360 Secure SkillHub
360 安全技能中心

Skill Audit

该 Skill 通过执行脚本扫描全局、工作区与项目中的已安装 Skill,检查描述质量、Gotchas 章节、渐进式披露、目录结构、YAML frontmatter 与类别匹配,并做跨 Skill 的重复、孤儿文件、类别缺口与失效引用排查,最后按 0-10 分打分并输出审计报告。

bill492
bill492
热度 51.84
最近更新 2026-05-11 17:33:12
分类:开发依赖:代码执行 / 读写文件 / 内部调用大模型应用场景:代码审查 / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add unblocklabs-skill-audit
Metadata
name
skill-audit
description
Audit all installed skills for quality, duplicates, structural issues, and best-practice compliance. Use when asked to review, audit, lint, or check skills for problems. Triggers on "audit skills", "skill quality", "check my skills", "skill duplicates", "skill hygiene".
compatibility
["openclaw"]

skill-audit

Scans all skill locations (global, workspace, project) and produces a structured audit report.

What It Checks

Structural Quality (per skill)

  1. Description quality — Is the description field trigger-oriented (tells the model when to use it) vs a vague summary?
  2. Gotchas section — Does the SKILL.md include a Gotchas/Pitfalls/Common Issues section? (Highest-signal content per Anthropic)
  3. Progressive disclosure — Does the skill use subdirectories (scripts/, references/, assets/, examples/) or is it a flat SKILL.md?
  4. File structure — Are there scripts, templates, or reference files the agent can discover?
  5. YAML frontmatter — Does it have name, description, and optionally compatibility?
  6. Category fit — Does it map cleanly to one of the 9 skill categories (Library/API, Verification, Data, Automation, Scaffolding, Code Quality, CI/CD, Runbooks, Infrastructure)?

Cross-Skill Issues

  1. Duplicates — Same skill name or overlapping functionality across global/workspace/project dirs
  2. Orphan files — Stale .skill files, empty dirs, leftover copies
  3. Category gaps — Which of the 9 categories have no skills at all?
  4. Stale skills — Skills that reference missing tools, dead paths, or deprecated APIs

How to Run

Tell the agent: "audit my skills" or "run skill-audit"

The agent will:

  1. Run scripts/audit.sh to scan all skill locations and collect metadata
  2. Score each skill (0-10) based on the checks above
  3. Produce a summary report with:
    • Per-skill scorecard
    • Top issues to fix (sorted by impact)
    • Category coverage map
    • Duplicate/orphan findings

Output

Results are written to .sub-agent-results/skill-audit-report.md and summarized in chat.

Scoring

Points Criteria
+2 Has YAML frontmatter with name + description
+2 Description is trigger-oriented (contains "use when", "trigger", action verbs)
+2 Has a Gotchas/Pitfalls/Common Issues section
+2 Uses progressive disclosure (has subdirs with scripts/references/assets)
+1 Has at least one script or executable file
+1 SKILL.md is between 200-5000 chars (not too sparse, not bloated)

Scores: 8-10 = Good, 5-7 = Needs work, 0-4 = Poor

References