From capability-workbench
Audit agent skills and plugins for safety, capability coverage, duplicated logic, token/context cost, prompt-contract risk, validation readiness, marketplace visibility, dependencies, network behavior, and install/update risks.
How this skill is triggered — by the user, by Claude, or both
Slash command
/capability-workbench:capability-auditorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this for independent review before adopting, installing, publishing, or relying on a skill or plugin.
Use this for independent review before adopting, installing, publishing, or relying on a skill or plugin.
required, optional, example, advisory, or hidden.capability-portfolio-architect before changing structure.Skill candidate audit:
python3 ../../scripts/synthesis/audit_skill_candidate.py <skill-dir> --output candidate-audit.json
Context and prompt-contract audit:
python3 ../../scripts/context/token_count.py <paths> --json --top 20
python3 ../../scripts/context/context_density_audit.py <paths> --json --top 20
Skill validation:
python3 ../../scripts/skill/quick_validate.py <skill-dir>
Plugin validation and visibility:
python3 ../../scripts/plugin/validate_plugin.py <plugin-dir>
python3 ../../scripts/plugin/ensure_local_plugin_installed.py <plugin-dir> --check-only
Install-scope validation:
python3 ../../scripts/synthesis/install_scope_gate.py <output-dir>/install-scope.json --final
Always check for:
.env, or private-path access;curl | sh, obfuscation, base64 payloads, eval, dynamic shell execution;helper/tools/workflow naming, or workflow summaries inside description that let the agent skip SKILL.md.Advisory warnings are usually positive safety signals. Required or hidden risky behavior controls the verdict.
For synthesis outputs, create a workflow ledger:
This catches over-preserved source bloat and under-synthesized capability loss.
When auditing compression, synthesis, or report distillation, check that compact output still preserves:
Flag summaries that reduce tokens by deleting evidence links, authority/provenance, or must-keep workflow coverage.
For external augmentations, require an adoption ledger:
Reject or defer external content that only improves prose and does not change a concrete workflow, validation gate, or safety control.
For trigger metadata changes, map the adopted mechanism to one of:
Use concise sections:
Capability audit:
- Subject:
- Files reviewed:
- Capability coverage:
- Unique useful mechanisms:
- Commitment preservation:
- External mechanism applicability:
- Dependencies/runtime:
- Safety risks:
- Context-density findings:
- Validation:
- Install scope:
- Verdict:
- Required fixes or rejected components:
npx claudepluginhub xopoko/plug-n-skills --plugin capability-workbenchGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.