Auditing

Runs a 10-category diagnostic sweep across your bundle-plugin project: structure, version drift, skill quality, workflow integration, hooks, docs, and security scanning (7 attack surfaces including SKILL.md injection, hook configs, and MCP risks). Auto-detects whether you're auditing a full project, single skill, or workflow layer. Outputs a scored JSON baseline plus a layered markdown report with Go/No-Go verdict. Pure measurement tool, it won't fix anything, just tells orchestrating skills like blueprinting or releasing what's broken. Supports local paths, GitHub URLs, or zip files. If you're shipping a plugin or adding new skills to an existing bundle, this catches the structural rot and security holes before they ship.

GitHub stars: 297
last updated: Apr 27, 2026

View on GitHub

Install

$ npx -y skills add odradekai/bundles-forge --skill auditing --agent claude-code

Installs into .claude/skills of the current project.

Files

Auditing Bundle-Plugins

Overview

Systematically evaluate a bundle-plugin project or a single skill across applicable quality categories — including security scanning — score each, and produce a diagnostic report. This skill is a pure diagnostic tool: it identifies and reports issues but does not orchestrate fixes.

Core principle: Measure and report. A scored audit gives orchestrating skills (blueprinting, optimizing, releasing) the information they need to decide what to fix. When sources contradict, apply the authority hierarchy in references/source-of-truth-policy.md.

This skill includes security scanning. No need to invoke a separate security skill — see Category 10 under Full Project Audit.

Announce at start: "I'm using the auditing skill to audit [this project / this skill]."

SKILL.md on GitHub