---
name: Audit Skill Libraries
slug: audit-skill-libraries
category: Quality
description: Reviews skill libraries for structural, safety, linkage, size, and trigger-boundary issues. Useful for static analysis of skill metadata and structure without executing code.
github: "https://github.com/MisterBrookT/skill2/tree/main/skills/skill2-audit"
language: Python
stars: 10
forks: 0
install: "git clone https://github.com/MisterBrookT/skill2"
added: 2026-07-17T07:10:03.569Z
last_synced: 2026-07-17T07:10:03.569Z
canonical_url: "https://dirskills.com/skills/audit-skill-libraries"
---

# Audit Skill Libraries

Reviews skill libraries for structural, safety, linkage, size, and trigger-boundary issues. Useful for static analysis of skill metadata and structure without executing code.

**Install:** `git clone https://github.com/MisterBrookT/skill2`

## README

# Audit Skill Libraries

Find evidence-backed defects without changing the library.

## Scope

| Target | Checks |
| --- | --- |
| One Skill | Frontmatter, description, links, resources, scripts, secrets, local paths, size |
| Skill Library | Every single-Skill check plus duplicate names, ownership, scope, and static trigger overlap |

## Ownership

- Audit owns static structure, safety, references, metadata, and trigger overlap.
- Test owns live activation and outcome behavior.
- Visualize owns inventory/usage/test evidence and conservative lifecycle review candidates.
- Create owns applying approved structural changes.

## Method

1. Run `uv run --script <skill-dir>/scripts/run -- lint <target> --json` first for a single Skill or a library. Save and use its static findings as evidence.
2. Manually review what CLI cannot prove: description semantics, ownership, scope, and trigger overlap.
3. If CLI is unavailable or fails: state limitation / `inconclusive`. Never claim clean.
4. Do not execute scripts. Do not auto-fix.

## Checks

- Missing or invalid `SKILL.md` and frontmatter
- Directory/name mismatch
- Workflow summaries or ambiguous triggers in `description`
- Broken relative links and unused resources
- Non-executable or risky scripts
- Secrets and accidental machine-local paths
- Oversized bodies that should use progressive disclosure
- Static trigger overlap across sibling skills
- Project-only instructions inside a global package

## Severity

| Level | Meaning |
| --- | --- |
| P0 | Install or execution breaks |
| P1 | Triggering or ownership is wrong |
| P2 | Safety or maintenance risk |
| P3 | Cleanup or style debt |

## Output

Return severity, file, evidence, impact, and smallest suggested change. Do not apply fixes unless requested.

```bash
uv run --script <skill-dir>/scripts/run -- lint skills/<name> --json
uv run --script <skill-dir>/scripts/run -- lint skills --json
uv run --script <skill-dir>/scripts/run -- scan skills/<name> --json
uv run --script <skill-dir>/scripts/run -- scan skills --json
```