capability-portfolio-architect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited capability-portfolio-architect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bundled commands use $PLUGIN_ROOT ($env:PLUGIN_ROOT in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"), otherwise the absolute path of this skill folder's ../...
Use this when a capability set may have the wrong shape.
This skill owns structural decisions across skills and plugins.
Decisions include keep, split, merge, remove, rename, route, move skills between plugins, extract shared capability patterns, move detail to references, extract deterministic scripts, or create a new skill/plugin boundary.
context-density first when the primary problem is context cost, hot-path prose, prompt contracts, or measured placement.skill-trigger-metadata for final name/description trigger wording after the target architecture is chosen.skill-factory or plugin-factory to perform the concrete edits after this skill produces the decision ledger. python3 "$PLUGIN_ROOT/scripts/portfolio/portfolio_architecture_audit.py" <plugin-dir> --json
python3 "$PLUGIN_ROOT/scripts/portfolio/portfolio_architecture_audit.py" plugins --json
python3 "$PLUGIN_ROOT/scripts/context/context_density_audit.py" <plugin-dir> --json --top 20skill names, descriptions, router rows, references, scripts, validation commands, install surface, adjacent plugins, and cross-plugin overlap candidates.
keep: current boundary is coherent.metadata-review: trigger scent or boundary wording is weak.reference-extract: hot path contains rare details.script-extract: repeated deterministic procedure should become a script.split-review: one skill owns multiple independently triggerable workflows.merge-review: two skills share the same trigger surface and workflow.delete-review: capability is obsolete, unreachable, unsafe, or fully replaced.router-review: plugin needs an explicit router or router repair.plugin-split-review: one plugin contains multiple independently marketable or load-heavy families.plugin-merge-review: two plugins are not independently coherent products.move-review: a skill appears to belong in another plugin boundary.cross-plugin-overlap-review: two plugins share a responsibility pattern that needs keep/move/merge/extract-shared/defer.shared-capability-review: repeated workflow mechanics should become a shared script, reference, or Workbench pattern.$PLUGIN_ROOT/references/portfolio-architecture.md for full action proof rules.For material work, produce:
Portfolio architecture audit:
- Scope:
- Current architecture:
- Measurements:
- Cross-plugin candidates:
- Candidate actions:
- Decision ledger:
- Adopted edits:
- Rejected/deferred edits:
- Preserved invariants:
- Validation:
- Install/cache state:
- Residual risks:Use $PLUGIN_ROOT/references/portfolio-architecture.md for the JSON ledger schema and action matrix.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.