CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

plugin-audit

Comprehensive audit pipeline for skills, plugins, agents, and commands. Validates structure, quality, security, marketplace compliance, cross-platform compatibility, and ecosystem integration. Runs all built-in validation tools, invokes domain-appropriate agents for code review, and produces a pass/fail gate report. Usage: /plugin-audit <skill-path>

65

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a highly actionable, well-sequenced audit pipeline: every phase has an exact command, a numeric gate rule, and defined auto-fix/escalation behavior, and the final report template plus verdict logic make outcomes unambiguous. Its weaknesses are modest — the final report section restates gate rules already given per phase, and the single-file structure inlines detail that could live in one-level-deep reference files.

Suggestions

Deduplicate the Verdict Logic table and Blockers/Non-Blockers lists, which restate the per-phase gate rules; a compact pointer to the phase gates would save tokens.

Move the Phase 6 marketplace/plugin.json compliance details and the Phase 8 domain-to-agent review matrix into a references/ file, keeping SKILL.md as a lean overview with clearly signaled one-level-deep links.

Trim the decorative ASCII report box to a simpler markdown table or bullet template — the borders add tokens without adding information.

DimensionReasoningScore

Conciseness

The body is efficient and assumes Claude's competence — it does not explain what validation or auditing concepts are, and commands are given as exact one-liners (e.g. "python3 engineering/skills/skill-tester/scripts/skill_validator.py {skill_path} --tier {detected_tier} --json"). Minor trimming opportunities exist: the ASCII report block plus the duplicated Verdict Logic table and Blockers/Non-Blockers lists restate the same gate rules already given per phase, which keeps it at 'efficient; minor instances of over-explanation' rather than 'lean; every token earns its place'.

4 / 5

Actionability

Guidance is fully executable: every phase gives a copy-paste-ready command with exact paths and flags (skill_validator.py, quality_scorer.py, script_tester.py, skill_security_auditor.py, grep commands for index sync), concrete numeric thresholds ("Score must be ≥ 75", "≥ 60", "Zero CRITICAL findings"), and specific parse instructions for each tool's JSON output. This matches the 'fully executable; copy-paste ready code or commands' anchor.

5 / 5

Workflow Clarity

The 8 phases are clearly sequenced with explicit validation checkpoints and feedback loops: Phase 2's gate rule instructs "Auto-fix what's possible... Re-run after fixes. If still below 75, report as FAIL and continue", Phase 4-6 define blockers vs warnings, and the Final Report consolidates verdict logic. Despite being a batch operation over repository artifacts, validation is embedded at every phase, matching the top anchor ('clear sequence with explicit validation steps; feedback loops for error recovery').

5 / 5

Progressive Disclosure

The body is well structured: each phase is its own section with sub-phases (6a-6d, 7a-7d), and external materials are consolidated in a clearly signaled "Skill References" table pointing to the validator scripts and standards docs one level deep. No bundle files (references/, scripts/, assets/) ship with this skill, so it is judged as a single-file skill; it stays at 4 rather than 5 because ~300 lines of dense procedural detail (e.g. the full marketplace-compliance rules and the Phase 8 domain-to-agent table) is inlined where a one-level-deep reference file would keep SKILL.md as a leaner overview.

4 / 5

Total

18

/

20

Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong on specificity and trigger terms, clearly stating what the audit pipeline does in third person with concrete validation dimensions and outputs. Its main weakness is the absence of an explicit 'Use when...' trigger clause — the 'Usage:' line documents invocation syntax but not when Claude should reach for this skill — which caps completeness and slightly weakens its otherwise distinct niche.

Suggestions

Add an explicit trigger clause, e.g. "Use when the user asks to audit, validate, review, or gate-check a skill, plugin, agent, or command before merge/publish."

Include common user phrasings and synonyms ("audit", "validate", "review", "lint", "pre-publish check") to broaden natural trigger coverage.

Tighten the validation-dimension list ("structure, quality, security, marketplace compliance, cross-platform compatibility, and ecosystem integration") so it reads as a scannable trigger surface rather than an exhaustive inventory.

DimensionReasoningScore

Specificity

The description lists multiple specific concrete actions with comprehensive coverage: "Validates structure, quality, security, marketplace compliance, cross-platform compatibility, and ecosystem integration", "Runs all built-in validation tools, invokes domain-appropriate agents for code review, and produces a pass/fail gate report". It is written in third person ("Validates", "Runs", "produces") and matches the anchor for multiple specific concrete actions; it is not the level below (4) because there are no significant gaps in the action inventory.

5 / 5

Completeness

The 'what' is clear and concrete ("Comprehensive audit pipeline... produces a pass/fail gate report"), but the only 'when' guidance is "Usage: /plugin-audit <skill-path>", which is invocation syntax rather than an explicit 'Use when...' trigger clause. Per the rubric guideline, a missing 'Use when' clause caps completeness at 3 — the 'when' is only weakly implied.

3 / 5

Trigger Term Quality

Good keyword coverage of natural terms users would say: "audit", "skills", "plugins", "agents", "commands", "code review", "pass/fail". However common variations and synonyms such as "review my skill", "check", "lint", "publish", or file extensions are missing, so it fits the 'good coverage; a few natural terms missing' anchor rather than the comprehensive anchor at 5.

4 / 5

Distinctiveness Conflict Risk

"Comprehensive audit pipeline for skills, plugins, agents, and commands" carves a distinct audit/gate niche with clear triggers (audit, pass/fail gate report), but the breadth across "skills, plugins, agents, and commands" plus validation of "structure, quality, security" creates minor overlap risk with dedicated validator or security skills, matching the 'mostly distinct; minor overlap risk' anchor rather than the minimal-conflict anchor at 5.

4 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 2 missing

Warning

Total

14

/

16

Passed

Repository

alirezarezvani/claude-skills

Path

.gemini/skills/plugin-audit/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.