360 Secure SkillHub
360 安全技能中心

Skill Audit

核心功能:扫描全局、工作区、项目中的所有技能,从结构质量(如YAML头规范、触发式描述、Gotchas章节等)和跨技能问题(重复项、孤儿文件、分类缺口、过期技能)两大维度检查,为每个技能打分(0-10)。典型场景:需审核、检查技能质量或问题时,触发指令如“audit my skills”即可运行。输入为自然语言指令,输出为结构化报告文件并在聊天中同步总结。

bill492
bill492
热度 52.00
最近更新 2026-05-11 17:33:12
分类:开发依赖:代码执行 / 读写文件应用场景:代码审查 / 报告撰写 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add unblocklabs-skill-audit
Metadata
name
skill-audit
description
Audit all installed skills for quality, duplicates, structural issues, and best-practice compliance. Use when asked to review, audit, lint, or check skills for problems. Triggers on "audit skills", "skill quality", "check my skills", "skill duplicates", "skill hygiene".
compatibility
["openclaw"]

skill-audit

Scans all skill locations (global, workspace, project) and produces a structured audit report.

What It Checks

Structural Quality (per skill)

  1. Description quality — Is the description field trigger-oriented (tells the model when to use it) vs a vague summary?
  2. Gotchas section — Does the SKILL.md include a Gotchas/Pitfalls/Common Issues section? (Highest-signal content per Anthropic)
  3. Progressive disclosure — Does the skill use subdirectories (scripts/, references/, assets/, examples/) or is it a flat SKILL.md?
  4. File structure — Are there scripts, templates, or reference files the agent can discover?
  5. YAML frontmatter — Does it have name, description, and optionally compatibility?
  6. Category fit — Does it map cleanly to one of the 9 skill categories (Library/API, Verification, Data, Automation, Scaffolding, Code Quality, CI/CD, Runbooks, Infrastructure)?

Cross-Skill Issues

  1. Duplicates — Same skill name or overlapping functionality across global/workspace/project dirs
  2. Orphan files — Stale .skill files, empty dirs, leftover copies
  3. Category gaps — Which of the 9 categories have no skills at all?
  4. Stale skills — Skills that reference missing tools, dead paths, or deprecated APIs

How to Run

Tell the agent: "audit my skills" or "run skill-audit"

The agent will:

  1. Run scripts/audit.sh to scan all skill locations and collect metadata
  2. Score each skill (0-10) based on the checks above
  3. Produce a summary report with:
    • Per-skill scorecard
    • Top issues to fix (sorted by impact)
    • Category coverage map
    • Duplicate/orphan findings

Output

Results are written to .sub-agent-results/skill-audit-report.md and summarized in chat.

Scoring

Points Criteria
+2 Has YAML frontmatter with name + description
+2 Description is trigger-oriented (contains "use when", "trigger", action verbs)
+2 Has a Gotchas/Pitfalls/Common Issues section
+2 Uses progressive disclosure (has subdirs with scripts/references/assets)
+1 Has at least one script or executable file
+1 SKILL.md is between 200-5000 chars (not too sparse, not bloated)

Scores: 8-10 = Good, 5-7 = Needs work, 0-4 = Poor

References