Skip to content
audit-skills logo

Audit Skills

audit-skills

Audits all personal Claude skills against the SKILLS_GUIDE.md manifest, latest official Claude skills documentation, and best practices. Reports issues, missing patterns, and improvement suggestions per skill. Use to keep skills healthy, consistent, and up-to-date with the latest standards.

SKILL.md

Full skill instructions

Audit Skills

Audit personal Claude skills for consistency, best practices, and up-to-date standards.

Command routing

Check $ARGUMENTS:

  • help → display help then stop
  • --fix [skill-name] → auto-fix issues (see Fix mode)
  • --verbose [skill-name] → show full details for every check (not just failures)
  • <skill-name> → audit a single skill
  • empty → audit all skills

Help

Doctor — Audit personal Claude skills for health and consistency

Usage:
  /​audit-skills                      Audit all personal skills
  /​audit-skills <skill-name>         Audit a single skill
  /​audit-skills --fix                Auto-fix all skills
  /​audit-skills --fix <skill-name>   Auto-fix a specific skill
  /​audit-skills --verbose            Full detail for every check
  /​audit-skills help                 This help

Checks performed:
  Manifest    Does the skill follow SKILLS_GUIDE.md conventions?
  Frontmatter Are all required/​recommended fields present and correct?
  Content     Is the skill under 500 lines? Are references bundled?
  Tools       Are allowed-tools minimal? Any duplicates? Any contradictions?
  UX          Does it have help/​config/​reset? First-time detection? Memory?
  Docs        Is the description third-person with trigger keywords?
  Security    Does disable-model-invocation match the side-effect profile?
  Upstream    Does it follow latest official Claude skills documentation?

Output:
  [PASS] Check passed
  [WARN] Non-critical suggestion
  [FAIL] Violates manifest or best practice
  [INFO] Informational note

Example output:
  /​slack-to-ticket
    [PASS] Third-person description
    [PASS] disable-model-invocation: true (has side effects)
    [WARN] SKILL.md is 120 lines — fine, but has inline examples that could be bundled
    [FAIL] Missing help subcommand
    [PASS] Preferences memory pattern present

Step 1: Load references

Local manifest

Read ~/​.claude/​skills/​SKILLS_GUIDE.md — this is the source of truth for local conventions.

Latest upstream docs

Search the web for the latest Claude Code skills documentation:

ultrathink

Search for:

  • site:code.claude.com skills — official skill format docs
  • site:platform.claude.com agent-skills best-practices — authoring best practices
  • claude code skills 2026 — any new features or changes

Fetch and read the top results. Extract:

  • Any NEW frontmatter fields not in our manifest
  • Any CHANGED best practices (naming, descriptions, tool restrictions)
  • Any DEPRECATED patterns we're still using
  • Any NEW features we should adopt

Compile a checklist of upstream checks in addition to the manifest checks.

If web search is unavailable, proceed with manifest-only checks and note: "Could not fetch upstream docs — manifest checks only."

Step 2: Discover skills

~/​.claude/​skills/​*/​SKILL.md

List all found skills. If a specific skill-name was given in $ARGUMENTS, filter to just that one.

Step 3: Audit each skill

For each skill, run every check below. Track results as PASS/​WARN/​FAIL/​INFO.

Frontmatter checks

CheckPASSFAIL
name presentHas nameMissing
description presentHas descriptionMissing
description is third-personStarts with verb in third person ("Creates", "Analyzes")Imperative/​second person ("Create", "Analyze")
description has trigger keywordsContains "Use when" or similar usage hintNo usage context
description length≤1024 charsOver 1024
argument-hint presentHas hintWARN: missing (optional but recommended)
disable-model-invocationtrue if skill has side effects (check allowed-tools for Write, Edit, Bash, MCP create/​update tools)Missing when side effects present
allowed-tools presentListedWARN: missing (broad permissions)

Tool checks

CheckPASSFAIL
No duplicate MCP toolsSingle prefix per serviceBoth mcp__linear-server__* and mcp__claude_ai_Linear__*
MCP tools use canonical prefixUses mcp__claude_ai_Linear__*Uses mcp__linear-server__*
No contradictory toolsRead-only skills don't have Write/​EditRead-only principle violated
Minimal toolsOnly tools actually referenced in bodyTools listed but never used

Content checks

CheckPASSFAIL
Under 500 lines≤500WARN: over 500
No redundant instructionsDoesn't tell Claude how to use JSON, git basics, etc.WARN: generic instructions
Uses numbered checklists for workflowsSteps are numberedWARN: prose-only workflow
References bundled files if >100 lines of examplesExamples in separate filesWARN: large inline examples

UX checks (from manifest conventions)

CheckPASSFAIL
help subcommandBody handles $ARGUMENTS = "help"Missing
config subcommandBody handles $ARGUMENTS = "config"Missing
reset subcommandBody handles $ARGUMENTS = "reset"Missing
First-time detectionChecks for preferences file existenceMissing
Preferences memoryReferences preferences.md fileMissing
Dynamic context injectionUses !backtick`` preprocessingWARN: missing where applicable

Upstream checks (from fetched docs)

Apply any new checks discovered in Step 1. Common ones:

CheckPASSFAIL
context: fork for self-contained skillsSet when skill doesn't need conversation historyWARN: could benefit from fork
model field for reasoning-heavy skillsSet for complex analysis skillsINFO: could benefit from model override
Positional args $0, $1Used for structured inputsINFO: could use positional args
Skill directory structureHas SKILL.md + optional reference/​examplesNon-standard structure

Inventory check (only on full audit)

  • Compare discovered skills against SKILLS_GUIDE.md inventory table
  • Report any skills not in the inventory (WARN)
  • Report any inventory entries with no matching skill (WARN)

Step 4: Present results

Per-skill report

/​skill-name
  [PASS] 8 checks passed
  [WARN] 2 warnings
  [FAIL] 1 failure

  Failures:
    - disable-model-invocation missing (skill creates Linear issues)

  Warnings:
    - No dynamic context injection (could pre-fetch git branch)
    - SKILL.md is 180 lines with inline examples (consider bundling)

Summary (full audit only)

Doctor Summary — {date}

Skills audited: {N}
  [PASS] {N} fully healthy
  [WARN] {N} with warnings
  [FAIL] {N} with failures

Top issues:
  1. {most common failure across skills}
  2. {second most common}

Upstream updates:
  {Any new features/​changes from official docs worth adopting}
  (or "All skills are up-to-date with latest docs")

Inventory:
  {N} skills in SKILLS_GUIDE.md
  {N} skill directories found
  {discrepancies if any}

Step 5: Offer fixes (if --fix flag)

If --fix was passed:

  1. For each FAIL, propose a specific edit
  2. For each WARN, propose a fix (optional)
  3. Use AskUserQuestion (multiSelect: true):
    • One option per proposed fix
    • "Apply all fixes"
    • "Skip all"
  4. Apply approved fixes using Edit tool
  5. Update SKILLS_GUIDE.md inventory if new skills were found
  6. Report what was changed

Without --fix: just report findings.

Step 6: Save audit results

Write a timestamped audit log to:

~/​.claude/​skills/​audit-skills/​last-audit.md

Format:

# Skill Audit — {date}

## Summary
- Skills: {N}
- Pass: {N}, Warn: {N}, Fail: {N}

## Per-skill results
{compact results}

## Upstream notes
{anything new from docs}

This allows comparing across audits to track improvement.

Principles

  • Non-destructive by default: Only report, never modify without --fix and user confirmation.
  • Manifest is local truth: SKILLS_GUIDE.md defines what "good" means for this user.
  • Upstream is advisory: New features from official docs are INFO/​WARN, not FAIL (unless the user's manifest adopts them).
  • Be specific: Every FAIL/​WARN includes exactly what's wrong and how to fix it.
  • Fast: Don't re-read files unnecessarily. Parse frontmatter first, skip deep content checks if frontmatter fails.

More Security skills

supabase logo
Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K
View

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K
View

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K
View

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K
View

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K
View

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K
View

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K
View
cloudflare logo
Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K
View

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K
View
gws-gmail logo
Security

gws-gmail

Send, read, and manage Gmail messages, drafts, labels, and account settings.

31.2K 78.9K
View

Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.

94 72.3K
View
gws-shared logo
Security

gws-shared

Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.

31.2K 63.4K
View

Security AI tools

StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
GeoSpy logo
Security

GeoSpy

GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams

Free
View

Detect AI-generated voices to protect against audio fraud.

Paid
View

Ensure Your Content's Originality with AI Plagiarism Checker

Freemium
View
Img Upscaler logo
Security

Img Upscaler

Upscale images by 400% without quality loss

Freemium
View
AICheatCheck logo
Security

AICheatCheck

Accurately Detect AI-Generated Content with TheChecker.AI

Free
View
D
Security

Detect GPT

Chrome extension that detects and flags AI-generated content

Free
View