Use when evaluating, comparing, installing, or recommending a Claude Code plugin, Agent Skill, MCP server, agent toolkit, or GitHub-hosted AI extension, especially when popularity is weak evidence or the candidate requests shell, network, filesystem, or credential access.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Collect comparable evidence about GitHub-hosted agent capabilities before installation. The bundled script uses the GitHub API without cloning a repository. It reports maintenance metadata, license, distribution files, executable surfaces, test signals, and high-risk text patterns. It does not install, authenticate, or declare a project safe.
Convert each candidate to owner/repo or a GitHub repository URL.
Run the script for all credible candidates, not only the popularity leader:
python ${CLAUDE_SKILL_DIR}/scripts/audit.py owner/repo another/repo
Read the exact pinned commit or package that would be installed. The script inspects the current default branch only; say so explicitly.
Open every discovered plugin manifest, SKILL.md frontmatter, hook, MCP configuration, and executable script before recommending installation.
Compare candidates using task fit, blast radius, runtime proof, maintenance, interoperability, rollback, documentation, and adoption. Cap adoption at 5% of the decision.
Report four states separately: discovered, structurally inspected, installed/authenticated, and runtime-tested.
Use --json for machine-readable output and --token-env NAME only when an existing GitHub token environment variable is needed for rate limits. Never paste a token into the command.
SECURITY.md is a review signal, not proof of insecurity.allowed-tools, install scripts, and downloaded binaries define the effective trust boundary.Read ecosystem-discovery-guide.md for the source order, weighted scorecard, research seeds, and installation gate.
Inspect the artifact you will execute, at the version you will execute—not the reputation of its repository.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Use when cutting a release, writing a CHANGELOG entry, or summarizing what changed since a tag — when the repo's commits follow (or mostly follow) Conventional Commits and a mechanically-accurate section breakdown beats a model's reading of the diff.
日本語の概要は準備中です。原文の説明を表示しています。
Use before committing, opening a PR, or reporting a task done — when you want ground-truth confirmation there are no conflict markers, live-looking credentials, debug leftovers, untracked TODOs, or oversized files, without spending a model turn re-reading every file yourself.
日本語の概要は準備中です。原文の説明を表示しています。
Use before publishing documentation, merging a docs PR, or reporting a Markdown-heavy repo's navigation as complete — when you want ground-truth confirmation that internal links, heading anchors, and directory links resolve, without opening every file yourself.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user names a coding or Claude Code task ("add OAuth", "set up hooks", "review this PR", "pick a model"), asks which prompt to use, says to "use the right prompt", or when you enter this repo and need to orient without reading every file.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user names a coding, Claude Code, research, documentation, or technology-selection task; asks which prompt to use; says to use the right prompt; or when an agent enters this repository and needs to orient without reading every file.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a skill isn't triggering as expected, before adding a new skill (to check for a name collision), during periodic cleanup of an accumulated skills directory, or when asked to review skill quality — checks frontmatter validity, description quality against Skill Discovery Optimization conventions, body size, and cross-scope name collisions.
日本語の概要は準備中です。原文の説明を表示しています。