverage check (file -> table): For each referenced file, run grep -E '^#{2,3} ' filename.md to extract its headings. For each heading or key term, confirm it appears in the routing table's topic description for that file. Missing terms = content agents can't find through the table.
2. Accuracy check (table -> file): For each search term listed in the routing table, run grep -i "term" filename.md to confirm the file actually contains it. Mismatches = stale entries that route agents to the wrong file.

A routing table passes when every key term in the file appears in the table (coverage) and every term in the table appears in the file (accuracy). For tier 1 rows with 10+ headings, coverage is sufficient if the top 5 most-queried terms are represented. For tier 2 rows, coverage requires all classes, functions, and API endpoints - no "top 5" shortcut. Both columns must pass independently.

Example:

Referenced file `widgets.md` contains headings: DataTable, Tree, Select, Input, OptionList

OK Coverage check passes - routing table says:
| Widgets - DataTable, Tree, OptionList, Select, Input | widgets.md |

NO Coverage check fails - routing table says:
| Widgets                                              | widgets.md |
(agent searching for "DataTable" won't find the right file)

OK Accuracy check passes - grep widgets.md for "DataTable" -> found
NO Accuracy check fails - routing table lists "TreeView" but file only contains "Tree"

Tier 2 example (upstream source column):

Routing table row:
| Core API - Client, Session, request(), stream() | api-reference.md | docs/api/full-reference.md  |

Upstream file `docs/api/full-reference.md` contains headings: Client, Session, request, stream, Connection, Retry

NO Tier 2 coverage check fails - topic lists 4 of 6 symbols; missing Connection and Retry -> add them to topic description
NO Tier 2 accuracy check fails - topic lists "stream()" but upstream file heading is "Streaming" -> fix topic or confirm alias

Fixed topic: Core API - Client, Session, request(), Streaming, Connection, Retry

Presence gate: Before checking coverage and accuracy, first confirm a tier 2 table exists at all. Run find <upstream-dirs> -name '*.md' to list all upstream files. If any exist but the routing table has no tier 2 (upstream source) column, the skill is incomplete - add the column and populate it before proceeding with coverage/accuracy checks.

SKILL.md Structure

Frontmatter (YAML):

• Only two fields supported: name and description (custom fields are stripped by Claude Code)
• Caps are PER FIELD, not combined: name 64 characters, description 1024
• Over the cap is not refused, it is silently truncated. No warning, no error, and nothing in the file to see: the SKILL.md still reads perfectly while the injected available-skills listing cuts the description mid-word and ends it with an ellipsis, so every trigger past the cut is invisible to the router. The skill then behaves as if its newest triggers were never written - documented, tested, listed in its own table, and never suggested.
  • Measure the field, do not eyeball it: extract the frontmatter description and take len(). This repo's commit gate measures it too and fails over the cap, so the rule is mechanical rather than remembered.
  • The observed cut falls LATER than 1024, not earlier. A 1060-character description was delivered whole; a 2124-character one lost its last 597 characters. So nothing under the documented cap is at risk, and the reason to stay under it is that the real boundary is a harness detail that can move - not that your 900-character description is in danger. Do not probe for the knife; the 500-character target below is the margin worth aiming at.
  • A bloated description is a REWRITE, not an append. An appended trigger lands in the dead tail, and inserting one early only pushes a different one out.
  • To see where a live session actually cut, ask a running agent to quote its own available-skills entry for that skill verbatim, and diff it against the field in the file. The listing is injected into the system prompt, so it cannot be read off disk.
• name: Use letters, numbers, and hyphens only (no parentheses, special chars)
• description: Third-person, describes ONLY when to use (NOT what it does)
  • Start with "Use when..." to focus on triggering conditions
  • Include specific symptoms, situations, and contexts
  • NEVER summarize the skill's process or workflow (see CSO section for why)
  • Keep under 500 characters if possible

---
name: skill-name-with-hyphens
description: Use when [specific triggering conditions and symptoms]
---

# Skill Name

## Overview
What is this? Core principle in 1-2 sentences.

## When to Use
[Small inline flowchart IF decision non-obvious]

Bullet list with SYMPTOMS and use cases
When NOT to use

## Core Pattern (for techniques/patterns)
Before/after code comparison

## Quick Reference
Table or bullets for scanning common operations

## Implementation
Inline code for simple patterns
Link to file for heavy reference or reusable tools

## Common Mistakes
What goes wrong + fixes

## Real-World Impact (optional)
Concrete results

Claude Search Optimization (CSO)

Critical for discovery: Future Claude needs to FIND your skill

1. Rich Description Field

Purpose: Claude reads description to decide which skills to load for a given task. Make it answer: "Should I read this skill right now?"

Format: Start with "Use when..." to focus on triggering conditions

CRITICAL: Description = When to Use, NOT What the Skill Does

The description should ONLY describe triggering conditions. Do NOT summarize the skill's process or workflow in the description.

Why this matters: Testing revealed that when a description summarizes the skill's workflow, Claude may follow the description instead of reading the full skill content. A description saying "code review between tasks" caused Claude to do ONE review, even though the skill's flowchart clearly showed TWO reviews (spec compliance then code quality).

When the description was changed to just "Use when executing implementation plans with independent tasks" (no workflow summary), Claude correctly read the flowchart and followed the two-stage review process.

The trap: Descriptions that summarize workflow create a shortcut Claude will take. The skill body becomes documentation Claude skips.

# NO BAD: Summarizes workflow - Claude may follow this instead of reading skill
description: Use when executing plans - dispatches subagent per task with code review between tasks

# NO BAD: Too much process detail
description: Use for TDD - write test first, watch it fail, write minimal code, refactor

# OK GOOD: Just triggering conditions, no workflow summary
description: Use when executing implementation plans with independent tasks in the current session

# OK GOOD: Triggering conditions only
description: Use when implementing any feature or bugfix, before writing implementation code

Content:

• Use concrete triggers, symptoms, and situations that signal this skill applies
• Describe the problem (race conditions, inconsistent behavior) not language-specific symptoms (setTimeout, sleep)
• Keep triggers technology-agnostic unless the skill itself is technology-specific
• If skill is technology-specific, make that explicit in the trigger
• Write in third person (injected into system prompt)
• NEVER summarize the skill's process or workflow

# NO BAD: Too abstract, vague, doesn't include when to use
description: For async testing

# NO BAD: First person
description: I can help you with async tests when they're flaky

# NO BAD: Mentions technology but skill isn't specific to it
description: Use when tests use setTimeout/sleep and are flaky

# OK GOOD: Starts with "Use when", describes problem, no workflow
description: Use when tests have race conditions, timing dependencies, or pass/fail inconsistently

# OK GOOD: Technology-specific skill with explicit trigger
description: Use when using React Router and handling authentication redirects

2. Keyword Coverage

Use words Claude would search for:

• Error messages: "Hook timed out", "ENOTEMPTY", "race condition"
• Symptoms: "flaky", "hanging", "zombie", "pollution"
• Synonyms: "timeout/hang/freeze", "cleanup/teardown/afterEach"
• Tools: Actual commands, library names, file types

3. Descriptive Naming

Use active voice, verb-first:

• OK creating-skills not skill-creation
• OK condition-based-waiting not async-test-helpers

If the target marketplace defines a naming registry, follow it. Some marketplaces enforce a category-prefix scheme (e.g. <category>-[<sub>-]<name> like coding-python-..., marketing-...) via a registry file and a contribution gate. When contributing there, pick the category per that repo's rules and keep the verb-first/descriptive style for the <name> part. The scheme itself is repo-specific - see that repo's CONTRIBUTING.md (for this marketplace, skill-taxonomy.json).

4. Token Efficiency (Critical)

Problem: getting-started and frequently-referenced skills load into EVERY conversation. Every token counts.

Target word counts (tiered by skill type):

• getting-started workflows: <150 words each
• Frequently-loaded / process skills: <200 words total
• Other process/technique skills: <500 words (still be concise)
• Reference/hub skills (routing tables + supporting files): MAY exceed 500 words, but keep the SKILL.md lean - push detail into reference files and let the body stay an index. This skill-writer is itself a hub skill and legitimately runs long.

Techniques:

Move details to tool help:

# NO BAD: Document all flags in SKILL.md
search-conversations supports --text, --both, --after DATE, --before DATE, --limit N

# OK GOOD: Reference --help
search-conversations supports multiple modes and filters. Run --help for details.

Use cross-references:

# NO BAD: Repeat workflow details
When searching, dispatch subagent with template...
[20 lines of repeated instructions]

# OK GOOD: Reference other skill
Always use subagents (50-100x context savings). REQUIRED: Use [other-skill-name] for workflow.

Compress examples:

# NO BAD: Verbose example (42 words)
your human partner: "How did we handle authentication errors in React Router before?"
You: I'll search past conversations for React Router authentication patterns.
[Dispatch subagent with search query: "React Router authentication error handling 401"]

# OK GOOD: Minimal example (20 words)
Partner: "How did we handle auth errors in React Router?"
You: Searching...
[Dispatch subagent -> synthesis]

Eliminate redundancy:

• Don't repeat what's in cross-referenced skills
• Don't explain what's obvious from command
• Don't include multiple examples of same pattern

Verification:

wc -w skills/path/SKILL.md
# getting-started workflows: aim for <150 each
# Other frequently-loaded: aim for <200 total

Name by what you DO or core insight:

• OK condition-based-waiting > async-test-helpers
• OK using-skills not skill-usage
• OK flatten-with-flags > data-structure-refactoring
• OK root-cause-tracing > debugging-techniques

Gerunds (-ing) work well for processes:

• creating-skills, testing-skills, debugging-with-logs
• Active, describes the action you're taking

5. Cross-Referencing Other Skills

When writing documentation that references other skills:

Use skill name only, with explicit requirement markers:

• OK Good: **REQUIRED SUB-SKILL:** Use bitranox:process-test-driven-development
• OK Good: **REQUIRED BACKGROUND:** You MUST understand bitranox:process-debug-systematic
• NO Bad: See skills/testing/test-driven-development (unclear if required)
• NO Bad: @skills/testing/test-driven-development/SKILL.md (force-loads, burns context)

Why no @ links: @ syntax force-loads files immediately, consuming 200k+ context before you need them.

Referencing a SCRIPT is the opposite of referencing a skill: state the home path. A skill name resolves through the skill system; a script filename resolves through nothing. A bare helper.py --check in prose is unrunnable for a reader whose context lacks the owning skill's base directory, and it reads as NOT SHIPPED to anyone auditing the plugin (they search the path-qualified locations, e.g. hooks/, and conclude the file is missing).

• OK Good: `reconcile_memory_index.py --check` (home: `<plugin>/skills/meta-self-improve/`, launch via `hooks/run-python.sh`)
• NO Bad: run `reconcile_memory_index.py --check` (bare filename - where? how?)

Rules: state the home (skills/<owner>/<script>) and the launch shim at the point of use; when a family of skills shares a core reference file, single-source the homes there (a "Script homes" section) and let the members cite it; a script referenced from OUTSIDE its owning skill is the case that always needs the path - within its own skill's SKILL.md the announced base directory resolves a bare name.

Referencing external DOCS must be INSTALL-REACHABLE (the same rule, applied to docs). A skill teaching a tool or library usually points at that project's fuller docs (its README, a docs/ folder). But the skill ships ALONE - only its own directory - and a package's README/docs/ are usually STRIPPED from the installed wheel (the wheel ships src/ + py.typed, not docs). So a bare see docs/api.md or "the package's README" is a DANGLING pointer on any machine that installed the skill: it resolves to nothing. This shipped for real in more than one skill. Every reference you send a reader to must resolve FROM AN INSTALL, by one of:

• Install-local discovery FIRST - the installed code's own truth (zero rot, no network, always the reader's version). For CLI options, the skill must direct the reader/LLM to RUN <tool> --help (and <tool> <subcommand> --help) instead of freezing a flag list that goes stale; for the API, python -c "import mod; help(mod)" / docstrings. When a command's flags or an API signature are in question, running --help/help() beats reading any doc - it is the authoritative, always-current source. Author every tool/library skill this way: do NOT enumerate every flag in the SKILL.md when --help covers it - point the reader at --help and keep the body to the judgment --help cannot give.
• For narrative docs not in --help, link the LATEST docs (the default branch). Tools here are installed/updated via uv/uvx, so the reader is normally on the latest release and latest docs match: https://github.com/<owner>/<repo>/blob/<default-branch>/docs/x.md (use the repo's real default branch - master or main; blob/HEAD/... is branch-name-agnostic and survives a default-branch rename). The one fragility: a deep file link 404s if that file is later renamed or moved - mitigate by linking the docs/ dir or repo root when the file set is unstable. Do NOT hard-code a version tag as the default - it silently goes STALE as the tool moves past it. Use a tag-anchored URL plus a "swap <tag> for your installed version" hint ONLY when the skill is pinned to one library version or version drift would actively mislead.
• A DISTILLED copy bundled in the skill dir (it then ships with the skill) - use when offline use matters or the skill is pinned to one library version; stamp it with the source URL + version so it can be refreshed, and keep it distilled so drift stays bounded.
• NEVER a bare package-local path (docs/api.md, "its docs/") that is neither shipped in the skill dir nor a URL.

First make the SKILL.md SELF-SUFFICIENT for the common path, so any external reference is for the deep minority of cases only: then a rotted link or a stale bundle degrades gracefully instead of breaking the skill. Neither a URL (network + link-rot) nor a bundle (drift) is free - the self-sufficient body is what makes either safe.

Verify before shipping: grep -nE '(docs/|README|see [^ ]*\.md|its .docs.)' SKILL.md | grep -v http should surface only references that (a) ship as files in the skill dir (ls them) or (b) are install-local --help/help(). Any remaining bare package-local path is the bug.

Flowchart Usage

digraph when_flowchart {
    "Need to show information?" [shape=diamond];
    "Decision where I might go wrong?" [shape=diamond];
    "Use markdown" [shape=box];
    "Small inline flowchart" [shape=box];

    "Need to show information?" -> "Decision where I might go wrong?" [label="yes"];
    "Decision where I might go wrong?" -> "Small inline flowchart" [label="yes"];
    "Decision where I might go wrong?" -> "Use markdown" [label="no"];
}

Use flowcharts ONLY for:

• Non-obvious decision points
• Process loops where you might stop too early
• "When to use A vs B" decisions

Never use flowcharts for:

• Reference material -> Tables, lists
• Code examples -> Markdown blocks
• Linear instructions -> Numbered lists
• Labels without semantic meaning (step1, helper2)

REFERENCE: See graphviz-conventions.dot for graphviz style rules.

Visualizing for your human partner: Use render-graphs.js in this directory to render a skill's flowcharts to SVG:

./render-graphs.js ../some-skill           # Each diagram separately
./render-graphs.js ../some-skill --combine # All diagrams in one SVG

Code Examples

One excellent example beats many mediocre ones

Choose most relevant language:

• Testing techniques -> TypeScript/JavaScript
• System debugging -> Shell/Python
• Data processing -> Python

Good example:

• Complete and runnable
• Well-commented explaining WHY
• From real scenario
• Shows pattern clearly
• Ready to adapt (not generic template)

Don't:

• Implement in 5+ languages
• Create fill-in-the-blank templates
• Write contrived examples

You're good at porting - one great example is enough.

An example from a real scenario is not a real address

"From a real scenario" means the SHAPE is real, never that the values are. A skill ships to every install and to a public repo, so an address, MAC, hostname, user or path copied out of the machine you developed on is published with it - and it reads as authoritative, so readers paste it back. Substitute the reserved documentation values, which look real and name nothing:

Vendored upstream documentation keeps its own examples - rewriting them would make the copy disagree with its source. This rule is about values YOU add.

Write the skill and its artifacts in the present tense, not as a story

A skill says what is true now. A review artifact says what was verified. Neither is a session log, and the reader has neither your transcript nor your machine.

Keep out of both: what the operator instructed, permitted or changed their mind about; which tool or agent you reached for and when; scratch and temp paths; how the skill looked before this edit; who caught what. Keep in the artifact: the claim tested, how it was tested, and the outcome - a verbatim line of agent output earns its place when it IS the evidence, a paragraph of narrative around it does not.

The trap is that provenance feels like rigour while you are writing it, because it is what you just lived through. Test it by reading a line back and asking what a reader DOES differently knowing it. "The operator lifted a restriction mid-session" changes nothing for anyone; "a subagent on the old text wrote the call the library refuses" is the test result.

File Organization

Self-Contained Skill

defense-in-depth/
  SKILL.md    # Everything inline

When: All content fits, no heavy reference needed

Skill with Reusable Tool

condition-based-waiting/
  SKILL.md    # Overview + patterns
  example.ts  # Working helpers to adapt

When: Tool is reusable code, not just narrative

Skill with Heavy Reference

pptx/
  SKILL.md       # Overview + workflows
  pptxgenjs.md   # 600 lines API reference
  ooxml.md       # 500 lines XML structure
  scripts/       # Executable tools

When: Reference material too large for inline

Bundled scripts and hooks: keep them cross-platform

Any script you ship inside a skill or as a hook (a .sh, .py, .js, scripts in scripts/, or a hook command) runs on a user's machine that may be Windows. Author it so Windows does not silently break it:

• Write the logic in Python, not bash or jq. A script's or hook's real work belongs in a typed, testable language (Python with the standard library is the default); use bash only as a thin launcher shim. Bash/jq pipelines are hard to unit-test, behave differently across OSes, and are the usual source of silent Windows breakage.
• Line endings: LF only. Commit a .gitattributes that pins *.sh text eol=lf (and *.py/*.json for stable hashing). A CRLF .sh makes Git Bash on Windows fail with "cannot execute: required file not found" or $'\r': command not found, and a Stop/PreToolUse hook that exits cleanly on failure then disappears with no error.
• Force UTF-8 in launched interpreters. A non-UTF-8 Windows locale (e.g. German cp1252) corrupts IO. For Python set PYTHONUTF8=1 and PYTHONIOENCODING=utf-8 before exec; read/write files with explicit encoding="utf-8".
• Do not assume an interpreter name resolves. On Windows python3 is usually the Microsoft Store stub (exits non-zero in a subprocess), python may be Python 2, and py -3 is Windows-only. Launch Python through a small bash shim that probes python3 -> python -> py -3 and converts POSIX paths with cygpath when present. The plugin's hooks/run-python.sh is the working reference; reuse it.
• Git Bash only on Windows. Hooks run through Git Bash (Git for Windows), not WSL or Cygwin (those mount drives differently and resolve a Linux interpreter). Guard uname -s and skip loudly to stderr under an unexpected shell.
• A hook must never wedge a turn. Every failure path exits 0; degrade silently (with a one-line stderr note) rather than erroring.
• Set the executable bit in git, not the working tree. A file run directly (./script, or a hook invoked by path with a #! shebang) needs its exec bit recorded in git. A working-tree chmod +x does NOT persist when core.fileMode = false; set it in the index with git update-index --chmod=+x <file> and verify with git ls-files -s (mode 100755). Interpreter-run files with no shebang (a .py/.js run as python x.py) are never ./-run, so they stay 100644.
• Match signals to their source. A gate that scans transcript text for a trigger must run intent/correction patterns against the user role and self-admission patterns against the assistant role; matching both over concatenated text fires on ordinary assistant phrasing.
• Do real work in this preference order; drop a level only when the one above cannot do it:
  1. A modern, well-maintained library for the job. Consult the bitranox:coding-python-use-modern-libraries skill and use its pick (httpx2 for HTTP, orjson for JSON, rtoml for TOML, ruamel.yaml for YAML, and so on). Do not fall back to dated defaults (urllib/requests, stdlib json) when a clearly better library exists. Declare deps via uv so they land in an isolated, reproducible environment, never the user's system Python: a CLI tool via uvx <tool>, or a script with PEP-723 inline metadata run by uv run script.py (uv fetches the deps on run, no prompt).
     • Libraries on the bitranox:coding-python-use-modern-libraries list are pre-approved - use them and let uv fetch them; do NOT ask first.
     • For a library NOT on that list, first vet it: trustworthy (reputable maintainer or community, not a typo-squat), common (widely adopted), and modern (actively maintained, current releases). If it passes, propose adding it to the bitranox:coding-python-use-modern-libraries list so the curated set grows. Each new entry needs: a proper one-line description of what it is for, the older library/libraries it replaces, and why it is better. Then use it. If it fails vetting, prefer a curated alternative or stdlib. Either way surface the choice to the user (name it, say why, note it is new to the list).
     • uv itself is the one prerequisite: if it is not installed, STOP and ask permission to install it (explaining what for) rather than installing it silently.
  2. Standard library when no third-party library is warranted (small glue, no hot path, or the stdlib module is genuinely the best tool: pathlib, dataclasses, zoneinfo, re, subprocess). The goal is the best tool, not the most dependencies.
  3. An external command (last resort). Only when neither of the above fits. Shelling out is the least portable choice because the program and its flags differ per OS:
     • It must EXIST on every target OS. Windows usually has no grep, sed, awk, curl, jq, timeout, or make. Probe with shutil.which(prog) and fail with a clear message (or fall back to stdlib) instead of crashing with "file not found".
     • Its flags must be valid for THAT OS's build. The same tool name is often a different program with different options (GNU vs BSD/macOS sed/date/stat; the Windows port of a tool; PowerShell vs cmd.exe builtins). Do not assume a Linux flag works elsewhere; stick to the common documented subset or branch per platform.
     • Pass an argv list, never a shell string. Use subprocess.run([...]), not shell=True. A shell string (pipes, ||, $?, redirects, case) is POSIX-only, breaks under Windows cmd.exe, and is a command-injection risk. Decide success from the return code plus an output-file or output-text check in your own code, not shell glue. If you must accept a user-supplied command template, parse it once with shlex.split and substitute placeholders into the list elements (no shell).

Ship tests for every script (and they MUST pass)

A skill that bundles Python scripts MUST also ship a tests/ directory with pytest tests, and those tests MUST pass before the skill is considered done. This is not optional.

• Cover every important/main function - each script's public/main functions need a test with decent coverage (happy path plus the key edge cases), not just an import smoke test.
• Tests must pass. Run them (uv run --with pytest pytest tests/ or the project's runner) and confirm green. A skill with failing or missing tests does not ship.
• Test by behaviour with real inputs: build a tiny fixture project/data, run the function, assert on the actual output (e.g. the analyzer flags the planted case and skips the decorated/compiled one). Writing the tests routinely surfaces real bugs (argv ignored, order-sensitive regex, wrong thresholds) - fix the script, do not weaken the test.
• Keep scripts import-safe so they can be tested: all run-time work behind if __name__ == "__main__":, never at module top level (a script that executes on import cannot be unit-tested and will run side effects when imported).
• A bundled script must IMPORT in a BARE environment. The contribution gate (and any plain pytest) imports your test modules with the interpreter as-is - it does NOT provision a script's PEP 723 dependencies; only uv run <script> does. So a hard top-level import orjson collects fine under uv run yet fails the gate with ModuleNotFoundError on a clean runner. Guard every third-party import with a stdlib fallback (try: import orjson ... except ModuleNotFoundError: import json as ...) - keep the fast path, import anywhere. VERIFY in a fresh venv that has ONLY pytest, not your deps (uv venv x && uv pip install --python x pytest && x/bin/python -m pytest); your own machine having the dep installed is exactly what hides this until CI.
• A tests/conftest.py that puts the skill dir on sys.path lets tests import <script> by module name.

Universal rules vs. marketplace plumbing

Everything in this skill (CSO/description craft, structure, flowcharts, cross-platform scripts, tests, library choices) applies to any skill you author - a standalone skill for your own machine just as much as one you contribute to a marketplace. Follow it either way.

A skill you contribute to a specific plugin marketplace has EXTRA rules layered on top, and those are repo-specific, so they live in that repo's CONTRIBUTING.md (and CLAUDE.md), not here. Typically: a release/versioning policy, a contribution gate (pre-commit/CI check), an index or registry to update when you add a skill, and a git-history policy. Read that repo's CONTRIBUTING.md before contributing.

When you discover a NEW authoring rule: if it helps any skill author (a portability gotcha, a testing habit, a structural pattern), it belongs here in skill-writer; if it only matters for one repo's release machinery, it belongs in that repo's CONTRIBUTING.md.

Persisting durable state: use the curated store, not a hand-rolled backend

If the skill you author persists durable facts, learnings, preferences, or state across sessions, use the

…(truncated)