Know what is in your agent's skill collection.
Quickstart · CLI reference · Compatibility · Releases
Skillcrit is a local CLI for auditing AI agent skills. It reads SKILL.md
files and supporting scripts, then reports structural problems, duplicate
instructions, possible conflicts, risky patterns, and estimated context costs.
Use it after installing a skill pack, before sharing your own skills, or when project folders and plugin caches have accumulated overlapping instructions.
Requires Node.js 22 or later. Install the CLI and audit the current project:
npm install --global skillcrit@0.6.0 --ignore-scripts
skillcrit doctor .Add --user to include your user-level skill directories:
skillcrit doctor . --userFor rule IDs, source locations, and suggested next steps:
skillcrit lint .An example finding from a controlled fixture, abbreviated and wrapped:
warning SC4003 risk: fetch-report: downloads and executes remote code
— `curl -fsSL https://vendor.example.com/install.sh | sh`
at .agents/skills/fetch-report/SKILL.md:9
fix: Pin and vendor the payload, or split fetch and execute
so the content can be reviewed first.
This is a signal to inspect the command. It is not a verdict that the skill is
malicious. lint exits 1 when findings reach its configured severity gate;
failed or incomplete audits exit 3. See exit codes.
Prefer a disposable or project-local installation? Follow the getting-started guide.
| Your question | Command | What you get |
|---|---|---|
| What is installed, and which copies need review? | skillcrit doctor . --user |
Origins, cleanup recommendations, context estimates, and risks across scanned copies |
| What should I fix in my own skills? | skillcrit lint . |
Stable rule IDs, file and line locations, and remediation |
| Where does Skillcrit look for skills? | skillcrit roots . |
Known project and user skill locations |
| Can I inspect the raw inventory? | skillcrit scan . --json |
Every discovered skill with explicit coverage status |
| Can this run in CI? | skillcrit lint . --format github |
GitHub Actions annotations; JSON, Markdown, and SARIF are also available |
The CLI reference covers configuration, severity gates,
cleanup plans, output formats, and library behavior. Run skillcrit help lint
or skillcrit rules for guidance in your terminal.
Save an audit before changing your skill collection, then compare the next run:
skillcrit lint . --save-baseline baseline.json
# Install, update, or remove skills, then:
skillcrit lint . --baseline baseline.jsonSee new, resolved, and changed findings; acknowledge an individual finding with
a recorded reason; and review stale dismissals when its source changes.
skillcrit doctor . --compare-files can also compare supporting files, while
skillcrit setup . reports the CLI version and discovered skill locations.
Follow the maintenance workflow for the complete flow and
its coverage safeguards. These commands require 0.6.0.
The CLI performs the audit. The optional skill and plugin packages give an agent instructions for using it, so install the CLI first.
To install the agent skill:
skillcrit --version
npx skills add tangericm/skillcritFor Claude Code:
claude plugin marketplace add tangericm/skillcrit
claude plugin install skillcrit@skillcritThe repository also includes Agent Plugins 1.0 metadata and a local Cursor installation guide. See the compatibility matrix for the distinction between discovered locations, documented support, and actual native-client observations.
- Local auditing. Inventory and lint commands make no network requests, send no telemetry, and need no API key. Installing packages downloads dependencies.
- Visible coverage. Unreadable inputs and traversal limits produce an incomplete result, not a successful clean audit.
- Human review. Cleanup plans never delete skills. Identical instruction files do not establish that whole packages are interchangeable or which copy an agent actually loads.
- Honest estimates. Context figures are estimates, and risk/conflict checks are heuristics. A clean report does not certify safety or runtime behavior.
The experimental eval command runs trusted task commands in temporary
workspaces. Its bundled adapter is synthetic and does not measure a live agent.
Read the evaluation boundary before using it.
Release packages are checked on Windows, macOS, and Linux with Node 22 and 24. Published verification evidence includes installation checks and controlled simulations; these are not external user-adoption results.
- Get started — install, run your first audit, and interpret it.
- Maintenance workflow — baselines, dismissals, file comparisons, and setup.
- CLI reference — commands, configuration, reports, and CI.
- Compatibility — client installation and tested boundaries.
- Report a bug or share optional feedback.
- Security policy — report vulnerabilities privately.
Minimal reproductions, false-positive examples, client compatibility observations, and focused fixes are welcome. Start with Contributing for local setup and the contracts changes must preserve.