技能审计
skill-audit
by bill492
Audit all installed skills for quality, duplicates, structural issues, and best-practice compliance. Use when asked to review, audit, lint, or check skills for problems. Triggers on "audit skills", "skill quality", "check my skills", "skill duplicates", "skill hygiene".
安装
claude skill add --url github.com/openclaw/skills/tree/main/skills/bill492/unblocklabs-skill-audit文档
skill-audit
Scans all skill locations (global, workspace, project) and produces a structured audit report.
What It Checks
Structural Quality (per skill)
- Description quality — Is the
descriptionfield trigger-oriented (tells the model when to use it) vs a vague summary? - Gotchas section — Does the SKILL.md include a Gotchas/Pitfalls/Common Issues section? (Highest-signal content per Anthropic)
- Progressive disclosure — Does the skill use subdirectories (scripts/, references/, assets/, examples/) or is it a flat SKILL.md?
- File structure — Are there scripts, templates, or reference files the agent can discover?
- YAML frontmatter — Does it have
name,description, and optionallycompatibility? - Category fit — Does it map cleanly to one of the 9 skill categories (Library/API, Verification, Data, Automation, Scaffolding, Code Quality, CI/CD, Runbooks, Infrastructure)?
Cross-Skill Issues
- Duplicates — Same skill name or overlapping functionality across global/workspace/project dirs
- Orphan files — Stale
.skillfiles, empty dirs, leftover copies - Category gaps — Which of the 9 categories have no skills at all?
- Stale skills — Skills that reference missing tools, dead paths, or deprecated APIs
How to Run
Tell the agent: "audit my skills" or "run skill-audit"
The agent will:
- Run
scripts/audit.shto scan all skill locations and collect metadata - Score each skill (0-10) based on the checks above
- Produce a summary report with:
- Per-skill scorecard
- Top issues to fix (sorted by impact)
- Category coverage map
- Duplicate/orphan findings
Output
Results are written to .sub-agent-results/skill-audit-report.md and summarized in chat.
Scoring
| Points | Criteria |
|---|---|
| +2 | Has YAML frontmatter with name + description |
| +2 | Description is trigger-oriented (contains "use when", "trigger", action verbs) |
| +2 | Has a Gotchas/Pitfalls/Common Issues section |
| +2 | Uses progressive disclosure (has subdirs with scripts/references/assets) |
| +1 | Has at least one script or executable file |
| +1 | SKILL.md is between 200-5000 chars (not too sparse, not bloated) |
Scores: 8-10 = Good, 5-7 = Needs work, 0-4 = Poor
References
- Anthropic: Lessons from Building Claude Code Skills — Thariq's 9 categories, gotchas sections, progressive disclosure
- Ole Lehmann: Auto-improve Skills — Autoresearch loop (future enhance mode)
相关 Skills
安全专家
by alirezarezvani
覆盖威胁建模、漏洞评估、安全架构设计、代码审计与渗透测试,内置 STRIDE、OWASP、加密模式和安全扫描流程,适合系统设计评审与上线前安全排查。
✎ 安全专家把威胁建模、漏洞分析到渗透测试串成一套流程,内置 STRIDE 与 OWASP 指南,做安全设计和排查更省心。
安全运营
by alirezarezvani
覆盖应用安全、漏洞管理与合规审计,支持代码/依赖扫描、CVE 评估、Secrets 检测和安全自动化,适合做安全基线落地、漏洞响应、审计检查与安全开发治理。
✎ 应用安全、漏洞管理和合规检查一套打通,还能自动化扫描与响应,帮团队更早发现并收敛风险。
安全审计
by alirezarezvani
安装前审计 Claude Code Skill 的代码执行、Prompt 注入和依赖供应链风险,支持本地目录或 Git 仓库扫描,输出 PASS/WARN/FAIL 结论及修复建议
✎ 把代码审查、漏洞扫描和合规检查串成一条线,帮团队更早发现风险,做安全治理更省心。
相关 MCP 服务
by Sentry
搜索和分析 Sentry 错误报告,辅助调试。
✎ 把零散的 Sentry 错误报告变成可检索线索,帮你在海量报错里更快定位线上故障,排障调试明显省时。
by sinewaveai
为 AI agents 提供安全层:拦截 prompt injection、识别伪造 packages,并扫描漏洞风险。
✎ 给 AI Agent 补上关键安全层,能拦截 prompt 注入、识别伪造包并扫描漏洞风险,把防护前置更省心。
by pantheon-security
强化安全性的 NotebookLM MCP,集成 post-quantum encryption,提升数据防护能力。