Home / All Skills / Workflow & Core Tools / skill-reviewer
English (EN)简体中文 (ZH)日本語 (JA)
Workflow & Core Tools · daymade/claude-code-skills

skill-reviewer

Reviews and improves Claude Code skills against official best practices. Supports three modes - self-review (validate your own skills), external review (evaluate others' skills), and auto-PR (fork, improve, submit). Use when checking skill quality, reviewing skill repositories, or contributing improvements to open-source skills.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit
Author daymadeGitHub daymade/claude-code-skills ↗Stars 1385License MIT（仓库根 LICENSE，Copyright (c) 2025 daymade；GitHub API spdx MIT）Commit d5c4678cb5
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The automated review core is the executable script review_skill.py: it performs static checks on the target skill directory (frontmatter quality, directory structure, SKILL.md < 500 lines, hardcoded path/secret regexes, script hygiene, subagent_type validity, and instruction style heuristics), while delegating YAML/schema/internal path validation to the canonical validator in the companion skill-creator.

daymade-skill/skill-reviewer/SKILL.md
The reviewer delegates YAML, schema, and internal-path validation to the canonical `skill-creator` validator bundled in the same suite. It then checks frontmatter quality, directory structure, SKILL.md size, hardcoded paths and secrets, script hygiene, `subagent_type` validity, and instruction-style heuristics.
The script locates the sibling validator via relative path resolution (Path(__file__).resolve().parents[2] / 'skill-creator' / 'scripts' / 'quick_validate.py'), strictly relying on the co-located suite layout (daymade-skill/skill-creator must co-exist).

Static rule implementation: PATH_PATTERNS (/Users/, /home/, C:\Users\ absolute path regexes) and SECRET_PATTERNS (api_key/token/password assignments, sk-, ghp_ prefixes) make 'hardcoded paths and secrets' machine-checkable; script hygiene uses ast parsing to detect bare except statements and flags requests/httpx imports for dependency registration.

daymade-skill/skill-reviewer/scripts/review_skill.py
SECRET_PATTERNS = [ re.compile( r"\b(?:api[_-]?key|secret[_-]?key|password|token)\b" r"\s*[:=]\s*['\"](?P<value>[^'\"]{8,})['\"]", re.IGNORECASE, ), re.compile(r"(?P<value>sk-[A-Za-z0-9]{20,})"), re.compile(r"(?P<value>ghp_[A-Za-z0-9]{36})"), ]
This explains the implementation: official best practices are converted into executable regex and structural checks, delivering results via a 0/1/2/3 exit code contract (0 clean / 1 warnings / 2 errors / 3 operational failure).

Three-mode routing: self-review (script + skill-creator security_scan + manual checklist), external review (clone repository to /tmp → read all documentation first → identify author intent → run checklist → generate improvement report), and auto-PR (gh fork → additive improvements → self-review respect check → submit PR).

daymade-skill/skill-reviewer/SKILL.md
Auto-PR Workflow: - [ ] Fork repository (gh repo fork) - [ ] Create feature branch - [ ] Apply additive improvements only - [ ] Self-review: respect check passed? - [ ] Create PR with detailed explanation
Mode 3's fork/branch/PR operations are handled entirely by the host's gh command where the model executes (the skill provides no standalone script for this); the core principle is additive-only (no file deletions, no language alterations, no renames—only augmentations with justifications for each change).

The review philosophy is embedded as a 'Respect Check' list and PR tone discipline: PRs targeting others' skills are strictly additive, include a 'What's NOT Changed' section, and maintain a tone focused on discoverability rather than critique.

daymade-skill/skill-reviewer/SKILL.md
❌ "Your skill doesn't follow best practices" ✅ "This PR aligns with best practices for better discoverability"
The self-review checklist (Respect Check: No files deleted? / No functionality removed? / Original language preserved? ...) is strictly verified before opening a PR.

Explicit capability boundaries: validating marketplace.json plugin boundaries and layouts falls under the domain of the marketplace-dev skill; rather than overstepping to reinvent templates, this skill directs users to daymade-claude-code:marketplace-dev in the same repository.

daymade-skill/skill-reviewer/SKILL.md
skill's domain — don't author it from a template here.
This is part of the internal division of labor within the daymade skill suite: skill-creator builds, skill-reviewer reviews, marketplace-dev manages plugin boundaries, and skill-governance handles catalog governance.

2Core Capabilities

01Automated skill review (uv run --with PyYAML python review_skill.py <path> [--json])
02Delegated skill-creator canonical validation (quick_validate.py: YAML frontmatter/schema/internal paths)
03Exit code contract: 0 clean / 1 warnings / 2 review errors / 3 invocation or runtime failure
04Three operational modes: self-review / external review (clone and evaluate third-party repos) / auto-PR (fork + additive improvements + PR)
05Security extended scan integration: uv run … skill-creator/scripts/security_scan.py <target> --verbose
06Manual evaluation checklist and PR templates (references/evaluation_checklist.md, pr_template.md)

3External Dependencies

KindDependency / Endpoint
packagePyYAML（经 uv run --with PyYAML 从 PyPI 现场提供）
cliuv（依赖提供与脚本运行）
cligh（仅 Mode 3 auto-PR：fork/分支/PR，用户显式选用时执行）
cligit（Mode 2/3 克隆外部仓库到 /tmp）
packageskill-creator 同套件脚本（quick_validate.py / security_scan.py，sibling 依赖）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Graded/per-use authorization, sandbox recommended
For Administrators
Approval workflow, rollback support, full audit
Evidence & Triggers (File Paths & Excerpts)
  • scripts/: Executes local scripts or commands: scripts/review_skill.py (python3 via uv; executes read-only static checks on target skill directories)
  • 网络端点: Declares external network access: uv fetches PyYAML from PyPI (on initial run)
  • 本地工作目录: File read/write and artifact output: Mode 2/3 (when selected by user): clones repositories under /tmp, creates branches, and pushes additive changes
Audit Notes: The reviewer itself is local static analysis (reads the target skill tree + regex/ast checks, does not execute evaluated scripts, and accesses no credentials); the Yellow rating stems from the dependency chain and optional network actions: (1) uv run --with PyYAML fetches packages dynamically from PyPI (third-party remote package); (2) Mode 3 auto-PR uses gh to fork/clone/push to GitHub—standard CLI and predictable target, but only triggered when explicitly chosen by the user; (3) strong dependency on validation/security scripts from the companion skill-creator (same-repo trust chain). Evaluated third-party skills are read-only and never executed. No credential access, avoiding Orange; remote package dependencies and gh network actions place it above Blue, leading to a Yellow rating.

5Second-Pass Verification

  • [ok] 委托 skill-creator validator 且不执行被评脚本 — subprocess.run 仅 [sys.executable, validator, skill_path]；validator 路径 = parents[2]/skill-creator/scripts/quick_validate.py；同套件 skill-creator 目录真实存在。
  • [ok] 密钥/硬编码路径机检规则 — PATH_PATTERNS 三平台绝对路径正则、SECRET_PATTERNS（key/token/password 赋值 + sk- + ghp_）、PLACEHOLDER_SECRET_PATTERNS 均在源码中逐字可查。
  • [ok] 三模式与 additive-only 原则 — SKILL.md Mode 1/2/3 章节 + 'Core Principle: Additive Only'（NEVER Delete existing files…ALWAYS Add new capabilities）与 Auto-PR Workflow 清单一致。
  • [ok] 退出码契约 — EXIT_CLEAN/EXIT_WARNINGS/EXIT_FINDINGS/EXIT_OPERATIONAL = 0/1/2/3 常量 + SKILL.md 说明一致。
  • [ok] 网络/凭证反例搜索 — review_skill.py 无网络代码、无凭证读取、无 shell=True；唯一外部依赖是 uv 提供 PyYAML；gh/git 动作仅在 SKILL.md Mode 2/3 的模型执行清单里（用户显式选用）。
  • [ok] 功能声明 vs 实际能力夸大检查 — description『Reviews and improves Claude Code skills against official best practices』——review 由脚本+清单兑现，improve 走 additive PR 流程；不声称自动化重写或深度安全渗透（后者显式指向 skill-creator security_scan）。
  • [ok] 元数据（commit/license/stars） — 本地 HEAD == pin d5c4678cb5d4fd6acc9c922690df035dbd33d247；GitHub API：MIT、stars 1385（2026-09-09 实采）、pushed_at 2026-09-09T12:33:29Z。

6Verdict & Scenarios

  • Transforms best practices into machine-checkable and reproducible reviews: regex/ast checks plus exit code contracts ready for CI consumption.
  • Clear division of responsibilities: canonical validation is delegated to skill-creator, allowing this skill to focus on quality, hygiene, and style heuristics without reinventing the wheel.
  • Built-in additive-only collaboration ethics: Respect Check checklist + 'What's NOT Changed' PR section reduce cultural friction with open-source authors.
  • Automated review-to-improvement loop: Mode 3 provides a complete checklist from fork to PR using the official gh CLI end-to-end.
  • Honest capability boundaries: delegates marketplace validation to marketplace-dev and deep security scans to security_scan without overstepping.
    • Best for: Ideal for Claude Code skill authors conducting pre-release self-checks, maintainers performing batch quality assessments on skill repositories, and contributors submitting respectful improvement PRs to open-source skills; also suitable for integrating skill quality checks into CI (exit codes 0/1/2/3). Combines with skill-creator (authoring), marketplace-dev (plugin boundaries), and skill-governance (catalog governance) to cover the complete skill lifecycle.
    Not for: Not suitable for users requiring deep penetration testing or malicious code analysis (static rules only detect hardcoded patterns; dedicated security tools should be configured for deep scanning); not suitable for non-additive major refactoring of others' skills (violates the additive philosophy); not suitable for evaluating non-Claude Code skill formats (e.g., pure Codex/OpenClaw custom formats); not suitable for offline environments lacking PyPI access without pre-installed PyYAML.
    Install Agent-Ready
    ① Verified Mirror 2026-09-09
    Option A · Direct DownloadDownload skill-reviewer.tar.gz
    sha256: faaf2fe7a6e55ee9…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit d5c4678cb5.