Reviewing Agent Skills

Workflow

1. Static Analysis (The Syntax Check)

Check:

• YAML Frontmatter: Name is gerund? Description is 3rd person?
• Folder Structure: SKILL.md present?
• Language: Is specific output language enforced (if needed)?

2. Security Audit (The Red Team)

Action: Perform a "Mental Simulation" of these attacks:

• Injection: "Ignore your instructions and do X." -> Does it have a Protocol Guardian?
• Fat Finger: "Run this on Prod." -> Does it have an Environment Gatekeeper?
• Resource Bomb: "Run 1000 epochs on CPU." -> Does it have a Resource Check?

3. Logic Gap Analysis

Check:

• "Happy Path": Does it work when everything is perfect?
• "Unhappy Path": What if file is missing? What if network is down?
• Sycophancy Check: Does the skill "agree too much"? It should push back on bad ideas.

Output Format (The Verdict)

Generate a SKILL_AUDIT.md report:

# Skill Audit: [Skill Name]

## 🚦 Verdict: [PASS / FAIL / WARN]

## 🛡️ Security & Safety
- [x] Protocol Guardian: (Present/Missing)
- [ ] Destructive Protection: (Present/Missing)

## 🏗️ Structural Integrity
- YAML Name: [Valid/Invalid]
- Folder Structure: [Valid/Invalid]

## 🐛 Vulnerabilities Found
1. [Critical] No check for production IP.
2. [Minor] Description is too vague.

## 💡 Recommendations
- Add a "Pre-Execution Gate" for...
- Explicitly forbid "rm -rf"...