audit-agent-cli
Use this skill to review an existing command-line tool against the agent-CLI contract and safety model — before extending it, before trusting it in an autonomous loop, or as a quality gate. Triggers on "audit this CLI", "review this tool for agents", "is this CLI safe for agents", "check the agent CLI against best practices", "contract review", "safety review of the CLI". Produces a findings report graded against the invariants and the guarded-mutation model. Read-only.
What this skill does
# Audit an agent CLI
Review an existing CLI against the contract that makes a tool safe to be **driven and
extended by agents**. Read-only — produce a findings report, do not change code.
## Step 1 — Establish intent 🔶 DECISION GATE
Ask the human ONE thing (one `AskUserQuestion`): **what safety posture should this tool
have?**
- *Report-only* (never mutates) — audit that it truly never writes.
- *Guarded mutation* (mutates only on explicit command, with recheck) — audit the full
safety model.
- *Autonomous loop* (an agent runs it unattended) — audit the strictest bar
(token split, recheck-before-mutate, proposal/apply separation).
The posture sets the bar for the Safety section. Everything else is read from the repo.
## Step 2 — Metrics pass
```sh
python3 <plugin>/scripts/repo-health.py <repo> # or --bots-separate for loops
```
Capture: feat:fix per scope (fragile subsystems), churn concentration (the de-facto
spec), deletion cadence. These become the "fragility" section of the report.
## Step 3 — Contract pass
Walk [`references/contract-checklist.md`](references/contract-checklist.md) group by
group (External surface · Internal robustness · Author surface · Safety). For each
invariant, grep/read for evidence and mark **PASS / FAIL / N-A** with a file:line
citation. Don't guess — cite the code or mark it FAIL.
Quick greps that find most gaps:
- `--json` handling + a single stdout writer; stderr for progress
- a typed error class carrying `exitCode` + `code`; a top-level catch converting it
- `safeParse` / schema validation at model/IO boundaries (not bare `JSON.parse` of model output)
- atomic writes (`rename`) + `open(..., "wx")` locks
- a `{ name, ...methods }` adapter interface + a registration array (breadth pluggable)
- `.gitignore` of the state dir / a separate state repo
## Step 4 — Safety pass
For guarded/autonomous posture, audit against
[`references/safety-model.md`](references/safety-model.md): the credential boundary
(does the model ever hold write creds during analysis?), proposal-vs-apply separation,
recheck-live-state-before-mutate (drift check), single deterministic apply path, and
marker-backed idempotent side effects. These are the patterns that prevent an
autonomous agent from doing damage.
## Step 5 — Report
Emit a findings report:
- **Summary:** posture audited, overall PASS/FAIL count.
- **Contract findings:** table of invariant · status · evidence (file:line) · severity.
- **Safety findings:** the credential/recheck/apply-path findings (highest severity).
- **Fragility:** the repo-health signals + the 1–2 scopes that need a test sweep.
- **Recommended next steps:** ordered, each pointing at **evolve-agent-cli** or
**agent-spec-kit** for the fix.
Severity guide: a missing credential boundary or recheck on a mutating autonomous tool
is **critical**; missing `--json`/exit-code classes is **high** (blocks agent driving);
missing tests on a churn-hot file is **high**; style/doc gaps are **low**.
## Definition of done
- [ ] posture confirmed with the human
- [ ] repo-health metrics captured
- [ ] every contract invariant marked PASS/FAIL/N-A with a citation
- [ ] safety model audited for the stated posture
- [ ] findings report with ordered, skill-routed next steps
Related in AI Agents
skill-development
IncludedComprehensive meta-skill for creating, managing, validating, auditing, and distributing Claude Code skills and slash commands (unified in v2.1.3+). Provides skill templates, creation workflows, validation patterns, audit checklists, naming conventions, YAML frontmatter guidance, progressive disclosure examples, and best practices lookup. Use when creating new skills, validating existing skills, auditing skill quality, understanding skill architecture, needing skill templates, learning about YAML frontmatter requirements, progressive disclosure patterns, tool restrictions (allowed-tools), skill composition, skill naming conventions, troubleshooting skill activation issues, creating custom slash commands, configuring command frontmatter, using command arguments ($ARGUMENTS, $1, $2), bash execution in commands, file references in commands, command namespacing, plugin commands, MCP slash commands, Skill tool configuration, or deciding between skills vs slash commands. Delegates to docs-management skill for official documentation.
reprompter
IncludedTransform messy prompts into well-structured, effective prompts — single or multi-agent. Use when: "reprompt", "reprompt this", "clean up this prompt", "structure my prompt", rough text needing XML tags and best practices, "reprompter teams", "repromptception", "run with quality", "smart run", "smart agents", multi-agent tasks, audits, parallel work, anything going to agent teams. Don't use when: simple Q&A, pure chat, immediate execution-only tasks. See "Don't Use When" section for details. Outputs: Structured XML/Markdown prompt, quality score (before/after), optional team brief + per-agent sub-prompts, agent team output files. Success criteria: Single mode quality score ≥ 7/10; Repromptception per-agent prompt quality score 8+/10; all required sections present, actionable and specific.
adaptive-compaction
IncludedAdaptive add-on policy and recovery layer that decides WHEN to compact, prune, snapshot, or fork -- replacing fixed-percent auto-compaction across Claude Code, Codex, and MCP-capable hosts. Trigger on auto-compact timing or damage: "when should I compact", "is it safe to compact now or start a fresh session", "auto-compact fires too early/mid-task", "switching to an unrelated task but the window still has space", "context rot", "answers get worse the longer the session runs", "the agent forgot the plan or my decisions after it summarized", "add a layer on top that manages context without changing the agent", raising autoCompactWindow to give the policy room, or installing/tuning a cross-tool compaction policy or PreCompact hook -- even when "compaction" is never said but the problem is context-window pressure or post-summarization memory loss. Do NOT use to summarize a conversation, build RAG, write a summarization prompt (decides WHEN not HOW), or answer max-context-length trivia.
agent-skill-creator
IncludedCreate cross-platform agent skills from workflow descriptions. Activates when users ask to create an agent, automate a repetitive workflow, create a custom skill, or need advanced agent creation. Triggers on phrases like create agent for, automate workflow, create skill for, every day I have to, daily I need to, turn process into agent, need to automate, create a cross-platform skill, validate this skill, export this skill, migrate this skill. Supports single skills, multi-agent suites, transcript processing, template-based creation, interactive configuration, cross-platform export, and spec validation.
llm-wiki
IncludedUse when building or maintaining a persistent personal knowledge base (second brain) in Obsidian where an LLM incrementally ingests sources, updates entity/concept pages, maintains cross-references, and keeps a synthesis current. Triggers include "second brain", "Obsidian wiki", "personal knowledge management", "ingest this paper/article/book", "build a research wiki", "compound knowledge", "Memex", or whenever the user wants knowledge to accumulate across sessions instead of being re-derived by RAG on every query.
skill-master
IncludedAgent Skills authoring, evaluation, and optimization. Create, edit, validate, benchmark, and improve skills following the agentskills.io specification. Use when designing SKILL.md files, structuring skill folders (references, scripts, assets), ingesting external documentation into skills, running trigger evals, benchmarking skill quality, optimizing descriptions, or performing blind A/B comparisons. Keywords: agentskills.io, SKILL.md, skill authoring, eval, benchmark, trigger optimization.