Audit a skill with Skill Crossroads

Grade the target skill and report every finding evidence-cited (file and line) — work from the receipts, not vibes. Only when the user asks for fixes, apply the highest-impact ones and re-grade until the score stops improving.

Overview

Most skills fail silently: they never trigger, over-grant tools, or leak secrets, and the author only finds out after publishing. This skill closes that loop before you ship. It runs the free skillcrossroads CLI (MIT) against a skill directory, producing a letter grade, a file:line-cited scorecard across six rubric categories, and a ranked fix list. Auditing is read-only; when the user also wants the skill improved, it walks that list, applying the smallest change that resolves each finding, until the grade stops improving.

Prerequisites

• Node.js 20+ with npx available, and network access to the npm registry (the CLI is fetched on demand; the version is pinned below for reproducibility).
• A skill directory containing a SKILL.md file.
• No credential is required, and by default nothing about your skill leaves the machine. Every command in this skill passes --no-llm, so all six rubric categories are scored deterministically and locally.
• The one exception is --suggest in step 4, which is opt-in and requires your explicit consent. Without --no-llm, the CLI sends content to Anthropic's Messages API (api.anthropic.com) whenever ANTHROPIC_API_KEY is present in the environment — it does not prompt. That path upgrades the Triggering category to an LLM judge and adds checks VERIFY-04, CLARITY-02 and CLARITY-05, sending per-check excerpts of 1,500-2,500 characters; --suggest sends up to 24,000 characters of the entry file. Requests are billed to your own key. Treat the key as a credential: never echo or commit it.
• Model results are cached on disk between runs, keyed by content hash: ./.beacon-cache if that directory already exists, otherwise %LOCALAPPDATA%\skillcrossroads\cache on Windows, $XDG_CACHE_HOME/skillcrossroads when set, or ~/.cache/skillcrossroads.

Steps

1. Identify the skill directory (it contains a SKILL.md). Use Glob to find **/SKILL.md candidates or Grep to search for the skill by name. If more than one candidate exists, ask the user which skill to audit.
2. Run the audit and capture the report. Single-quote the directory argument — single quotes prevent the shell from expanding $(...), backticks, and $variables hidden in a path (double quotes do NOT stop command substitution). Before running, inspect the path: if it co…