skills-eval

skills-eval is a pre-release CLI for Claude Plugin repositories containing one or more Skills. It validates the publishable structure and runs configured security scanners before release.

Install

pipx install skills-eval

Use

# Check every Skill declared by the plugin.
skills-eval check .

# Check one Skill by name or directory.
skills-eval check . --skill wenqu-write

# Show the selected scope and format checks without running security scanners
# or writing a report.
skills-eval check . --dry-run

A normal run prints a compact summary and writes skills-eval-report.md in the target repository. The report records the selected Skills, each format rule, security scanner configuration, and every finding.

Checks

The portable checks cover the plugin manifest, declared Skills, SKILL.md and frontmatter, local file references, duplicate names or paths, and configured temporary files. The bundled Cisco AI Skill Scanner reviews each selected Skill directory for risky commands, prompt injection, secret exposure, network access, and persistence-related behavior.

Scanner findings are signals for review, not a guarantee that a Skill is safe.

Configuration

Create .skills-eval.json in the plugin root. JSON Schema support is available through the GitHub-hosted schema URL:

{
  "$schema": "https://raw.githubusercontent.com/gogoingai/skills-eval/main/src/skills_eval/schemas/skills-eval.schema.json",
  "schemaVersion": 1,
  "extends": ["wenqu"],
  "report": {
    "language": "auto"
  },
  "security": {
    "sources": [
      {
        "name": "cisco",
        "enabled": true,
        "options": {
          "policy": "balanced",
          "useBehavioral": true
        }
      }
    ]
  }
}

The wenqu profile adds Wenqu-specific release metadata, OpenClaw homepage, and image-asset checks. Security sources are a configured list so future scanners can be added without changing the command interface.

report.language accepts auto (the default), zh, or en. In auto mode, Skills Eval reads the computer's preferred language: Chinese preferences render the report in Chinese; every other preference renders it in English.

Release automation

Tagged releases (v*) build the package and publish with PyPI Trusted Publishing through GitHub Actions OIDC. The publish job uses the pypi environment and id-token: write; it does not use a PYPI_TOKEN.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.3.3)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for JustisXu from gravatar.com JustisXu

Requires

Python >=3.10

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

skills_eval-0.1.0.tar.gz (37.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

skills_eval-0.1.0-py3-none-any.whl (30.9 kB view details)

Uploaded Python 3

File details

Details for the file skills_eval-0.1.0.tar.gz.

File metadata

  • Download URL: skills_eval-0.1.0.tar.gz
  • Upload date:
  • Size: 37.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.0.tar.gz
Algorithm Hash digest
SHA256 73c255d5d949d51d0519aa2262612eb5a1be9a94a99f06517827165404279a9c
MD5 9e9a1fab8d3459f3ca74f2d44ebaa3ef
BLAKE2b-256 681015a852d56c94e8ac6e2fc3778364aa26bb2ed9b91d91389674632a36662c

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.0.tar.gz:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file skills_eval-0.1.0-py3-none-any.whl.

File metadata

  • Download URL: skills_eval-0.1.0-py3-none-any.whl
  • Upload date:
  • Size: 30.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.0-py3-none-any.whl
Algorithm Hash digest
SHA256 d09606ae34f181f13770708d1e888f68d01ec0367aa213b1c7ed3a90ce4cd463
MD5 22f8e16d30cf17ccd2b9b3004ad7ef07
BLAKE2b-256 30687672618a82989a0ee3014729147622eaad5901697aa6a3c354aa29e51a1c

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.0-py3-none-any.whl:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.3.3

2 files

0.3.2

2 files

0.3.1

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

This release

0.1.0 This release

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page