skills-eval

skills-eval is a pre-release CLI for Claude Plugin repositories containing one or more Skills. It validates the publishable structure and runs configured security scanners before release.

Install

pipx install skills-eval

Use

# Check every Skill declared by the plugin.
skills-eval check .

# Check one Skill by name or directory.
skills-eval check . --skill wenqu-write

# Show the selected scope and format checks without running security scanners
# or writing a report.
skills-eval check . --dry-run

A normal run prints a compact summary and writes skills-eval-report.md in the target repository. The report records the selected Skills, each format rule, security scanner configuration, and every finding.

Checks

The portable checks cover the plugin manifest, declared Skills, SKILL.md and frontmatter, local file references, duplicate names or paths, and configured temporary files. The bundled Cisco AI Skill Scanner reviews each selected Skill directory for risky commands, prompt injection, secret exposure, network access, and persistence-related behavior.

Scanner findings are signals for review, not a guarantee that a Skill is safe.

Configuration

Create .skills-eval.json in the plugin root. JSON Schema support is available through the GitHub-hosted schema URL:

{
  "$schema": "https://raw.githubusercontent.com/gogoingai/skills-eval/main/src/skills_eval/schemas/skills-eval.schema.json",
  "schemaVersion": 1,
  "extends": ["wenqu"],
  "report": {
    "language": "auto"
  },
  "security": {
    "sources": [
      {
        "name": "cisco",
        "enabled": true,
        "options": {
          "policy": "balanced",
          "useBehavioral": true
        }
      }
    ]
  }
}

The wenqu profile adds Wenqu-specific release metadata, OpenClaw homepage, and image-asset checks. Security sources are a configured list so future scanners can be added without changing the command interface.

report.language accepts auto (the default), zh, or en. In auto mode, Skills Eval reads the computer's preferred language: Chinese preferences render the report in Chinese; every other preference renders it in English.

Release automation

Tagged releases (v*) build the package and publish with PyPI Trusted Publishing through GitHub Actions OIDC. The publish job uses the pypi environment and id-token: write; it does not use a PYPI_TOKEN.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.3.3)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for JustisXu from gravatar.com JustisXu

Requires

Python >=3.10

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

skills_eval-0.1.2.tar.gz (37.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

skills_eval-0.1.2-py3-none-any.whl (31.2 kB view details)

Uploaded Python 3

File details

Details for the file skills_eval-0.1.2.tar.gz.

File metadata

  • Download URL: skills_eval-0.1.2.tar.gz
  • Upload date:
  • Size: 37.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.2.tar.gz
Algorithm Hash digest
SHA256 38bb1dbcc523d5c69b4e5ab039f49d2ccd06a1b7a62764bae89a682a6e35ee2d
MD5 9a0dffb18fa0a00e4cf1b1ac5f3ca224
BLAKE2b-256 3b9e6ca34094917a69a3cb9d7dca1304b4250daec9983edb8b8af1a1b542ca1a

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.2.tar.gz:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file skills_eval-0.1.2-py3-none-any.whl.

File metadata

  • Download URL: skills_eval-0.1.2-py3-none-any.whl
  • Upload date:
  • Size: 31.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for skills_eval-0.1.2-py3-none-any.whl
Algorithm Hash digest
SHA256 f7b26177d0b7a408ef3191dd45d183885e627235e48ee2bd7243c205c515f65e
MD5 0790fbab289b2229ec36a58589f482c5
BLAKE2b-256 72c226890d86010dc5e74b1c2d69a956fb473155f9a1e2b67690cce58056d54c

See more details on using hashes here.

Provenance

The following attestation bundles were made for skills_eval-0.1.2-py3-none-any.whl:

Publisher: release.yml on gogoingai/skills-eval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.3.3

2 files

0.3.2

2 files

0.3.1

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

This release

0.1.2 This release

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page