New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Goal Prompt Writer

by trailofbits in trailofbits/skills

Drafts a single-line /goal command for Claude Code or Codex goal mode, built around a checkable end state, a stated verification command and a stop condition.

OfficialCC-BY-SA-4.0Auto-check: notesAgent Workflows

Install Goal Prompt Writer

skills CLI
$ npx skills add trailofbits/skills --skill goal-prompt -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trailofbits/skills goal-prompt --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/goal-prompt/skills/goal-prompt .claude/skills/goal-prompt && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
goal-prompt
GitHub stars
7.4k
Token cost
~1.5k tokens
SKILL.md length
819 words
Files
4 (incl. scripts)
Skills in repo
79
Repo updated
First seen
Licence
CC-BY-SA-4.0

At a glance

Drafts a single-line /goal command for Claude Code or Codex goal mode, built around a checkable end state, a stated verification command and a stop condition.

  • Works in 5 steps: End state, not activity — "all… → Scope to read first — the files, issue,… → Stated check — the exact command and its… → …
  • Writing a /goal command for a long-running refactor or migration
  • SKILL.md covers Draft, Close the easy-outs, Security research goals and Format, plus 1 more section
  • Runs Python scripts from its folder; calls npm, uv and make

What it does

Goal mode keeps an agent working until a completion condition holds, and in Claude Code a small model re-judges that condition after each turn from the transcript alone. The skill drafts conditions that can actually terminate: an end state rather than an activity, the files or logs to read first, an exact check command whose output must be shown, invariants that forbid weakening the checks, and a stop bound or blocked clause. The parts are joined with AND, never or.

It keeps goals small, never invents missing elements and flags anything it could not fill from your request or the repository. Because the line is capped at 4,000 characters, long briefs go into a GOAL.md that the objective references, and long goals also get a progress log file. A bundled Python formatter script, with its own test file, produces the final copy-ready line and warns when no stop bound is present.

When your agent uses it

  • Writing a /goal command for a long-running refactor or migration
  • Rewriting a vague goal so it has a checkable finish line
  • Compressing a long goal brief to fit the one-line limit
  • Adding a stop bound so a goal cannot loop forever

Example prompts

  • “Write a /goal for moving every legacyAuth() call site to auth.verify(), finishing when npm test passes.”
  • “Tighten this goal prompt and add a clause for when the agent is blocked.”
  • “Turn my notes in ./notes/refactor.md into a goal that fits the single-line limit.”

Requirements

  • Python, to run the bundled formatter script
  • Pre-approved tools (allowed-tools): Bash, Read, Write

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. End state, not activity — "all legacyAuth() call sites use auth.verify()", not "migrate the auth code". An activity can be claimed; an end…
  2. Scope to read first — the files, issue, logs, or plan to read before acting.
  3. Stated check — the exact command and its observable result ("npm test exits 0"), plus an instruction to run it and show the output; a…
  4. Invariants — what must not change ("without modifying vendor/"), always including "do not weaken, skip, or edit the checks themselves".
  5. Stop bound or blocked clause — "or stop after 20 turns", "if blocked, stop and report the blocker". Without one, a mis-stated condition…

What it can do on your machine

Read from SKILL.md and the folder at commit 82fe822. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Read
    • Write

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • npm
    • uv
    • make

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm and uv, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Goal Prompt Writer loads about 1.5k tokens when it runs. Until then it costs about 73 tokens; SKILL.md has 819 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~73
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Read, Write

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from trailofbits/skills at commit 82fe822, republished under its CC-BY-SA-4.0 licence (© trailofbits). 819 words, ~1,531 tokens.

Download SKILL.mdSave it as .claude/skills/goal-prompt/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
goal-prompt
description
Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex. Use when the user asks to create, write, rewrite, improve, compress, clean up, or prepare a goal prompt, goal condition, /goal command, goal-mode objective, or copy-ready long-running task objective.
allowed-tools
Bash, Read, Write

Goal Prompt

/goal keeps the agent working until a completion condition is met. Both Claude Code and Codex take it as one line, max 4,000 characters. In Claude Code a small model re-judges the condition after each turn from the transcript alone — it cannot run commands.

Draft a condition that can terminate, then format it. A goal fits work bigger than one turn with a checkable finish line; chain small goals with review between them rather than writing one giant goal.

Draft

Include, joined with AND — never "or", the loop takes the cheaper branch:

  1. End state, not activity — "all legacyAuth() call sites use auth.verify()", not "migrate the auth code". An activity can be claimed; an end state is true or false.
  2. Scope to read first — the files, issue, logs, or plan to read before acting.
  3. Stated check — the exact command and its observable result ("npm test exits 0"), plus an instruction to run it and show the output; a result that never lands in the transcript does not exist to the evaluator.
  4. Invariants — what must not change ("without modifying vendor/"), always including "do not weaken, skip, or edit the checks themselves".
  5. Stop bound or blocked clause — "or stop after 20 turns", "if blocked, stop and report the blocker". Without one, a mis-stated condition loops forever; the formatter warns when it is missing. (Claude Code resets the turn counter on session resume, so a turn bound silently extends across resumes.)

Keep it small. Every constraint narrows the state space the model can explore. Collapse to one terminating criterion when possible, move scope and definitions into a referenced file, and drop non-goals — a constraint earns its place only by closing a real easy-out.

For long goals, also name the final evidence (diff, report, artifact) and require a progress log file — durable state across compaction and resume. If the brief exceeds 4,000 characters, put the details in a GOAL.md and reference that file from the objective.

Never invent missing elements. Ground every element in the user's request, the conversation, or the repository — look things up rather than guessing. If an element cannot be filled from available information, still optimize and format what the user provided, leave the element out, and flag it as missing (see Format). A goal with an invented success condition terminates on the wrong contract.

Close the easy-outs

Before formatting, reread the drafted condition as a lazy model would: what is the cheapest way to make every check pass without doing the intended work? Close the cheapest ones — prefer pairing checks you already have over adding constraints, and do not enumerate every conceivable out into a non-goal list. The recurring outs:

  • Delete or stub instead of fix — "search prints nothing" also holds when the callers are gone; pair such checks with one that proves the feature still works.
  • Pass on a subset — running one test file, narrowing the search path, excluding directories from the check.
  • Game the gate — skipping/xfail-ing tests, hardcoding expected outputs, special-casing the test inputs, editing the check (the invariants rule).
  • Claim without running — declaring done or blocked with no check output in the transcript (the show-the-output rule).

Same discipline as above: an out you cannot close from available information goes in the Missing: list as a warning — an invented or absurd constraint is worse than a flagged gap.

Show full SKILL.md (263 more words)Show less

Security research goals

Collapse audit goals to one terminating criterion, such as identifying, triggering, and validating one high-severity vulnerability valid under a referenced threat-model file. That file, not the goal, carries scope, attacker powers, severity baseline, and known findings to skip. Use neutral wording ("trigger and validate", not "prove this is exploitable"), require demonstrated preconditions — assumed attacker access is the most common false positive — and stop for human review after each finding rather than piling up untriaged reports. Validate findings with a second pass by a fresh agent, never the finder alone.

Format

Run uv run --no-project {baseDir}/scripts/format_goal_prompt.py --fenced on the draft (file or stdin). It collapses whitespace to one line, strips /goal prefixes, quotes, and fences, warns on a missing stop clause, and rejects output over 4,000 characters — shorten or move detail to a file and rerun.

Return exactly one fenced text block, one line:

text
/goal <single normalized objective>

Add no prose around it — except when checklist elements could not be grounded: then follow the block with a Missing: list, one line per gap, telling the user what to supply.

Example

Draft:

/goal Migrate the auth module:
  - replace legacyAuth() with auth.verify()
  - make sure the tests still work

Redrafted and formatted:

text
/goal All legacyAuth() call sites use auth.verify(): `rg "legacyAuth\(" -t ts` prints nothing AND `npm test` exits 0 (run both, show the output), without modifying vendor/ or weakening any test. If blocked, stop and report attempted paths and the blocker, or stop after 20 turns.

Here npm test came from the repo's package.json — not a guess — and pairing it with the zero-matches check closes the cheapest out: deleting the call sites instead of migrating them. When nothing grounds an element, format what exists and flag the gaps:

Draft: make checkout faster, with no metric or benchmark anywhere in context:

text
/goal Make checkout faster

Missing:

  • measurable end state — which metric and threshold count as "faster"
  • verification — the benchmark or command that proves it
  • stop bound — e.g. "or stop after 20 turns"

© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts) in plugins/goal-prompt/skills/goal-prompt of trailofbits/skills.

  • SKILL.md
  • agents/openai.yaml
  • scripts/format_goal_prompt.py
  • scripts/test_format_goal_prompt.py

Open the folder on GitHubat commit 82fe822

Compare with similar skills

Goal Prompt Writer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Goal Prompt Writer compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Goal Prompt Writer this skilltrailofbits/skills7.4k—~1.5kAutomated safety check: NotesCC-BY-SA-4.0
Agents Best PracticesDenisSergeevitch/agents-best-practices2.4k—~7.4kAutomated safety check: PassMIT
Claude Code Agent Developmentanthropics/claude-plugins-official38k7 repos~2.8kAutomated safety check: PassApache-2.0
Show Me Your Work Decision Logcursor/plugins10k8 repos~1.6kAutomated safety check: PassNone
Autoresearch Iteration Loopuditgoenka/autoresearch6.5k1 repos~2kAutomated safety check: PassMIT
Install Loop Engineeringcobusgreyling/loop-engineering11k1 repos~648Automated safety check: PassMIT

Similar skills

  • Agents Best Practices

    DenisSergeevitch/agents-best-practices

    A skill your agent uses when designing, generating an MVP blueprint for, auditing, troubleshooting, refactoring, or explaining an agentic harness for any domain.

    2.4k GitHub stars~7.4k tokensUpdated 4 days ago
    AI & LLM EngineeringAuto-check passed

  • Claude Code Agent Development

    anthropics/claude-plugins-official

    Official

    Explains how to write agents for Claude Code plugins: the markdown file with YAML frontmatter, trigger descriptions, model and color settings, and system prompt design.

    38k GitHub starsUsed in 7 repos~2.8k tokens
    Agent WorkflowsAuto-check passed

  • Show Me Your Work Decision Log

    cursor/plugins

    Official

    Keeps a TSV decision log for long or unattended agent runs, one row per decision with what, why, evidence and result, so a reviewer can check the work later.

    10k GitHub starsUsed in 8 repos~1.6k tokens
    Agent WorkflowsAuto-check passed

  • Autoresearch Iteration Loop

    uditgoenka/autoresearch

    Runs an autonomous modify, verify, keep-or-discard loop against any metric, with subcommands for planning, debugging, fixing, security audits, shipping and more.

    6.5k GitHub starsUsed in 1 repo~2k tokens
    Agent WorkflowsAuto-check passed

  • Install Loop Engineering

    cobusgreyling/loop-engineering

    Installs Loop Engineering into a project through the single @cobusgreyling/loop CLI, scaffolding a report-only loop and a readiness score.

    11k GitHub starsUsed in 1 repo~648 tokens
    Agent WorkflowsAuto-check passed

  • Loopy

    Forward-Future/loopy

    Discover, find, compare, audit, repair, adapt, craft, run, debrief, save, and prepare repeatable AI-agent loops for publication.

    3.2k GitHub stars~3.9k tokensUpdated 28 days ago
    Agent WorkflowsAuto-check passed

More from trailofbits/skills

All 79 skills in this repo

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated yesterday
    Auto-check: notes

  • Code Graph Mermaid Diagrams

    trailofbits/skills

    Official

    Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.

    7.4k GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

  • Trailmark Graph Evolution

    trailofbits/skills

    Official

    Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

    7.4k GitHub stars~3.4k tokensUpdated yesterday
    Auto-check passed

  • Let Fate Decide

    trailofbits/skills

    Official

    Draws a 12 Houses tarot spread to break ties when a request is vague or casually delegated, then reads the cards to pick the next step.

    7.4k GitHub stars~2.5k tokensUpdated yesterday
    Auto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    Auto-check: notes

  • Burp Suite Project Parser

    trailofbits/skills

    Official

    Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.

    7.4k GitHub starsUsed in 3 repos~4.2k tokens
    Auto-check: notes

Categories

Questions about Goal Prompt Writer

What does Goal Prompt Writer do?

Drafts a single-line /goal command for Claude Code or Codex goal mode, built around a checkable end state, a stated verification command and a stop condition. Goal mode keeps an agent working until a completion condition holds, and in Claude Code a small model re-judges that condition after each turn from the transcript alone. The skill drafts conditions that can actually terminate: an end state rather than an activity, the files or logs to read first, an exact check command whose output must be shown, invariants that forbid weakening the checks, and a stop bound or blocked clause.

When should I use Goal Prompt Writer?

Goal Prompt Writer fits situations like: writing a /goal command for a long-running refactor or migration; rewriting a vague goal so it has a checkable finish line; compressing a long goal brief to fit the one-line limit; adding a stop bound so a goal cannot loop forever.

How do I install Goal Prompt Writer in Claude Code?

Run `npx skills add trailofbits/skills --skill goal-prompt -a claude-code`. Or copy the skill folder (plugins/goal-prompt/skills/goal-prompt in trailofbits/skills) into .claude/skills/goal-prompt in your project. Claude Code loads it when a task matches its description.

How do I install Goal Prompt Writer in Codex?

Run `npx skills add trailofbits/skills --skill goal-prompt -a codex`. Or copy the skill folder (plugins/goal-prompt/skills/goal-prompt in trailofbits/skills) into .agents/skills/goal-prompt in your project. Codex loads it when a task matches its description.

Can I use Goal Prompt Writer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills --skill goal-prompt -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/goal-prompt, .gemini/skills/goal-prompt, .github/skills/goal-prompt and .opencode/skills/goal-prompt in your project.

What does Goal Prompt Writer need to run?

Going by SKILL.md and its folder, Goal Prompt Writer needs Python for the scripts in its folder and the command-line tools its instructions call (npm, uv and make). Our summary lists: Python, to run the bundled formatter script. Its frontmatter pre-approves these tools: Bash, Read, Write.

Does Goal Prompt Writer access the network?

SKILL.md contains no URLs. Its commands use npm and uv, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Goal Prompt Writer safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Goal Prompt Writer use?

Goal Prompt Writer is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Goal Prompt Writer use?

About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Goal Prompt Writer?

Skills that share tags, products or a category with Goal Prompt Writer: Agents Best Practices (DenisSergeevitch/agents-best-practices, 2.4k stars), Claude Code Agent Development (anthropics/claude-plugins-official, 38k stars), Show Me Your Work Decision Log (cursor/plugins, 10k stars) and Autoresearch Iteration Loop (uditgoenka/autoresearch, 6.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Goal Prompt Writer?

trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills, which has 7,440 GitHub stars. The repository holds 79 skills in this directory. The repository was last updated on October 7, 2026.

Source: trailofbits/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.