New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Audit Skill

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Audit and improve a Claude Code skill using Skill Crossroads.

MITAuto-check passedDevelopment

Install Audit Skill

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill audit-skill -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace audit-skill --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/community/skillcrossroads/skills/audit-skill .claude/skills/audit-skill && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
audit-skill
GitHub stars
2.8k
Token cost
~2.3k tokens
SKILL.md length
1,161 words
Files
6 (incl. references)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Audit and improve a Claude Code skill using Skill Crossroads.

  • Works in 6 steps: Identify the skill directory (it… → Run the audit and capture the report.… → Report the scorecard and the Top fixes… → …
  • The user says audit my skill
  • SKILL.md covers Overview, Prerequisites, Steps and Output, plus 4 more sections
  • Calls npx; needs ANTHROPIC_API_KEY

What it does

Audit Skill is an agent skill from jeremylongshore/tons-of-skills-marketplace. Audit and improve a Claude Code skill using Skill Crossroads. Use when the user says "audit my skill", "grade my skill", "check my skill quality", "why doesn't my skill trigger", or "lint my SKILL.md" — or before publishing any skill, to get an evidence-cited quality score, ranked fix list, and badge. Trigger with "audit my skill".

Its SKILL.md is about 2.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including reference files (for example `evals/audit-and-fix-low-grade-skill.md`, `evals/audit-clean-skill.md` and `evals/npx-unavailable.md`). Compatibility notes: Designed for Claude Code; the underlying CLI grades skills, subagents, slash commands, MCP configs, and plugins

It sits in Development. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • The user says audit my skill
  • Check my skill quality
  • Why doesnt my skill trigger
  • Lint my SKILL.md —

Example prompts

  • “audit my skill”
  • “grade my skill”
  • “check my skill quality”
  • “/audit-skill”

Requirements

  • Node.js
  • A credential in ANTHROPIC_API_KEY
  • Compatibility (from SKILL.md): Designed for Claude Code; the underlying CLI grades skills, subagents, slash commands, MCP configs, and plugins
  • Pre-approved tools (allowed-tools): Read, Edit, Grep, Glob, Bash(npx:*)

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

  1. Identify the skill directory (it contains a SKILL.md). Use Glob to find **/SKILL.md
  2. Run the audit and capture the report. Single-quote the directory argument — single
  3. Report the scorecard and the Top fixes list (ranked by grade impact) to the user.
  4. Apply fixes (only on explicit request or confirmation). The deterministic report from
  5. Re-run the audit. Repeat steps 4–5 until the grade stops improving or only intentional
  6. Offer the badge: npx skillcrossroads@0.11.4 '' --no-llm --badge writes an SVG the user

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Edit
    • Grep
    • Glob
    • Bash(npx:*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • skillcrossroads.com
    • npmjs.com
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • ANTHROPIC_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code; the underlying CLI grades skills, subagents, slash commands, MCP configs, and plugins

    From compatibility in the SKILL.md frontmatter.

Context cost

Audit Skill loads about 2.3k tokens when it runs, and up to ~3.5k if it reads all its reference files. Until then it costs about 86 tokens; SKILL.md has 1,161 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~86
When it runs · the whole SKILL.md, loaded when a task matches
~2.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 1,161 words, ~2,286 tokens.

Download SKILL.mdSave it as .claude/skills/audit-skill/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
audit-skill
description
Audit and improve a Claude Code skill using Skill Crossroads. Use when the user says "audit my skill", "grade my skill", "check my skill quality", "why doesn't my skill trigger", or "lint my SKILL.md" — or before publishing any skill, to get an evidence-cited quality score, ranked fix list, and badge. Trigger with "audit my skill".
allowed-tools
Read, Edit, Grep, Glob, Bash(npx:*)
compatibility
Designed for Claude Code; the underlying CLI grades skills, subagents, slash commands, MCP configs, and plugins
disable-model-invocation
true
argument-hint
<skill-dir — path to the directory containing SKILL.md>
version
0.11.4
author
Steve Harlow <sgharlow@users.noreply.github.com>
license
MIT
tags
audit, quality, linter, skills

Audit a skill with Skill Crossroads

Grade the target skill and report every finding evidence-cited (file and line) — work from the receipts, not vibes. Only when the user asks for fixes, apply the highest-impact ones and re-grade until the score stops improving.

Overview

Most skills fail silently: they never trigger, over-grant tools, or leak secrets, and the author only finds out after publishing. This skill closes that loop before you ship. It runs the free skillcrossroads CLI (MIT) against a skill directory, producing a letter grade, a file:line-cited scorecard across six rubric categories, and a ranked fix list. Auditing is read-only; when the user also wants the skill improved, it walks that list, applying the smallest change that resolves each finding, until the grade stops improving.

Prerequisites

  • Node.js 20+ with npx available, and network access to the npm registry (the CLI is fetched on demand; the version is pinned below for reproducibility).
  • A skill directory containing a SKILL.md file.
  • No credential is required, and by default nothing about your skill leaves the machine. Every command in this skill passes --no-llm, so all six rubric categories are scored deterministically and locally.
  • The one exception is --suggest in step 4, which is opt-in and requires your explicit consent. Without --no-llm, the CLI sends content to Anthropic's Messages API (api.anthropic.com) whenever ANTHROPIC_API_KEY is present in the environment — it does not prompt. That path upgrades the Triggering category to an LLM judge and adds checks VERIFY-04, CLARITY-02 and CLARITY-05, sending per-check excerpts of 1,500-2,500 characters; --suggest sends up to 24,000 characters of the entry file. Requests are billed to your own key. Treat the key as a credential: never echo or commit it.
  • Model results are cached on disk between runs, keyed by content hash: ./.beacon-cache if that directory already exists, otherwise %LOCALAPPDATA%\skillcrossroads\cache on Windows, $XDG_CACHE_HOME/skillcrossroads when set, or ~/.cache/skillcrossroads.

Steps

  1. Identify the skill directory (it contains a SKILL.md). Use Glob to find **/SKILL.md candidates or Grep to search for the skill by name. If more than one candidate exists, ask the user which skill to audit.

  2. Run the audit and capture the report. Single-quote the directory argument — single quotes prevent the shell from expanding $(...), backticks, and $variables hidden in a path (double quotes do NOT stop command substitution). Before running, inspect the path: if it contains a single quote, $, a backtick, or a newline, do not pass it to a shell at all — such characters in a skill directory name are themselves a red flag; rename the directory or ask the user for a safe path first.

    bash
    npx skillcrossroads@0.11.4 '<skill-dir>' --no-llm --markdown

  3. Report the scorecard and the Top fixes list (ranked by grade impact) to the user. Auditing is read-only. If the user asked only to audit, grade, check, or lint, stop here — do not edit anything. Proceed to step 4 only when the user explicitly asked to fix or improve the skill, or confirms they want the fixes applied after seeing the report.

  4. Apply fixes (only on explicit request or confirmation). The deterministic report from step 2 is normally enough to work from.

    Optionally, model-drafted rewrites are available — but --suggest is the only command in this skill that sends anything off the machine, so ask the user before running it and proceed only on an explicit yes:

    --suggest sends up to 24,000 characters of this skill's entry file to Anthropic's API (api.anthropic.com), billed to your own ANTHROPIC_API_KEY, and caches the result on disk. Run it, or continue with the local findings?

    On a yes, and only when ANTHROPIC_API_KEY is set:

    bash
    npx skillcrossroads@0.11.4 '<skill-dir>' --suggest

    If the user declines, or no key is set, continue with the step 2 findings — they already cover all six rubric categories. Either way, treat suggestions as proposals to review and never apply one unread. For each fix, Read the cited file:line, confirm the finding is real, and apply the smallest Edit that resolves it. Typical high-impact fixes: rewrite the frontmatter description to lead with the use case and include the phrases a user would actually say; add a verification step; state constraints and failure modes; remove hardcoded secrets or over-broad allowed-tools.

  5. Re-run the audit. Repeat steps 4–5 until the grade stops improving or only intentional trade-offs remain.

  6. Offer the badge: npx skillcrossroads@0.11.4 '<skill-dir>' --no-llm --badge writes an SVG the user can embed in their README, linking to https://skillcrossroads.com for the hosted version. It lands in the current working directory as <name>.beacon.svg, not inside the skill directory; pass --badge=<path> to choose where it goes.

Show full SKILL.md (418 more words)Show less

Output

  • A markdown scorecard: overall letter grade, per-category scores across the six rubric categories, and every finding cited with file and line.
  • A ranked Top fixes list ordered by grade impact.
  • After the fix loop (when the user requested fixes): the before → after grades, reported to the user.
  • With --badge: an SVG badge file, <name>.beacon.svg, written to the current working directory — not into the skill directory; --badge=<path> chooses another location.

Error Handling

  • If npx fails (offline, registry blocked, unsupported Node version), report the error verbatim and stop — do not hand-estimate a grade.
  • If no SKILL.md is found in the target directory, ask the user for the correct path instead of guessing.
  • If the grade plateaus with findings remaining, list each residual finding and ask the user whether it is an intentional trade-off; never mask a finding to force a grade.
  • Never suppress, delete, or work around a SAFETY- finding* — fix the underlying problem (remove the secret, narrow the tool grant). Safety findings always count.
  • Do not pad the skill with filler to game a check; if a finding is a deliberate trade-off, say so to the user instead of masking it.
  • Say which mode ran (keyless deterministic vs. LLM-upgraded) so the user knows what the grade covers.

Examples

User: "Audit my skill in skills/deploy-checker — why doesn't it trigger?"

bash
npx skillcrossroads@0.11.4 'skills/deploy-checker' --no-llm --markdown

The report grades Triggering low, citing SKILL.md:3 — the description lacks the phrases a user would say. Report that finding and stop (the user asked why, not for edits). If they then say "fix it", rewrite the description to lead with the use case, re-run the audit, and report the before → after grade (for example C → A). Alternatively, run with --suggest to review proposed rewrites before applying them.

Verify

Done means: for an audit-only request, the scorecard and Top fixes list were reported with no files modified. For a fix request: the final npx skillcrossroads@0.11.4 '<skill-dir>' --no-llm --markdown run shows the improved grade with no fail-status findings remaining (or each remaining one acknowledged by the user as intentional), and the before → after grades are reported to the user.

Resources

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (references) in plugins/community/skillcrossroads/skills/audit-skill of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • evals/audit-and-fix-low-grade-skill.md
  • evals/audit-clean-skill.md
  • evals/npx-unavailable.md
  • references/flags-quick-reference.md
  • references/rubric-categories.md

Open the folder on GitHubat commit cfae287

Compare with similar skills

Audit Skill next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Audit Skill compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Audit Skill this skilljeremylongshore/tons-of-skills-marketplace2.8k—~2.3kAutomated safety check: PassMIT
Vercel Composition Patternssupabase/supabase111k58 repos~726Automated safety check: PassMIT
Finishing a Development Branchobra/superpowers297k5 repos~1.9kAutomated safety check: PassMIT
Typescript Advanced Typesrolling-scopes/rsschool-app10k25 repos~4.2kAutomated safety check: PassMPL-2.0
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
Code Review ChecklistshareAI-lab/learn-claude-code78k4 repos~1.1kAutomated safety check: PassMIT

Similar skills

  • Vercel Composition Patterns

    supabase/supabase

    Official

    React composition patterns that scale. An agent skill from supabase/supabase.

    111k GitHub starsUsed in 58 repos~726 tokens
    DevelopmentAuto-check passed

  • Finishing a Development Branch

    obra/superpowers

    Walks the last step of a branch: confirm tests pass, detect the git environment, ask how to integrate, carry out your choice and clean up the worktree.

    297k GitHub starsUsed in 5 repos~1.9k tokens
    DevelopmentAuto-check passed

  • Typescript Advanced Types

    rolling-scopes/rsschool-app

    Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications.

    10k GitHub starsUsed in 25 repos~4.2k tokens
    DevelopmentAuto-check passed

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed

  • Code Review Checklist

    shareAI-lab/learn-claude-code

    Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.

    78k GitHub starsUsed in 4 repos~1.1k tokens
    DevelopmentAuto-check passed

  • Greploop

    onyx-dot-app/onyx

    Iteratively improves a PR (GitHub), MR (GitLab), or shelved changelist (Perforce) until Greptile gives it a 5/5 confidence score with zero unresolved comments.

    32k GitHub starsUsed in 4 repos~3.3k tokens
    DevelopmentAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Categories

Questions about Audit Skill

What does Audit Skill do?

Audit and improve a Claude Code skill using Skill Crossroads. Audit Skill is an agent skill from jeremylongshore/tons-of-skills-marketplace. Audit and improve a Claude Code skill using Skill Crossroads.

When should I use Audit Skill?

Audit Skill fits situations like: the user says audit my skill; check my skill quality; why doesnt my skill trigger; lint my SKILL.md —.

How do I install Audit Skill in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill audit-skill -a claude-code`. Or copy the skill folder (plugins/community/skillcrossroads/skills/audit-skill in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/audit-skill in your project. Claude Code loads it when a task matches its description.

How do I install Audit Skill in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill audit-skill -a codex`. Or copy the skill folder (plugins/community/skillcrossroads/skills/audit-skill in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/audit-skill in your project. Codex loads it when a task matches its description.

Can I use Audit Skill in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill audit-skill -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-skill, .gemini/skills/audit-skill, .github/skills/audit-skill and .opencode/skills/audit-skill in your project.

What does Audit Skill need to run?

Going by SKILL.md and its folder, Audit Skill needs the command-line tools its instructions call (npx) and credentials named ANTHROPIC_API_KEY. Our summary lists: Node.js; A credential in ANTHROPIC_API_KEY. Its frontmatter pre-approves these tools: Read, Edit, Grep, Glob, Bash(npx:*). Compatibility (from SKILL.md): Designed for Claude Code; the underlying CLI grades skills, subagents, slash commands, MCP configs, and plugins.

Does Audit Skill access the network?

SKILL.md names 3 domains. As links in the text: skillcrossroads.com, npmjs.com and github.com. This is read from the text; nothing was executed.

Is Audit Skill safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Audit Skill use?

Audit Skill is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Audit Skill use?

About 2.3k tokens (SKILL.md is roughly 9.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.2k tokens, read only when the agent opens those files.

What are the alternatives to Audit Skill?

Skills that share tags, products or a category with Audit Skill: Vercel Composition Patterns (supabase/supabase, 111k stars), Finishing a Development Branch (obra/superpowers, 297k stars), Typescript Advanced Types (rolling-scopes/rsschool-app, 10k stars) and PR Babysitter (openinterpreter/openinterpreter, 69k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Audit Skill?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.