skill-health-lens — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-health-lens (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Audits Agent Skills against the same checks ModelBound runs in its Skill Development Pipeline — Trust, Token Budget, Duplicates, and Tool Surface — without running the full pipeline.
SKILL.md fileFor each SKILL.md in scope:
Score the skill 0–100 using ModelBound's @modelbound/skill-trust heuristics:
name, description, optional allowed_tools present and well-formedReport trust tier:
Estimate tokens (chars / 4) for the skill body and compare against ModelBound's thresholds:
Flag the top 3 most token-heavy sections and suggest where to split into sub-skills or move into a referenced doc.
For each skill, compare with every other SKILL.md in the workspace using a Jaccard similarity over normalized tokens. Flag pairs with similarity ≥ 0.4 as likely duplicates and ≥ 0.6 as near-clones. Suggest a merge or rename.
Parse the allowed_tools frontmatter (and any explicit tool mentions in the body). Flag:
allowed_tools field (implicit unrestricted access)run_terminal, delete_file, write_file on broad globs)**/SKILL.md from the workspace root (or operate on the currently open file).When the user is signed in to ModelBound (via the modelbound MCP server defined in this plugin), also:
skills.list (optionally filtered by category or group_id) and skills.listGroups to pull the user's Skills — including a whole group at once when they say things like "lens my Onboarding group" or "audit every Backend skill".skills.get / skills.getFile for the full bundle, and platform.exportSkillForIde with group_id to bundle every skill in a group into the IDE in one shot.Note: ModelBound no longer uses the legacy "pack" concept — everything is a Skill, optionally organized into a Skill group. Olderpacks.*/export_pack_for_idetool names still work as deprecated aliases but new code should useskills.*andplatform.exportSkillForIde.
If the MCP server is unreachable or the user is not signed in, the four core checks still run locally.
# Skill Health Lens — <N> skills in <workspace>
## Summary
| Skill | Trust | Tokens | Duplicates | Tools |
| --- | --- | --- | --- | --- |
| code-reviewer | 🟢 86 | 🟢 1.2k | — | ✅ scoped |
| pr-helper | 🟡 71 | 🔴 6.8k | clones code-reviewer (0.62) | ⚠️ unrestricted |
## Top 3 fixes
1. **pr-helper**: split into `pr-summarize` and `pr-review` (current body is 6.8k tokens).
2. **pr-helper**: add `allowed_tools: [read_file, grep]` to drop the unrestricted warning.
3. **pr-helper** ↔ **code-reviewer**: 62% overlap — consider merging or extracting a shared rule.
## Details
...~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.