skill-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited skill-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scan skills, then apply judgment to identify what should change and why. The script does detection - you do the decisions.
$ARGUMENTS (optional) - a specific skill name to audit in focused mode. Omit to audit all skills.~/.claude/commands/skill-audit/scripts/scan-skills.sh $ARGUMENTSIf $ARGUMENTS is empty, scans all skills. If a skill name is provided, scans only that skill (faster, used automatically after creation).
Work through each section of the scan output:
From INLINE_BASH_COMMANDS and BASH_BLOCKS_PER_SKILL:
For each bash block, classify the operation:
| Classification | What it looks like | Verdict |
|---|---|---|
| Calls an existing script | ~/.claude/commands/*/scripts/*.sh | Correct - no change |
| Pure data collection | cat, ls, find, grep, uname, df, free, ssh + read-only | Extract to script |
| Text transformation | sed, awk, cut, tr with no conditionals | Extract to script |
| Conditional / judgment | if/then, case, comparisons, decisions | Keep in SKILL.md |
| Complex pipeline | >5 piped commands doing what a script would do | Extract to script |
For every deterministic block: show BEFORE (the inline block) and AFTER (what the extracted script would look like). Label clearly.
From SHARED_SCRIPT_OPPORTUNITIES:
For each match: the skill has inline bash that already exists as a script in another skill. Suggest calling that script directly instead. Name which skill owns it and what the call would look like.
From DUPLICATE_COMMANDS and the full skill set:
For each duplication: name both skills, show the duplicated lines, suggest which one should own a shared script.
From SKILL_STRUCTURES:
Flag any skill that:
scripts/ folder - extraction candidatescripts/ folder but SKILL.md still has inline data collection - incomplete extraction.md file (not a folder) - needs migration to folder formatFrom DESCRIPTION_LENGTHS:
From MISSING_ARGUMENT_HINTS:
Flag any skill using $ARGUMENTS without argument-hint in frontmatter.
For each issue found:
SKILL: <name>
ISSUE: <what's wrong, one sentence>
SEVERITY: high | medium | low
BEFORE:
<the current inline bash block or current description>
AFTER:
<the extracted script content or improved description>
WHY: <the reason - reuse, token savings, trigger reliability, etc.>Group by severity. High = duplicated logic, broken triggering, or token waste. Medium = extraction opportunity. Low = description polish.
Summary Table after all issues:
| Skill | Extract to Script | Shared Script | Description | Total |
|---|
Action List at the end - the 3 highest-value changes to make now, in order.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.