skills-eval

skills-eval is a pre-release CLI for Claude Plugin repositories containing one or more Skills. It validates the publishable structure and runs configured security scanners before release.

Install

pipx install skills-eval

Use

# Check every Skill declared by the plugin.
skills-eval check .

# Check one Skill by name or directory.
skills-eval check . --skill wenqu-write

# Show the selected scope and format checks without running security scanners
# or writing a report.
skills-eval check . --dry-run

A normal run prints a compact summary and writes skills-eval-report.md in the target repository. The report records the selected Skills, each format rule, security scanner configuration, and every finding.

Checks

The portable checks cover the plugin manifest, declared Skills, SKILL.md and frontmatter, local file references, duplicate names or paths, and configured temporary files. The bundled Cisco AI Skill Scanner reviews each selected Skill directory for risky commands, prompt injection, secret exposure, network access, and persistence-related behavior.

Scanner findings are signals for review, not a guarantee that a Skill is safe.

Configuration

Create .skills-eval.json in the plugin root. JSON Schema support is available through the GitHub-hosted schema URL:

{
  "$schema": "https://raw.githubusercontent.com/gogoingai/skills-eval/main/src/skills_eval/schemas/skills-eval.schema.json",
  "schemaVersion": 1,
  "extends": ["wenqu"],
  "report": {
    "language": "auto"
  },
  "security": {
    "sources": [
      {
        "name": "cisco",
        "enabled": true,
        "options": {
          "policy": "balanced",
          "useBehavioral": true
        }
      }
    ]
  }
}

The wenqu profile adds Wenqu-specific release metadata, OpenClaw homepage, and image-asset checks. Security sources are a configured list so future scanners can be added without changing the command interface.

report.language accepts auto (the default), zh, or en. In auto mode, Skills Eval reads the computer's preferred language: Chinese preferences render the report in Chinese; every other preference renders it in English.

Release automation

Tagged releases (v*) build the package and publish with PyPI Trusted Publishing through GitHub Actions OIDC. The publish job uses the pypi environment and id-token: write; it does not use a PYPI_TOKEN.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.3.3)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for JustisXu from gravatar.com JustisXu

Requires

Python >=3.10

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

skills_eval-0.1.1.tar.gz (37.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

skills_eval-0.1.1-py3-none-any.whl (31.1 kB view details)

Uploaded Python 3

File details

Details for the file skills_eval-0.1.1.tar.gz.

File metadata

  • Download URL: skills_eval-0.1.1.tar.gz
  • Upload date:
  • Size: 37.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.1.tar.gz
Algorithm Hash digest
SHA256 bfb28570dc747d8d150688dd62f9ac32ea957bfde7b0d4e11824fea926f24c8f
MD5 934a2cac7d04601f2363d8b25e0b5890
BLAKE2b-256 e23922cdd2ed13a5256359b64202015e8f9f57fcac0e4b0b3d9da4e32860099e

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.1.tar.gz:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file skills_eval-0.1.1-py3-none-any.whl.

File metadata

  • Download URL: skills_eval-0.1.1-py3-none-any.whl
  • Upload date:
  • Size: 31.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.1-py3-none-any.whl
Algorithm Hash digest
SHA256 11c4cfb8d277aa310329d2d3c7fb43fe666d5c6c88e8d5f80b880b119188fde8
MD5 cb2933f43f998d2446c72336814946dd
BLAKE2b-256 4b8b39a8b4fa08cabfab4520c15b4d93f1bb3aef10905fced6d78dd54644eac2

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.1-py3-none-any.whl:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.3.3

2 files

0.3.2

2 files

0.3.1

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

This release

0.1.1 This release

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page