skill-scorer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-scorer (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
一个"评测 Skill 的 Skill"。接收任意 Agent Skill 的源文件，必须依据本仓库的官方评分入口和 rubric/rubric.yaml 给出 5 大支柱的 100 分制评分、等级、证据引用与改进建议。Rubric 内置三类型差异化（atomic / pipeline / composite），子维度数随 skill 结构自动启用，由 applies_to 字段控制。同时兼容 Cursor / Claude / OpenClaw 三套规范。
SKILL.md / skill 文件夹 / .zip / GitHub URL，并请求评分、审计或改进建议。如果你是 Cursor、WorkBuddy、Hermes、小龙虾或类似 code agent，先读 USAGE.md。
推荐先运行 CLI 向导，让用户选择通用评测或金融专家版；如果选择金融专家版，向导会继续确认金融子场景，并输出后续官方命令：
python3 skills/skill-scorer/scripts/score.py --agent-wizard <path-to-skill-zip-dir-or-SKILL.md>规则分预览：
python3 skills/skill-scorer/scripts/score.py <path-to-skill-zip-dir-or-SKILL.md>完整 agent-side Deep Review（使用 code agent 自己的模型套餐，不消耗 SkillLens 服务端 key）：
python3 skills/skill-scorer/scripts/score.py --agent-prompt <path-to-skill-zip-dir-or-SKILL.md> > agent-deep-review-prompt.md
# 将 agent-deep-review-prompt.md 完整交给当前 code agent 的模型，保存严格 JSON 为 agent-llm-results.json
python3 skills/skill-scorer/scripts/score.py --llm-results agent-llm-results.json <path-to-skill-zip-dir-or-SKILL.md>不得临时生成自定义评分脚本替代官方 CLI；最终分数必须来自最后一步官方 CLI 输出。
金融专家版（可选）应优先通过 --agent-wizard 选择；手动执行时，必须在 --agent-prompt 和 --llm-results 两步都加入相同的 --domain finance --scenario <scenario-id>。支持的场景详见 USAGE.md。
SKILL.md 文本，或scripts/ references/ assets/ 等），或.zip 打包的 skill，或{
"spec": "claude | openclaw",
"language": "zh | en",
"score": 0-100,
"grade": "S | A | B | C | D",
"pillars": [
{
"id": "business_value",
"score": 0-25,
"dimensions": [
{
"id": "...",
"checks": [
{
"id": "...",
"status": "pass|partial|fail|n_a",
"evidence": "<primary-language alias>",
"evidence_zh": "中文现状",
"evidence_en": "English diagnosis",
"fix": "<primary-language alias>",
"fix_zh": "中文改法",
"fix_en": "English fix"
}
]
}
]
}
],
"bonus": 0-5,
"suggestions": [
{
"title": "Top 改进项",
"title_zh": "中文 Top 改进项",
"title_en": "English Top Improvement",
"why": "现状",
"why_zh": "中文现状",
"why_en": "English why",
"how": "改法",
"how_zh": "中文改法",
"how_en": "English how"
}
],
"deepReviewCertificate": {
"status": "verified"
}
}evidence_zh + evidence_en (and fix_zh + fix_en, why_zh + why_en, how_zh + how_en, title_zh + title_en) are the canonical bilingual fields ≥ engineVersion 0.4.1. The unsuffixed evidence / fix / why / how / title are preserved as back-compat aliases pointing at the primary language so older readers keep working. The HTML report's ZH/EN toggle uses the suffixed fields to switch body content; falls back to the bare field when the JSON predates the bilingual schema.
skills/skill-scorer/rubric/rubric.yaml 的 SkillLens 仓库根目录。 python3 skills/skill-scorer/scripts/score.py <path-to-skill-zip-dir-or-SKILL.md>--agent-wizard。如手动执行，必须确认是否启用领域专家版；当前 MVP 支持 finance，并必须确认具体 --scenario。--agent-prompt 生成官方提示词，用当前 code agent 的模型返回严格 JSON，再运行 --llm-results 合并。领域专家版必须在两步命令都带上相同的 --domain / --scenario。deepReviewCertificate.status="verified"；金融专家版还必须包含 domainExpert 和 deepReviewCertificate.domain；没有证书只能称为规则分预览或非官方结果。evidence_zh + evidence_en, fix_zh + fix_en, why_zh + why_en, how_zh + how_en）渲染报告；Top 改进项必须来自 JSON 的 suggestions，旧版单语 JSON 可回退到 evidence / fix / why / how。skills/skill-scorer/scripts/score.py for local tool use, or call the deployed SkillLens Web/API endpoint when the user explicitly提供该服务地址。--agent-wizard for agent-side Deep Review so the user explicitly chooses general vs. finance expert review.--agent-prompt → model JSON → --llm-results flow for agent-side Deep Review.--domain finance --scenario <scenario-id> in prompt generation and merge.python3 <<'PYEOF' ... scoring script to replace the official scorer.deepReviewCertificate.status is exactly verified.llmComplete=false / llmCoverage in the rendered report. If LLM checks are skipped, say so clearly.source: official SkillLens CLI or source: SkillLens Web Deep Review.rubric/rubric.yaml as read-only scoring data. Do not alter weights, thresholds, or pass/partial/fail mapping during evaluation.type: llm 的细则，不得覆盖或改写规则分结果。rubric/rubric.yaml — 评分细则（Web 端与 CLI 共用的单一事实源）domains/finance/rubric.yaml — 金融专家版评分细则（通用分之外的附加专家报告）scripts/score.py — 官方本地 CLI 打分脚本（规则分预览；不会伪造 LLM Deep Review）USAGE.md — 给 Cursor / WorkBuddy / Hermes / 小龙虾等 code agent 的官方调用契约references/best-practices.md — Skill 写作最佳实践（供 LLM few-shot 与人类阅读）Render the official JSON into a concise report. Do not use a fixed sample score. Use this shape:
# SkillLens Report
source: official SkillLens CLI | SkillLens Web Deep Review
mode: rule-only preview | full deep review
llmComplete: true | false
**Total**: <score from JSON> / 100 · **Grade**: <grade from JSON>
## Pillars
| Pillar | Score | LLM coverage |
|---|---:|---:|
| <pillar.name_zh/name_en> | <pillar.score>/<pillar.weight> | <evaluated>/<total> |
## Top Improvements
1. <suggestion.title from JSON>
- 现状/Why: <suggestion.why>
- 改法/How: <suggestion.how>If the CLI output says llmComplete=false, explicitly call the result a rule-only preview. Never upgrade it to a full deep review.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.