Borrowing it
Nothing to install: this file belongs to ayutaz/piper-plus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ayutaz/piper-plus/dev/.claude/skills/skill-health/SKILL.mdgit clone --depth 1 https://github.com/ayutaz/piper-plusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ayutaz/piper-plus/skill-health)<a href="https://agentmods.dev/skills/ayutaz/piper-plus/skill-health"><img src="https://agentmods.dev/badge/skills/ayutaz/piper-plus/skill-health/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ayutaz/piper-plus/skill-health"><img src="https://agentmods.dev/badge/skills/ayutaz/piper-plus/skill-health.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 19 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01015 |
| Opus 5 | $0.00000 | $0.00508 |
| Sonnet 5 | $0.00000 | $0.00203 |
| Haiku 4.5 | $0.00000 | $0.00102 |
Grade A, and why
skill-health scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill / Hook Health Check
このプロジェクトの自動化資産 (16 skill + 5 hook + 49 pre-commit hook) を meta-level で健全性検証する。
memory feedback_conservative_changes.md に従い、 read-only、 検査結果を report として返すのみ。 修正は別 skill / 手動で。
カバー範囲
| 検証対象 | 内容 |
|---|---|
| SKILL.md frontmatter | name / description / allowed-tools の必須 key、 description 長 |
| name ↔ directory 一致 | .claude/skills/foo/SKILL.md の name: foo であること |
| scripts/*.py 参照 | SKILL.md 内で参照されるスクリプトが repo 内に実在 |
| trigger 衝突 | 複数 skill の description で同じ 「...」 が使われていないか |
| hook 実行可能性 | .claude/hooks/*.sh の executable bit + shebang |
実行ステップ
1. 検査スクリプト実行
uv run python scripts/check_skill_health.py --verbose
期待出力例:
inspected 16 skills, 5 hooks
OK skill-health: 16 skill(s), 5 hook(s) inspected
2. 失敗時の対応
| エラー種別 | 修正案 |
|---|---|
frontmatter not parseable |
YAML 構文エラー。 --- 行 + key: value を見直す |
missing frontmatter key: name |
SKILL.md 冒頭に name 追加 |
name does not match directory |
ディレクトリ名と SKILL.md の name を揃える |
references <path> but file does not exist |
参照されるスクリプトを作るか SKILL.md から消す |
trigger fragment used by: [...] |
複数 skill で同じ trigger 文言 → どちらかを書き換えて曖昧性除去 |
not executable |
chmod +x .claude/hooks/*.sh |
no shebang on line 1 |
#!/usr/bin/env bash を 1 行目に追加 |
3. CI 連携
このチェック自体は CI gate にする選択もあるが、 false positive (trigger 衝突警告は意図的なケースもある) のため pre-commit には入れずに skill 経由で呼ぶ。
将来、 false positive を減らせた段階で pre-commit hook 化を検討。
注意
- memory feedback_conservative_changes: 自動修復しない。 検査結果のみ。
- trigger 衝突: 「コミット前」 のような短い fragment は多数 skill に出現しても問題ないが、 「6 エージェント並列レビュー」 のような特定 skill 専用文言が他に漏れていたら衝突。
- frontmatter 長さ警告: description は 80-400 chars が推奨。 800 chars 超は単一文を超えており指針違反。
使用例
# 全 skill / hook の health check
/skill-health
# verbose で全 skill / hook を一覧
/skill-health verbose
期待効果
- skill / hook の script reference rot を pre-commit 入れなくても定期検査可
name ↔ directoryミスマッチ (skill 追加時の rename 忘れ) の早期発見- trigger 衝突 の検出 (どの skill が呼ばれるべきか LLM に曖昧)
.claude/hooks/*.shの shebang 漏れ / executable 漏れ 防止
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 79 lines · 0 tokens per session scan A c0ff1e500f6a
skill-health is a skill published in the GitHub repository ayutaz/piper-plus (204 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,015 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
developing-with-streamlit
Use for ALL Streamlit tasks: creating, editing, debugging, beautifying, styling, theming, optimizing, or deploying Streamlit apps. Also custom components, st.components.v2, HTML/JS/CSS work. Discovers and loads version-matched reference docs from the user's installed Streamlit (>=1.57). Triggers: streamlit, st.…
physicsnemo-shard-tensor
Official NVIDIA-authored guidance for PhysicsNeMo ShardTensor domain parallelism — integrate domain parallelism into training/inference scripts (new or existing) with DDP or FSDP2, write and register shard patches to enable new layers/ops, and bootstrap multi-GPU correctness tests. Use when working with ShardTensor…
code-task
PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, /code/bar) or a git URL. Clones the repo, runs an OpenSquilla agent on the host to make the change on a task branch…
physicsnemo-discover
Official NVIDIA-authored guidance for navigating PhysicsNeMo — pick the model, datapipe, or example for a SciML/AI4Science task (surrogates, forecasting, downscaling, physics-informed, inverse, generative). Points at existing files via live repo search; never writes code. Do NOT use for installation or environment…
stack-trace-js-probe
Internal helper for meta-stack-trace-investigator. Use when a JavaScript or TypeScript stack trace needs npm/node/tsc-specific checks, reproduction guidance, and patch targets.
stack-trace-generic-probe
Internal helper for meta-stack-trace-investigator. Use when a stack trace language is unknown and the workflow needs language-neutral failure-contract checks, reproducer guidance, and patch targets.