Skills Explorer Add Skills

scaffold-exercises

An agent skill by mattpocock, from mattpocock/skills. Tags: documentation, education, setup, templates, workflow.

What it does

Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add mattpocock/skills --skill scaffold-exercises

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/misc/scaffold-exercises ~/.claude/skills/scaffold-exercises

Safety box score

Grade B, low risk: 14 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill scaffolds exercise folders and stub README files inside a repository, then validates them with a project-local lint command and commits the result. The main risks are local command execution and automatic git history changes; it does not appear to reach the network, secrets, or system-wide settings.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It explicitly runs shell commands and a local CLI: `mkdir -p`, `git mv`, `pnpm ai-hero-cli internal lint`, and `git commit`.
Network access0 (none)No file downloads, uploads, or remote API calls are described in the skill.
Filesystem reach1 (low)All writes are scoped to repository paths under `exercises/`, creating and renaming exercise directories and `readme.md` files.
Secrets & credentials0 (none)The skill does not read or request tokens, keys, passwords, `.env` files, or browser/CLI sessions.
Privilege & persistence0 (none)There is no sudo, global install, service registration, shell profile editing, or other privilege-changing step.
Instruction hijack surface0 (none)The files do not tell the agent to ignore instructions, hide actions, or follow remote content.
Irreversible actions1 (low)It instructs the agent to finish by running `git commit`, which mutates repository history automatically, but it does not push or deploy.
Transparency0 (none)The skill contents are plain markdown and YAML; there are no binaries, installers, or decoded-at-runtime blobs.

Before installing

Rated 2026-10-16 by an automated review of 2 files from the skill's repository.

Source

Repository
mattpocock/skills (all skills from this repository)
Path
skills/misc/scaffold-exercises/SKILL.md
Branch
main
Updated
2026-10-05