skill-budget — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-budget (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
"In environments with many skills (40+) and rich configuration, the model bypasses the Skill tool entirely and uses built-in tools directly, even when skill descriptions explicitly state 'ALWAYS use this skill.'" — issue #34648
You install 40 skills. The system prompt has a limited budget for skill descriptions. The excess falls off silently — no warning, no error. Claude can't see them, and you don't know it.
When invoked, run the bundled audit.py script (next to this SKILL.md) and present its output to the user verbatim.
The script scans three locations:
~/.claude/skills/<name>/SKILL.md — your global skills.claude/skills/<name>/SKILL.md — project-level skills~/.claude/plugins/**/skills/<name>/SKILL.md — plugin-installed skillsIt parses each SKILL.md's YAML frontmatter, sums the name + description chars (the approximate per-skill cost in the system prompt), and ranks skills by weight. Skills whose cumulative sum exceeds the budget are marked INVISIBLE TO CLAUDE.
${CLAUDE_PLUGIN_ROOT}/skills/skill-budget/audit.py--budget 12000, --json),forward them.
the bar chart and the suggested mv ... .disabled commands are the value. Reformatting them defeats the purpose.
(highest information density per char freed) or the ones the user uses least often.
suggested mv commands in the output are for the user to inspect and run themselves.
/claude-papercuts:skill-budgetdegraded behavior
it estimates based on char budget. The 15,000-char default is inferred from issue discussions, not officially documented.
mv ... .disabledcommands are for the user to copy-paste if they choose.
.disabled'd(renamed). Those are off-budget by definition.
# Use a different budget (e.g. if you know your environment's cap)
${CLAUDE_PLUGIN_ROOT}/skills/skill-budget/audit.py --budget 12000
# Machine-readable output (for piping into other tools)
${CLAUDE_PLUGIN_ROOT}/skills/skill-budget/audit.py --jsonThe retention play: run this every Monday morning, after every skill install, or whenever Claude stops triggering a skill you expect. Same flywheel as npm outdated or brew doctor — a weekly health check.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.