Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/timschoch/skilly --skill audit-skilly-workflow- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads audit-skilly-workflow automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Audit skilly workflow
The harness loads every instruction file side by side. No file wins by default: on a conflict the agent follows either one. This audit finds those conflicts between skilly-installed files and everything else, and reports them. It edits nothing.
1. Run the script
node .agents/skills/audit-skilly-workflow/scripts/audit.mjs
consumer: false → tell the user the reason, stop.
| Field | Holds |
|---|---|
sources | every instruction file: owner (skilly, overlay, repo, global), loaded (always, on-demand), bytes |
skills | name and description of each installed skill |
tier | the repo's tier from .skilly/config.json; a verify step with its own tier runs only at that tier |
gates | skilly commit gate values; verify stages (commit, push, ci, nightly) with their steps; other commit gates and naming linters found in config |
findings | config defects: kind, where, detail |
report | file to write; ignored says whether git ignores it |
2. Confirm the findings
Open each finding at where. A false positive (e.g. a path the text names as optional) → drop it, count it. Done when every finding is kept with a one-line fix or dropped. A config defect you spot later while reading → add it as a kept finding.
3. Extract claims
Read every source in full, always first. A skill description is a claim too: its trigger → use that skill. Read a full SKILL.md only when a source names that skill. Gate values and gates.*.others configs are claims with their own file:line.
Write each instruction as a claim: situation → required action, with file:line. Skip lines with no action.
- Bad: "Delegation" (no action)
- Good: "task finishes in one pass → no subagent" (
.claude/rules/<bundle>-delegation.md:3)
An overlay merges with its base rule. Judge other sources against the merged rule, not the base alone.
Non-skilly sources over 150 KB in total → split them into a few batches of similar size, one subagent per batch, model and effort per the repo's model rule. Pass each the skilly claim list; it returns matched pairs only.
Done when every source has its claims.
4. Match and judge
Match every skilly claim against every other claim by situation, never by shared words. "Stage the work and stop" and "push and open the PR once it is ready" share no word and still collide.
Also match:
- a number or list in text against
gates(text allows 90 chars, the gate allows 72) - an instruction to skip a gate (
-n, a disabled hook) against that gate - a text that says when to run a check ("run the tests before each commit") against the
gates.verifystage that runs it - a hook or CI job that runs a check itself instead of the
verifystage - each entry in
gates.*.others: read its config, compare its values with the skilly gate
Give each pair one kind:
| Kind | Test | Report |
|---|---|---|
| contradiction | following both at once is impossible | flag |
| restatement | same action in other words; drifts on the next edit | flag |
| override | an overlay changes its own base rule | show, never flag: the repo's sanctioned override |
| precedence stated | one side says which source wins | show |
| complement | different situation, or both hold | drop, count |
A value that differs (limit, list, model name) makes a restatement a contradiction.
Done when every skilly claim is matched or marked unmatched.
5. Name the fix owner
Synced skilly files are overwritten on every sync.
| Losing side lives in | Fix |
|---|---|
owner: skilly | never edit in place. Repo deviates on purpose → .claude/rules/<rule>.local.md. Skilly is wrong → issue in timschoch/skilly |
owner: repo | delete the restatement and link the skilly rule, or rewrite to agree, or move a deliberate deviation into .local.md |
| gate config (commitlint, lint, CI, hooks) | one enforcer per rule; align values with the skilly gate |
owner: global | the user edits it; propose the wording |
| a script finding | the file at where; one line of fix |
6. Write the report and stop
Write one self-contained HTML file to report.file. Create its directory. A hook or sandbox blocks the write → tell the user the path and the block, stop. Never write the report somewhere else.
Content:
- flagged: contradictions, restatements, kept findings; each row both quotes with
file:line, kind, fix owner - shown: overrides, precedence stated
- counts: complements and dropped findings
- sources read, with owner
report.ignored is false → tell the user git does not ignore the report. Do not edit .gitignore.
In chat: the report path, counts per kind, and one numbered line per flagged item. Stop. Fix only the items the user picks.
FAQ
What does the audit-skilly-workflow skill do?
Find where the repo's own instructions, the user's global instructions, hooks, lint and CI contradict or duplicate what skilly installed. Writes an HTML report, edits nothing.
How do I install audit-skilly-workflow?
Run npx skills add https://github.com/timschoch/skilly --skill audit-skilly-workflow in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/audit-skilly-workflow/ (personal) or .claude/skills/audit-skilly-workflow/ (project).
Which AI agents can use audit-skilly-workflow?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is audit-skilly-workflow safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains audit-skilly-workflow?
It is published by timschoch in timschoch/skilly. It has 555 recorded installs.
More from timschoch/skilly
git-shortcuts
timschoch/skilly
Translates shorthand git/GitHub workflow commands into the correct sequence of actions. ALWAYS trigger when the user's message contains a "--" prefixed shorthand like: "--c", "--p", "--cp", "--pr", "--prm", "--cppr", "--cpprm", "--ff", "--release", "--pub", "--close" — with or without a trailing "?". The "--" prefix is required — do NOT trigger on bare letters like "c" or "pr" appearing in normal sentences. NEVER invoke this skill autonomously — it MUST always be user-invoked via an explicit "--" shorthand in their message.
cleanup-merged-branches
timschoch/skilly
Delete remote branches whose PR was merged. Read-only dry-run, then confirm, then delete.
step-by-step
timschoch/skilly
Walk the user through a manual procedure step by step, with every value spelled out and every link clickable.
plan-critics
timschoch/skilly
Critiques an implementation plan — or a wayfinder map/ticket — from multiple angles (security, simplicity, edge cases, scope creep, codebase conflicts, tech-specific best practices) via parallel critic subagents. Trigger: user says "kritisiere den plan", "plan check", "plan-kritik", "blinde flecken", "/plan-critics" — also invoke when a planning agent wants to validate its own plan before presenting it, or a wayfinder session wants a resolution checked before closing a ticket. Must be called at top-level (not inside a subagent) — it uses the Task tool.
qa
timschoch/skilly
Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions "QA session".
1-3-1
timschoch/skilly
Frame a problem or decision as 1-3-1: one problem, three distinct solutions, one recommendation. Use when the user brings a non-trivial decision or fork and wants options weighed before a pick ("what should I do about X", "help me decide", "weigh the tradeoffs"), or names "1-3-1" or "do a 131". Skip questions with one right answer, just answer those.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.