astroicers

Skill Quality Research — Security skill for Claude Code

Security community

Craft-first quality review for Agent Skill repos — an LLM judges how well a skill is WRITTEN (trigger design, writing quality, scope, anti-hallucination); lint only filters packaging and security.

How to install Skill Quality Research

This entry records only its repository, not the path inside it, so there is no exact command to give. Open astroicers/skill-quality-research and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Skill Quality Research does

Craft-first quality review for Agent Skill repos — an LLM judges how well a skill is WRITTEN (trigger design, writing quality, scope, anti-hallucination); lint only filters packaging and security. From a 97-repo star-gradient study.

Alternatives in Security

Brooks Audit — Run a Brooks-Lint architecture audit 1.5k ★
Engage.Threatmodel — Materialize, lint, and drift-check the engagement threat model 348 ★
Data Viz Audit — Audit a data visualization for chart type selection, accessible color palette, annotations, and anti-patterns 309 ★

README

skill-quality-research

**這是一個審查 Agent Skill「寫得好不好」的工具。** LLM 讀 SKILL.md 判 trigger 設計 / 寫作風格 / scope / anti-hallucination ——**那是主判**;lint 只負責 packaging 與安全門檻,**它的分數不是品質結論** ([判準與信任邊界](#使用-skill-reviewercraft-判讀是主判lint-是過濾器))。

**為什麼反過來做**:分析 97 個 repo 後,數據給出的反直覺結論是 **高星 repo 的共同點是「好裝」,不是「寫得好」**——能自動化量的那一面,恰好不是品質。

⚠️ 那是**特徵剖面關聯,不是因果**:n=54、T3 層只有 **n=3**、效果量僅 ρ=0.19–0.32, **不宣稱統計顯著**。[完整限制與 CI](docs/RESEARCH.md#統計限制必讀)。

安裝

**Claude Code plugin(推薦,一行)**

/plugin marketplace add astroicers/skill-quality-research
/plugin install skill-reviewer@skill-reviewer

⚠️ **這兩行的證據強度**:結構與命名慣例已對照本機 8 個**已安裝且運作中**的 marketplace 驗過, **但沒有在乾淨環境端到端跑過一次**。裝不起來請開 issue——我們不替沒跑過的事背書。

驗了什麼、沒驗什麼

**驗過的:**

.claude-plugin/marketplace.json 的欄位集合與 visual-web-stack(已裝、運作中)完全相同
/plugin install @ 的兩個名字來自 JSON 的 name 欄位而非 repo 名 —— 決定性案例是 mattpocock:repo 叫 mattpocock/skills,而 marketplace 註冊名是 mattpocock
該格式與 ~/.claude/plugins/installed_plugins.json 的真實 key (superpowers@superpowers-marketplace 等)一致;6 個已裝 repo 的 README 也是同一模式

**沒驗的:** Claude 是否真能從 GitHub 抓下本 repo 並完成安裝。 **證據強度是「與八個能運作的實例結構一致」,不是「我裝過」。**

**一個只有我們有的落差**:那 8 個對照組的 marketplace 名稱都等於 repo 名, 我們不是(repo `skill-quality-research`,marketplace `skill-reviewer`)。功能上沒問題(`mattpocock` 即反例),但 `add` 完之後顯示的名字會和你輸入的不一樣。

**或裝成 skill**(symlink,repo 更新自動生效):

git clone https://github.com/astroicers/skill-quality-research.git
cd skill-quality-research && ./install.sh --symlink   # 安裝後自動跑 selftest 驗證

手動 / Windows(install.sh 是 POSIX-only,但工具本身可跑)

`lint_skill.py` 零依賴、純 Python,**在 Windows 上有 CI 實跑驗證** (`windows-latest` job:路徑分隔符與輸出編碼兩項都測)。安裝手動做即可:

git clone https://github.com/astroicers/skill-quality-research.git
Copy-Item -Recurse skill-quality-research\skill-reviewer "$env:USERPROFILE\.claude\skills\skill-reviewer"
python "$env:USERPROFILE\.claude