Use when evaluating, comparing, installing, or recommending a Claude Code plugin, Agent Skill, MCP server, agent toolkit, or GitHub-hosted AI extension, especially when popularity is weak evidence or the candidate requests shell, network, filesystem, or credential access.
中文简介正在准备中。当前显示原文说明。
安装前可以查看交给 AI 代理的指令内容。
Collect comparable evidence about GitHub-hosted agent capabilities before installation. The bundled script uses the GitHub API without cloning a repository. It reports maintenance metadata, license, distribution files, executable surfaces, test signals, and high-risk text patterns. It does not install, authenticate, or declare a project safe.
Convert each candidate to owner/repo or a GitHub repository URL.
Run the script for all credible candidates, not only the popularity leader:
python ${CLAUDE_SKILL_DIR}/scripts/audit.py owner/repo another/repo
Read the exact pinned commit or package that would be installed. The script inspects the current default branch only; say so explicitly.
Open every discovered plugin manifest, SKILL.md frontmatter, hook, MCP configuration, and executable script before recommending installation.
Compare candidates using task fit, blast radius, runtime proof, maintenance, interoperability, rollback, documentation, and adoption. Cap adoption at 5% of the decision.
Report four states separately: discovered, structurally inspected, installed/authenticated, and runtime-tested.
Use --json for machine-readable output and --token-env NAME only when an existing GitHub token environment variable is needed for rate limits. Never paste a token into the command.
SECURITY.md is a review signal, not proof of insecurity.allowed-tools, install scripts, and downloaded binaries define the effective trust boundary.Read ecosystem-discovery-guide.md for the source order, weighted scorecard, research seeds, and installation gate.
Inspect the artifact you will execute, at the version you will execute—not the reputation of its repository.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Use when cutting a release, writing a CHANGELOG entry, or summarizing what changed since a tag — when the repo's commits follow (or mostly follow) Conventional Commits and a mechanically-accurate section breakdown beats a model's reading of the diff.
中文简介正在准备中。当前显示原文说明。
Use before committing, opening a PR, or reporting a task done — when you want ground-truth confirmation there are no conflict markers, live-looking credentials, debug leftovers, untracked TODOs, or oversized files, without spending a model turn re-reading every file yourself.
中文简介正在准备中。当前显示原文说明。
Use before publishing documentation, merging a docs PR, or reporting a Markdown-heavy repo's navigation as complete — when you want ground-truth confirmation that internal links, heading anchors, and directory links resolve, without opening every file yourself.
中文简介正在准备中。当前显示原文说明。
Use when the user names a coding or Claude Code task ("add OAuth", "set up hooks", "review this PR", "pick a model"), asks which prompt to use, says to "use the right prompt", or when you enter this repo and need to orient without reading every file.
中文简介正在准备中。当前显示原文说明。
Use when the user names a coding, Claude Code, research, documentation, or technology-selection task; asks which prompt to use; says to use the right prompt; or when an agent enters this repository and needs to orient without reading every file.
中文简介正在准备中。当前显示原文说明。
Use when a skill isn't triggering as expected, before adding a new skill (to check for a name collision), during periodic cleanup of an accumulated skills directory, or when asked to review skill quality — checks frontmatter validity, description quality against Skill Discovery Optimization conventions, body size, and cross-scope name collisions.
中文简介正在准备中。当前显示原文说明。