skill-report

A report generator for installed coding-agent skills. It combines a health scan, context-use information, an overview of the skill collection, and a quality summary.

In plain words
What is it for?
Use it to review skill health, inspect context budgets, see the overall skill portfolio, generate quality summaries, or run scan-only and skip-scan reports.
Why use it?
It gives a consolidated view of the condition and organization of the installed skills. Optional modes let you run only the health scan or skip it.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/evol-ai/skillcompass/skill-report
Clone the repo
git clone --depth 1 https://github.com/Evol-ai/SkillCompass
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,109 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.03109
Opus 5 $0.00000 $0.01554
Sonnet 5 $0.00000 $0.00622
Haiku 4.5 $0.00000 $0.00311

Measured 3d ago against content hash 953ec32b2d6f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

skill-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/skill-report.md · 303 lines

How it starts

The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/skill-report — Skill Portfolio Report

Generate a comprehensive report of all installed skills: quick health scan, context budget, portfolio overview, and quality summary.

Arguments

  • --skip-scan: Skip Quick Health Scan, only show Parts 2-4
  • --scan-only: Only show Quick Health Scan (Part 1)

Steps

Step 1: Load Skill Inventory

Use the Read tool to load .skill-compass/setup-state.json. If the file does not exist, run /setup first and then continue from Step 2.

Extract the skill list from the inventory array. Each entry provides: name, path, version, purpose (category), modified_at. Keep the full list in memory.

If inventory is empty or missing, output:

No skills found in inventory. Run /setup to discover installed skills.

Then stop.

Step 2: Quick Health Scan (D1+D2+D3)

Skip this step entirely if --skip-scan was passed.

Build a skillEntries array from the inventory: [{ name, path, modified_at }, ...].

Run the QuickScanner using the Bash tool:

const { QuickScanner } = require('./lib/quick-scan');
const scanner = new QuickScanner('cc');
const skillEntries = /* array from inventory */;
const { results, summary } = scanner.scanAll(skillEntries);

Execute with node -e passing the constructed skillEntries inline, for example:

node -e "
const { QuickScanner } = require('./lib/quick-scan');
const scanner = new QuickScanner('cc');
const entries = {ENTRIES_JSON};
const out = scanner.scanAll(entries);
console.log(JSON.stringify(out));
"

Replace {ENTRIES_JSON} with the actual JSON array. Run this from the SkillCompass base directory ({baseDir}).

Sort results: high_risk first, then medium, then clean. Within each group, sort alphabetically by skill_name.

For skills that are disabled (check InboxStore.getSkillCache(name)?.disabled) or have ever_used === false from UsageReader.getSignals(name), mark them with verdict never_used for display purposes (use the symbol).

Read the full file on GitHub · 303 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 303 lines · 0 tokens per session scan A 953ec32b2d6f

Subscribe to this mod's changes

skill-report is a command published in the GitHub repository Evol-ai/SkillCompass (215 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,109 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.