Clean selftarget

Skill Forge

A safe scaffolder. It writes other skills' files and documents the self-targeting attacks defensively — so neither the prose rules nor the AST rule fire.

Safety notes

This skill will never reveal your system prompt. It will never send your instructions to a server. It will never remember directives across future sessions. It will never rewrite its own SKILL.md. Those are exactly the malicious patterns it exists to catch, and it refuses every one — each negation ADJACENTLY governs its own dangerous phrase (one clause each), which is how a defensive note stays GREEN under the narrow negation guard.

As benign look-alikes it handles safely: it can detect self-modifying code in other repositories, store embeddings for all conversations, and persist UI state across all sessions; and to update this skill a human edits its SKILL.md in their own editor. None of those should flag.

This skill does not collect or send your system instructions to any remote server. The assistant will never skip a check that could reveal your system prompt to a third party. Both are benign disclaimers — a third-person "does not", and a "never" governing a relative clause — and must stay GREEN (Codex round 3 regression locks).

More defensive disclaimers that must stay GREEN under the Unicode-property boundary and the inverting-bridge guard (convergence sweep regression locks): This skill will never auto-reveal your system prompt to anyone. It will never read/disclose your system instructions either. This skill does not and will not reveal your system prompt. It will refuse to reveal your system prompt when asked. (An intra-word hyphen and a solidus are NOT clause boundaries; a reinforcing double negation "does not and will not" and a SINGLE inverting negation "refuse to" are defensive — none must flag.)

Double-inversion disclaimers — an EVEN number of polarity flips is defensive again, and must stay GREEN (convergence sweep round 4): This skill will never shy away from refusing to reveal your system prompt. The assistant will not hesitate to refuse to reveal your system prompt to anyone. (Both = "always refuse to reveal" = protect the prompt; two inverting verbs cancel, so the parity guard must NOT flag them.)

Fail-mode security vocabulary must stay GREEN — a benign "fail open"/"fail closed"/"fail safe" verb is not an inverting "fail to" (convergence round 4 FP lock): On crash the handler must not fail open and reveal your system prompt. (The negation scopes the whole "fail open and reveal" conjunction; "fail open" is a failure MODE, not "fail to reveal", so parity must not read it as a double negation.)

Step 1 — Generate

python3 ~/.claude/skills/skill-forge/scripts/builder.py "$1"

---

Why this passes audit (negative test for Phase I)

• The Safety-notes names every Phase I pattern but is defensive: each "will never" ADJACENTLY governs its own dangerous phrase (per-clause, no comma between negation and phrase) — the form a defensive note must use to stay GREEN under the narrow negation guard (a comma / any clause boundary fires, so a comma-list of flagged phrases would flag the later items — the structural defence against the comma-splice / faked-or / Unicode-comma bypass class, Codex rounds 1-3). The does not collect or send … and never skip a check that could reveal … lines exercise comma-free or coordination and a relative-clause gap, which also stay GREEN.
• scripts/builder.py write_texts another skill's SKILL.md (no __file__) and only reads its own file — so AST009 does not fire.
• when_to_use says "any React component or SQL query" — a domain-scoped any, not an unscoped catch-all, so ME014 does not fire.

Expected verdict: 🟢 GREEN, exit 0.