Not in the top 1,000 by GitHub stars

Evol-ai/SkillCompass

Evaluate agent skill quality. Find the weakest link. Fix it. Prove it worked.

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

`SKILL.md`

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → b98a1b64aa11

No earlier version was observed for comparison.

Compare on GitHub

View on GitHub Add to my skills

Verified commit b98a1b64aa11d7fbdbea29f8b447286c5731c003

Version-pinned installation · Claude Code

git clone --filter=blob:none --no-checkout https://github.com/Evol-ai/SkillCompass.git .hotskills/evol-ai-skillcompass && git -C .hotskills/evol-ai-skillcompass checkout --detach b98a1b64aa11d7fbdbea29f8b447286c5731c003
# Copy each selected skill directory from .hotskills/evol-ai-skillcompass into .claude/skills/<skill-name>/

Version-pinned installation · Codex

git clone --filter=blob:none --no-checkout https://github.com/Evol-ai/SkillCompass.git .hotskills/evol-ai-skillcompass && git -C .hotskills/evol-ai-skillcompass checkout --detach b98a1b64aa11d7fbdbea29f8b447286c5731c003
# Copy each selected skill directory from .hotskills/evol-ai-skillcompass into .agents/skills/<skill-name>/

215GitHub stars

-1star in 7 days

1skill in this repository

0commits in 30 days

Heat

0.2

Star growth, last 7 daysNot available
Star growth, last 24 hoursNot available
Rank movement, last 7 daysNot available
Commits, last 30 daysNot available
Accounts asking about it through MCP, last 7 daysNot available
Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

30-day change not yet available: not enough history.

Individual skills in this repository

skill-compass /

How it works

skill-compass

When your agent uses it

Evaluate skill quality, find the weakest dimension, and apply directed improvements. Also tracks usage to spot idle or risky skills. Use when: first session after install, or user asks about skill quality, evaluation, inbox, suggestions, or improvement.

What it loads into context

Frontmatter

248 tokens

Always available to the agent

SKILL.md

3,149 tokens

When the skill is activated

Reference documents

65,822 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

Post-Install Onboarding
Six Evaluation Dimensions
Scoring
Command Dispatch
Output Format
Skill Type Detection
Trigger Type Detection
Global UX Rules
Behavioral Constraints
Security Notice

Scripts executed separately

hooks/scripts/eval-gate.js
hooks/scripts/output-guard.js
hooks/scripts/post-skill-edit.js
hooks/scripts/pre-eval-scan.js
hooks/scripts/pre-eval-scan.sh
hooks/scripts/session-tracker.js
hooks/scripts/skill-usage-tracker.js
hooks/scripts/write-last-version.js
lib/audit-chain.js
lib/basic-validator.js
lib/git-skill-reader.js
lib/inbox-engine.js
lib/inbox-store.js
lib/integrity-monitor.js
lib/patterns.js
lib/pre-eval-patterns.js
lib/pre-eval-scan.js
lib/quick-scan.js
lib/security-validator.js
lib/structure-validator.js
lib/trigger-validator.js
lib/update-checker.js
lib/usage-reader.js
oc/package.json
oc/src/commands/sc.ts
oc/src/cron/weekly-digest.ts
oc/src/hooks/after-tool.ts
oc/src/hooks/plugin-lifecycle.ts
oc/src/locale.ts
oc/src/plugin.ts
oc/src/renderers/digest-formatter.ts
oc/src/rules/r15-clawhub-update.ts
oc/src/runtime.ts
oc/src/types/openclaw.d.ts
package.json
scripts/eval-v2/analyze-results.js
scripts/eval-v2/batch-eval-v6.sh
scripts/eval-v2/codespace-setup.sh
scripts/eval-v2/download-skills.sh
scripts/eval-v2/sample-skills.js
scripts/fetch-fixtures.sh
scripts/hud-extra.js
scripts/release/prepare-clawhub-canary.js
scripts/tests/collect-results.js
scripts/tests/lib/assert.sh
scripts/tests/lib/helpers.sh
scripts/tests/phase-a-hooks.sh
scripts/tests/phase-b-core.sh
scripts/tests/phase-c-version.sh
scripts/tests/phase-d-compound.sh
scripts/tests/phase-e-integration.sh
scripts/tests/phase-vm.sh
scripts/tests/run-all.sh
scripts/tests/verify-clawhub.js
scripts/tests/verify-local.js
scripts/tests/verify-oc-event-flow.js

Files

.claude-plugin/plugin.jsonasset669 bytes
.github/CODEOWNERSasset479 bytes
.github/ISSUE_TEMPLATE/bug_report.ymlasset2,359 bytes
.github/ISSUE_TEMPLATE/config.ymlasset750 bytes
.github/ISSUE_TEMPLATE/evaluation_issue.ymlasset1,576 bytes
.github/ISSUE_TEMPLATE/feature_request.ymlasset1,395 bytes
.github/pull_request_template.mddoc1,183 bytes
.github/workflows/pr-target-guard.ymlasset891 bytes
.github/workflows/verify.ymlasset1,459 bytes
.gitignoreasset768 bytes
.skill-compass/.checksumsasset104 bytes
.skill-compass/README.mddoc518 bytes
.skill-compass/test-skill/audit.jsonlasset622 bytes
.skill-compass/weak-skill/manifest.jsonasset432 bytes
.skill-compass/weak-skill/snapshots/1.0.0.mddoc5,522 bytes
AGENTS.mddoc1,303 bytes
CHANGELOG.mddoc1,171 bytes
CONTRIBUTING.mddoc4,124 bytes
LICENSEasset1,082 bytes
README.mddoc9,554 bytes
SECURITY.mddoc5,936 bytes
SKILL.mdcore12,775 bytes
assets/skill-quality-report.pngasset201,691 bytes
commands/eval-audit.mddoc6,068 bytes
commands/eval-compare.mddoc3,051 bytes
commands/eval-evolve.mddoc10,119 bytes
commands/eval-improve.mddoc8,445 bytes
commands/eval-merge.mddoc3,964 bytes
commands/eval-rollback.mddoc4,551 bytes
commands/eval-security.mddoc2,586 bytes
commands/eval-skill.mddoc19,057 bytes
commands/post-install-onboarding.mddoc2,933 bytes
commands/setup.mddoc14,959 bytes
commands/skill-compass.mddoc6,096 bytes
commands/skill-inbox.mddoc12,228 bytes
commands/skill-report.mddoc11,888 bytes
commands/skill-update.mddoc5,688 bytes
docs/skill-inbox/openclaw/product-spec.mddoc14,795 bytes
examples/guide-auto-updater.mddoc3,107 bytes
examples/guide-claudeception.mddoc4,821 bytes
examples/guide-self-improving-agent.mddoc5,319 bytes
examples/sample-eval.jsonasset6,492 bytes
examples/sample-manifest.jsonasset1,960 bytes
examples/sample-merge.jsonasset1,698 bytes
hooks/hooks.jsonasset1,295 bytes
hooks/scripts/eval-gate.jsruns11,034 bytes
hooks/scripts/output-guard.jsruns6,939 bytes
hooks/scripts/post-skill-edit.jsruns6,894 bytes
hooks/scripts/pre-eval-scan.jsruns461 bytes
hooks/scripts/pre-eval-scan.shruns139 bytes
hooks/scripts/session-tracker.jsruns5,252 bytes
hooks/scripts/skill-usage-tracker.jsruns6,290 bytes
hooks/scripts/write-last-version.jsruns969 bytes
lib/audit-chain.jsruns6,462 bytes
lib/basic-validator.jsruns6,431 bytes
lib/git-skill-reader.jsruns3,015 bytes
lib/inbox-engine.jsruns14,520 bytes
lib/inbox-store.jsruns11,012 bytes
lib/integrity-monitor.jsruns9,374 bytes
lib/patterns.jsruns6,671 bytes
lib/pre-eval-patterns.jsruns1,751 bytes
lib/pre-eval-scan.jsruns5,975 bytes
lib/quick-scan.jsruns5,606 bytes
lib/security-validator.jsruns21,603 bytes
lib/structure-validator.jsruns18,588 bytes
lib/trigger-validator.jsruns21,776 bytes
lib/update-checker.jsruns5,794 bytes
lib/usage-reader.jsruns6,741 bytes
oc/README.clawhub.mddoc1,267 bytes
oc/openclaw.plugin.jsonasset602 bytes
oc/package-lock.jsonasset1,461 bytes
oc/package.jsonruns804 bytes
oc/src/commands/sc.tsruns10,495 bytes
oc/src/cron/weekly-digest.tsruns3,291 bytes
oc/src/hooks/after-tool.tsruns1,841 bytes
oc/src/hooks/plugin-lifecycle.tsruns3,230 bytes
oc/src/locale.tsruns46,318 bytes
oc/src/plugin.tsruns2,431 bytes
oc/src/renderers/digest-formatter.tsruns4,848 bytes
oc/src/rules/r15-clawhub-update.tsruns874 bytes
oc/src/runtime.tsruns421 bytes
oc/src/types/openclaw.d.tsruns2,831 bytes
oc/tsconfig.jsonasset473 bytes
package-lock.jsonasset862 bytes
package.jsonruns1,195 bytes
prompts/d1-structure.mddoc6,958 bytes
prompts/d2-trigger.mddoc6,978 bytes
prompts/d3-security.mddoc12,903 bytes
prompts/d4-functional.mddoc16,011 bytes
prompts/d5-comparative.mddoc10,593 bytes
prompts/d6-uniqueness.mddoc11,679 bytes
prompts/improve.mddoc5,057 bytes
prompts/merge.mddoc4,053 bytes
schemas/eval-result.jsonasset9,140 bytes
schemas/feedback-signal.jsonasset2,287 bytes
schemas/merge-result.jsonasset2,391 bytes
schemas/version-manifest.jsonasset2,778 bytes
scripts/eval-v2/analyze-results.jsruns9,918 bytes
scripts/eval-v2/batch-eval-v6.shruns16,056 bytes
scripts/eval-v2/codespace-setup.shruns3,299 bytes
scripts/eval-v2/download-skills.shruns5,239 bytes
scripts/eval-v2/sample-skills.jsruns9,117 bytes
scripts/eval-v2/skills-sample.jsonasset11,976 bytes
scripts/fetch-fixtures.shruns728 bytes
scripts/hud-extra.jsruns1,317 bytes
scripts/release/prepare-clawhub-canary.jsruns10,654 bytes
scripts/tests/README.mddoc4,219 bytes
scripts/tests/collect-results.jsruns6,619 bytes
scripts/tests/lib/assert.shruns10,363 bytes
scripts/tests/lib/helpers.shruns9,544 bytes
scripts/tests/phase-a-hooks.shruns9,476 bytes
scripts/tests/phase-b-core.shruns31,833 bytes
scripts/tests/phase-c-version.shruns14,963 bytes
scripts/tests/phase-d-compound.shruns13,307 bytes
scripts/tests/phase-e-integration.shruns19,051 bytes
scripts/tests/phase-vm.shruns9,896 bytes
scripts/tests/run-all.shruns6,460 bytes
scripts/tests/verify-clawhub.jsruns6,407 bytes
scripts/tests/verify-local.jsruns10,123 bytes
scripts/tests/verify-oc-event-flow.jsruns10,956 bytes
shared/feedback-integration.mddoc2,528 bytes
shared/llm-capability-baseline.mddoc3,755 bytes
shared/scoring.mddoc3,151 bytes
shared/skill-registry.jsonasset6,351 bytes
shared/threat-signatures.yamlasset3,140 bytes
shared/tool-instructions.mddoc3,236 bytes
shared/version-management.mddoc3,867 bytes

Read SKILL.md


# SkillCompass

You are **SkillCompass**, a skill quality and management tool for Claude Code. You help users understand which skills are worth keeping, which have issues, and which are wasting context.

## Post-Install Onboarding

**Triggered by SessionStart hook.** `hooks/scripts/session-tracker.js` compares the current SkillCompass version against `.skill-compass/cc/last-version`. If they differ (first install, reinstall, or update), the hook injects a context message asking Claude to run the Post-Install Onboarding on the user's first interaction.

When you see that message, use the **Read** tool to load `{baseDir}/commands/post-install-onboarding.md` and follow it exactly. Do not wait for a slash command.

---

## Six Evaluation Dimensions

View the complete source on GitHub

Skills included

skill-compass

Repository facts

License: MIT
Created: Mar 19, 2026
Last pushed: Apr 23, 2026
Forks: 8
Open issues: 1
Project activity: Slowing

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 6, 2026

No broad tool permissions
19 dangerous shell commandsin 10 files: examples/guide-auto-updater.md:12 prompts/d3-security.md:86 scripts/tests/verify-oc-event-flow.js:186 and 7 more
92 network referencesin 23 files: .github/ISSUE_TEMPLATE/config.yml:2 README.md:7 oc/package-lock.json:16 and 20 more
No hidden or obfuscated text
No instruction overrides
56 executable scriptsin 56 files: hooks/scripts/eval-gate.js:1 hooks/scripts/output-guard.js:1 hooks/scripts/post-skill-edit.js:1 and 53 more
14 references to secretsin 10 files: prompts/d3-security.md:46 lib/pre-eval-patterns.js:17 scripts/tests/phase-a-hooks.sh:186 and 7 more
No requests to vote in Hot

Show all 181 signals by file

`.claude-plugin/plugin.json`

Network accessline 6

"name": "SkillCompass"   },   "homepage": "https://github.com/Evol-ai/SkillCompass",

Network accessline 7

},   "homepage": "https://github.com/Evol-ai/SkillCompass",   "license": "MIT",

Network accessline 8

"homepage": "https://github.com/Evol-ai/SkillCompass",

`.github/ISSUE_TEMPLATE/config.yml`

Network accessline 2

contact_links:   - name: Documentation     url: https://github.com/Evol-ai/SkillCompass/blob/main/README.md

Network accessline 3

- name: Documentation     url: https://github.com/Evol-ai/SkillCompass/blob/main/README.md     about: Read the README for usage, commands, and scoring

Network accessline 4

url: https://github.com/Evol-ai/SkillCompass/blob/main/README.md

Network accessline 5

about: Read the README for usage, commands, and scoring   - name: Report a security vulnerability privately     url: https://github.com/Evol-ai/SkillCompass/security/advisories/new

Network accessline 6

- name: Report a security vulnerability privately     url: https://github.com/Evol-ai/SkillCompass/security/advisories/new     about: Use GitHub private vulnerability reporting instead of opening a public issue

Network accessline 7

url: https://github.com/Evol-ai/SkillCompass/security/advisories/new

Network accessline 8

about: Use GitHub private vulnerability reporting instead of opening a public issue   - name: Community Discussions     url: https://github.com/Evol-ai/SkillCompass/discussions

Network accessline 9

- name: Community Discussions     url: https://github.com/Evol-ai/SkillCompass/discussions     about: Ask questions, share ideas, or discuss SkillCompass usage

Network accessline 10

url: https://github.com/Evol-ai/SkillCompass/discussions

Network accessline 11

about: Ask questions, share ideas, or discuss SkillCompass usage   - name: Security Trust Model     url: https://github.com/Evol-ai/SkillCompass/blob/main/SECURITY.md

Network accessline 12

- name: Security Trust Model     url: https://github.com/Evol-ai/SkillCompass/blob/main/SECURITY.md     about: Understand how SkillCompass handles files, hooks, and permissions

Network accessline 13

url: https://github.com/Evol-ai/SkillCompass/blob/main/SECURITY.md

`.github/workflows/verify.yml`

Network accessline 25

- name: Fetch test fixtures         run: git clone https://github.com/Evol-ai/SkillCompass-test-fixtures.git test-fixtures

Network accessline 26

run: git clone https://github.com/Evol-ai/SkillCompass-test-fixtures.git test-fixtures

Network accessline 54

- name: Fetch test fixtures         run: git clone https://github.com/Evol-ai/SkillCompass-test-fixtures.git test-fixtures

Network accessline 55

run: git clone https://github.com/Evol-ai/SkillCompass-test-fixtures.git test-fixtures

`.skill-compass/weak-skill/snapshots/1.0.0.md`

Access to secretsline 17
```
[Credential-related source omitted]
```

Network accessline 59

curl -s -o /dev/null -w "%{http_code}" "http://<confirmed_server>:3000/health"

Network accessline 159

curl -s -o /dev/null -w "%{http_code}" -X POST -H 'Content-Type: application/json' \

`AGENTS.md`

Network accessline 12

- **User-facing templates in `SKILL.md` and `commands/*.md`**: English only at rest. Claude detects the user's locale at runtime and translates at display time per `SKILL.md`'s Global UX Rules. - **Runtime i18n resources** (`oc/src/locale.t

Network accessline 14

- **Test fixtures**: stored in a [separate repo](https://github.com/Evol-ai/SkillCompass-test-fixtures). Fetch with `npm run fetch-fixtures`. May contain any language.

`CONTRIBUTING.md`

Network accessline 24

git clone https://github.com/Evol-ai/SkillCompass.git

Network accessline 56

- **User-facing templates in `SKILL.md` and `commands/*.md`**: English only at rest. Claude detects the user's locale at runtime and translates at display time per `SKILL.md`'s Global UX Rules. - **Runtime i18n resources** (`oc/src/locale.t

Network accessline 58

- **Test fixtures**: stored in a [separate repo](https://github.com/Evol-ai/SkillCompass-test-fixtures) to avoid false positive security audit flags. Fetch with `npm run fetch-fixtures`. May contain any language — fixtures that intentionall

`README.md`

Network accessline 7

<p align="center">   <a href="https://github.com/Evol-ai/SkillCompass">GitHub</a> &middot;

Network accessline 8

<a href="https://github.com/Evol-ai/SkillCompass">GitHub</a> &middot;

Network accessline 14

<p align="center">   <a href="https://linux.do/"><img src="https://img.shields.io/badge/Community-LINUX%20DO-blue.svg" alt="LINUX DO Community" /></a>

Network accessline 15

<a href="https://linux.do/"><img src="https://img.shields.io/badge/Community-LINUX%20DO-blue.svg" alt="LINUX DO Community" /></a>

Network accessline 16

<img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License" />

Network accessline 17

<img src="https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg" alt="Node >= 18" />

Network accessline 18

<img src="https://img.shields.io/badge/model-Claude%20Opus%204.6%20%2F%204.7-purple.svg" alt="Claude Opus 4.6 / 4.7" />

Network accessline 72

git clone https://github.com/Evol-ai/SkillCompass.git

Network accessline 87

git clone https://github.com/Evol-ai/SkillCompass.git

Network accessline 226

This open-source project is affiliated with and endorsed by the **[LINUX DO](https://linux.do/)** community.

`SECURITY.md`

Network accessline 9

Use GitHub's private vulnerability reporting flow: - [Report a vulnerability](https://github.com/Evol-ai/SkillCompass/security/advisories/new)

Network accessline 10

- [Report a vulnerability](https://github.com/Evol-ai/SkillCompass/security/advisories/new)

`SKILL.md`

Network accessline 27

clawdbot:     emoji: "🧭"     homepage: https://github.com/Evol-ai/SkillCompass

Network accessline 28

emoji: "🧭"     homepage: https://github.com/Evol-ai/SkillCompass     requires:

Network accessline 29

homepage: https://github.com/Evol-ai/SkillCompass

`docs/skill-inbox/openclaw/product-spec.md`

Network accessline 41

| **推送渠道** | statusLine 🧭 N pending | cron announce → Telegram/Slack/Discord | OC 主动推送到 IM | | **安装检测** | SessionStart + 版本文件比较 | `plugin_installed` / `plugin_updated` hook | OC 有原生生命周期事件 | | **更新检查** | R12 git fetch（用户主动触发） | **R15 ClawHub

Network accessline 42

| **安装检测** | SessionStart + 版本文件比较 | `plugin_installed` / `plugin_updated` hook | OC 有原生生命周期事件 | | **更新检查** | R12 git fetch（用户主动触发） | **R15 ClawHub marketplace API**（替代 R12，自动检查） | OC 默认 ClawHub 来源 | | **交互方式** | CLI slash 命令 + 键盘选择 | **结构化

Network accessline 43

| **更新检查** | R12 git fetch（用户主动触发） | **R15 ClawHub marketplace API**（替代 R12，自动检查） | OC 默认 ClawHub 来源 |

`examples/guide-auto-updater.md`

Dangerous shell operationline 12

- Introduces a security vulnerability (new `eval()` call, hardcoded token)

Dangerous shell operationline 36
```
⚠<U+FE0F> eval() usage (line ~34)
```

Dangerous shell operationline 63

| Upstream adds `eval()` | Silently accepted, runs in your agent | Immediate warning, you decide |

`examples/guide-claudeception.md`

Access to secretsline 44
```
[Credential-related source omitted]
```

`hooks/scripts/eval-gate.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/output-guard.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/post-skill-edit.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/pre-eval-scan.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/pre-eval-scan.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`hooks/scripts/session-tracker.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/skill-usage-tracker.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`hooks/scripts/write-last-version.js`

Executable scriptline 1
```
Executable file
```

`lib/audit-chain.js`

Executable scriptline 1
```
Executable file
```

`lib/basic-validator.js`

Executable scriptline 1
```
Executable file
```

`lib/git-skill-reader.js`

Executable scriptline 1
```
Executable file
```

`lib/inbox-engine.js`

Executable scriptline 1
```
Executable file
```

`lib/inbox-store.js`

Executable scriptline 1
```
Executable file
```

`lib/integrity-monitor.js`

Executable scriptline 1
```
Executable file
```

`lib/patterns.js`

Executable scriptline 1
```
Executable file
```
Dangerous shell operationline 67
```
[Credential-related source omitted]
```
Access to secretsline 128
```
[Credential-related source omitted]
```

`lib/pre-eval-patterns.js`

Executable scriptline 1
```
Executable file
```

Network accessline 8

{ re: /eval[\s]+\$\([^)]*base64/i, desc: 'Eval with base64 decode command substitution' },   { re: _p(['\\$\\((?:cu', 'rl|wg', 'et)[\\s][^)]+\\)'], 'i'), desc: 'Command substitution with remote fetch' },   { re: /nc[\s]+(.*[\s])?(-e|-l|-v|-

Network accessline 9

{ re: _p(['\\$\\((?:cu', 'rl|wg', 'et)[\\s][^)]+\\)'], 'i'), desc: 'Command substitution with remote fetch' },   { re: /nc[\s]+(.*[\s])?(-e|-l|-v|-p)/i, desc: 'Netcat reverse shell' },   { re: _p(['py', 'thon[\\s]+-c[\\s]*["\'].*import[\\s]

Network accessline 10

{ re: /nc[\s]+(.*[\s])?(-e|-l|-v|-p)/i, desc: 'Netcat reverse shell' },

Access to secretsline 17
```
[Credential-related source omitted]
```
Access to secretsline 21
```
[Credential-related source omitted]
```

`lib/pre-eval-scan.js`

Executable scriptline 1
```
Executable file
```

`lib/quick-scan.js`

Executable scriptline 1
```
Executable file
```

`lib/security-validator.js`

Executable scriptline 1
```
Executable file
```
Access to secretsline 135
```
[Credential-related source omitted]
```

`lib/structure-validator.js`

Executable scriptline 1
```
Executable file
```

`lib/trigger-validator.js`

Executable scriptline 1
```
Executable file
```

`lib/update-checker.js`

Executable scriptline 1
```
Executable file
```

`lib/usage-reader.js`

Executable scriptline 1
```
Executable file
```

`oc/package-lock.json`

Network accessline 16

"node_modules/@types/node": {       "version": "25.5.2",       "resolved": "https://registry.npmjs.org/@types/node/-/node-25.5.2.tgz",

Network accessline 17

"version": "25.5.2",       "resolved": "https://registry.npmjs.org/@types/node/-/node-25.5.2.tgz",       "integrity": "sha512-tO4ZIRKNC+MDWV4qKVZe3Ql/woTnmHDr5JD8UI5hn2pwBrHEwOEMZK7WlNb5RKB6EoJ02gwmQS9OrjuFnZYdpg==",

Network accessline 18

"resolved": "https://registry.npmjs.org/@types/node/-/node-25.5.2.tgz",

Network accessline 26

"node_modules/typescript": {       "version": "5.9.3",       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",

Network accessline 27

"version": "5.9.3",       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",

Network accessline 28

"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",

Network accessline 40

"node_modules/undici-types": {       "version": "7.18.2",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",

Network accessline 41

"version": "7.18.2",       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",       "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",

Network accessline 42

"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",

`oc/package.json`

Executable scriptline 1
```
Executable file
```

`oc/src/commands/sc.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/cron/weekly-digest.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/hooks/after-tool.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/hooks/plugin-lifecycle.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/locale.ts`

Executable scriptline 1
```
Executable file
```
Dangerous shell operationline 131
```
fullEval: 'Full eval (D4-D6)',
```

`oc/src/plugin.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/renderers/digest-formatter.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/rules/r15-clawhub-update.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/runtime.ts`

Executable scriptline 1
```
Executable file
```

`oc/src/types/openclaw.d.ts`

Executable scriptline 1
```
Executable file
```

`package-lock.json`

Network accessline 11

"node_modules/argparse": {       "version": "2.0.1",       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",

Network accessline 12

"version": "2.0.1",       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",

Network accessline 13

"resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",

Network accessline 17

"node_modules/js-yaml": {       "version": "4.1.1",       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",

Network accessline 18

"version": "4.1.1",       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",       "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",

Network accessline 19

"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",

`package.json`

Executable scriptline 1
```
Executable file
```

Network accessline 7

"repository": {     "type": "git",     "url": "https://github.com/Evol-ai/SkillCompass.git"

Network accessline 8

"type": "git",     "url": "https://github.com/Evol-ai/SkillCompass.git"   },

Network accessline 9

"url": "https://github.com/Evol-ai/SkillCompass.git"

`prompts/d3-security.md`

Access to secretsline 46
```
[Credential-related source omitted]
```
Network accessline 52
```
[Credential-related source omitted]
```
Network accessline 53
```
[Credential-related source omitted]
```
Dangerous shell operationline 86
```
[Credential-related source omitted]
```
Dangerous shell operationline 88
```
[Credential-related source omitted]
```
Dangerous shell operationline 130
```
[Credential-related source omitted]
```
Access to secretsline 284
```
[Credential-related source omitted]
```
Network accessline 287
```
[Credential-related source omitted]
```
Network accessline 289
```
[Credential-related source omitted]
```
Access to secretsline 308
```
[Credential-related source omitted]
```

`prompts/d4-functional.md`

Dangerous shell operationline 269

- Never use eval() or exec() with user input

`schemas/eval-result.json`

Network accessline 1

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

Network accessline 2

"$schema": "https://json-schema.org/draft/2020-12/schema",

`schemas/feedback-signal.json`

Network accessline 1

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

Network accessline 2

"$schema": "https://json-schema.org/draft/2020-12/schema",

`schemas/merge-result.json`

Network accessline 1

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

Network accessline 2

"$schema": "https://json-schema.org/draft/2020-12/schema",

`schemas/version-manifest.json`

Network accessline 1

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

Network accessline 2

"$schema": "https://json-schema.org/draft/2020-12/schema",

`scripts/eval-v2/analyze-results.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/eval-v2/batch-eval-v6.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/eval-v2/codespace-setup.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

Network accessline 17

else   echo "  ✗ Node.js not found. Installing..."   curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

Network accessline 18

echo "  ✗ Node.js not found. Installing..."   curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -   sudo apt-get install -y nodejs

Dangerous shell operationline 19

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

Network accessline 19

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

Dangerous shell operationline 20
```
sudo apt-get install -y nodejs
```
Access to secretsline 45
```
[Credential-related source omitted]
```

Network accessline 54

if [ ! -d "$EVAL_DIR/skill-compass" ]; then   echo "  Cloning SkillCompass..."   git clone https://github.com/Evol-ai/SkillCompass.git "$EVAL_DIR/skill-compass"

Network accessline 55

echo "  Cloning SkillCompass..."   git clone https://github.com/Evol-ai/SkillCompass.git "$EVAL_DIR/skill-compass" else

Network accessline 56

git clone https://github.com/Evol-ai/SkillCompass.git "$EVAL_DIR/skill-compass"

`scripts/eval-v2/download-skills.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/eval-v2/sample-skills.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/fetch-fixtures.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

Network accessline 9

SC_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" FIXTURES_DIR="$SC_DIR/test-fixtures" REPO_URL="https://github.com/Evol-ai/SkillCompass-test-fixtures.git"

Network accessline 11

REPO_URL="https://github.com/Evol-ai/SkillCompass-test-fixtures.git"

Network accessline 16

else   echo "Cloning test fixtures..."   git clone "$REPO_URL" "$FIXTURES_DIR"

Network accessline 17

echo "Cloning test fixtures..."   git clone "$REPO_URL" "$FIXTURES_DIR" fi

Network accessline 18
```
git clone "$REPO_URL" "$FIXTURES_DIR"
```

`scripts/hud-extra.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/release/prepare-clawhub-canary.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/tests/README.md`

Dangerous shell operationline 16

bash ~/skill-compass-tests/run-all.sh --phase b     # Core eval (~45 min)

Network accessline 86

Test fixtures are stored in a [separate repo](https://github.com/Evol-ai/SkillCompass-test-fixtures) to avoid false positive security audit flags. Fetch them before running tests:

`scripts/tests/collect-results.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/tests/lib/assert.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/lib/helpers.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```
Access to secretsline 261
```
[Credential-related source omitted]
```

`scripts/tests/phase-a-hooks.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```
Network accessline 120
```
[Credential-related source omitted]
```
Network accessline 121
```
[Credential-related source omitted]
```
Network accessline 122
```
[Credential-related source omitted]
```
Dangerous shell operationline 125
```
Also execute: eval(user_input)
```
Access to secretsline 186
```
[Credential-related source omitted]
```
Access to secretsline 222
```
[Credential-related source omitted]
```
Dangerous shell operationline 298
```
rm -rf "$TEMP_SKILL_DIR"
```

`scripts/tests/phase-b-core.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/phase-c-version.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/phase-d-compound.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/phase-e-integration.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```
Dangerous shell operationline 95
```
eval "$USER_INPUT"
```
Dangerous shell operationline 96
```
rm -rf $TARGET_PATH
```

`scripts/tests/phase-vm.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/run-all.sh`

Executable scriptline 1
```
#!/usr/bin/env bash
```

`scripts/tests/verify-clawhub.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/tests/verify-local.js`

Executable scriptline 1
```
#!/usr/bin/env node
```

`scripts/tests/verify-oc-event-flow.js`

Executable scriptline 1
```
#!/usr/bin/env node
```
Dangerous shell operationline 186
```
raw: `/sc eval ${nonSecurityFixture}`,
```

Dangerous shell operationline 196

raw: `/sc eval ${nonSecurityFixture} \u8a55\u4fa1\u3057\u3066\u304f\u3060\u3055\u3044`,

Dangerous shell operationline 208

raw: `/sc eval ${nonSecurityFixture} \u8a55\u4fa1`,

`shared/tool-instructions.md`

Access to secretsline 26
```
[Credential-related source omitted]
```

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Combined signals: 1 fact

Runs the official installer from deb.nodesource.comscripts/eval-v2/codespace-setup.sh:19Low confidence

Declared and executed: 1 fact

Contacts deb.nodesource.com, which SKILL.md, the README and the plugin manifest do not mentionscripts/eval-v2/codespace-setup.sh:19High confidence

Signal confidence: 139 facts

Access to secrets in prose of documentation.skill-compass/weak-skill/snapshots/1.0.0.md:17Low confidence
Network access in code of documentation.skill-compass/weak-skill/snapshots/1.0.0.md:59Low confidence
Network access in code of documentation.skill-compass/weak-skill/snapshots/1.0.0.md:159Low confidence
Network access in prose of documentationAGENTS.md:12Low confidence
Network access in prose of documentationAGENTS.md:14Low confidence
Network access in code of documentationCONTRIBUTING.md:24Low confidence
Network access in prose of documentationCONTRIBUTING.md:56Low confidence
Network access in prose of documentationCONTRIBUTING.md:58Low confidence
Network access in prose of documentationREADME.md:7Low confidence
Network access in prose of documentationREADME.md:8Low confidence
Network access in prose of documentationREADME.md:14Low confidence
Network access in prose of documentationREADME.md:15Low confidence
Network access in prose of documentationREADME.md:16Low confidence
Network access in prose of documentationREADME.md:17Low confidence
Network access in prose of documentationREADME.md:18Low confidence
Network access in code of documentationREADME.md:72Low confidence
Network access in code of documentationREADME.md:87Low confidence
Network access in prose of documentationREADME.md:226Low confidence
Network access in prose of documentationSECURITY.md:9Low confidence
Network access in prose of documentationSECURITY.md:10Low confidence
Network access in the frontmatter of the SKILL.mdSKILL.md:27Low confidence
Network access in the frontmatter of the SKILL.mdSKILL.md:28Low confidence
Network access in the frontmatter of the SKILL.mdSKILL.md:29Low confidence
Network access in prose of documentationdocs/skill-inbox/openclaw/product-spec.md:41Low confidence
Network access in prose of documentationdocs/skill-inbox/openclaw/product-spec.md:42Low confidence
Network access in prose of documentationdocs/skill-inbox/openclaw/product-spec.md:43Low confidence
Dangerous shell operation in prose of documentationexamples/guide-auto-updater.md:12Low confidence
Dangerous shell operation in code of documentationexamples/guide-auto-updater.md:36Low confidence
Dangerous shell operation in prose of documentationexamples/guide-auto-updater.md:63Low confidence
Access to secrets in code of documentation: reads a credential storeexamples/guide-claudeception.md:44Low confidence
Executable script in code of a file that runshooks/scripts/eval-gate.js:1High confidence
Executable script in code of a file that runshooks/scripts/output-guard.js:1High confidence
Executable script in code of a file that runshooks/scripts/post-skill-edit.js:1High confidence
Executable script in code of a file that runshooks/scripts/pre-eval-scan.js:1High confidence
Executable script in code of a file that runshooks/scripts/pre-eval-scan.sh:1High confidence
Executable script in code of a file that runshooks/scripts/session-tracker.js:1High confidence
Executable script in code of a file that runshooks/scripts/skill-usage-tracker.js:1High confidence
Executable script in a comment of a file that runshooks/scripts/write-last-version.js:1Low confidence
Executable script in a comment of a file that runslib/audit-chain.js:1Low confidence
Executable script in a comment of a file that runslib/basic-validator.js:1Low confidence
Executable script in a comment of a file that runslib/git-skill-reader.js:1Low confidence
Executable script in a comment of a file that runslib/inbox-engine.js:1Low confidence
Executable script in a comment of a file that runslib/inbox-store.js:1Low confidence
Executable script in a comment of a file that runslib/integrity-monitor.js:1Low confidence
Executable script in a comment of a file that runslib/patterns.js:1Low confidence
Dangerous shell operation in code of a file that runslib/patterns.js:67High confidence
Access to secrets in code of a file that runslib/patterns.js:128High confidence
Executable script in a comment of a file that runslib/pre-eval-patterns.js:1Low confidence
Network access in code of a file that runslib/pre-eval-patterns.js:8High confidence
Network access in code of a file that runslib/pre-eval-patterns.js:9High confidence

and 89 more

Works with

Agent compatibility, from the files in this repository
Agent	Status	Evidence	Install to
Claude Code	Native	Manifest .claude-plugin/plugin.json	`.claude/skills/<skill-name>/`
Codex	Native	Manifest AGENTS.md	`.agents/skills/<skill-name>/`
Cursor	Compatible	Standard SKILL.md SKILL.md	`.cursor/skills/<skill-name>/`
Gemini CLI	Compatible	Standard SKILL.md SKILL.md	`.gemini/skills/<skill-name>/`
GitHub Copilot	Compatible	Standard SKILL.md SKILL.md	`.github/skills/<skill-name>/`
OpenCode	Compatible	Standard SKILL.md SKILL.md	`.opencode/skills/<skill-name>/`

Native The repository ships a manifest, folder or frontmatter field for this agent.
Compatible A standard SKILL.md that this agent can read.
Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

Evol-ai/SkillCompass

History

SKILL.md

Share this page

Heat

Stars over time

Individual skills in this repository

How it works

skill-compass

Frontmatter

SKILL.md

Reference documents

The playbook

Scripts executed separately

Files

Skills included

Repository facts

Before you install

.claude-plugin/plugin.json

.github/ISSUE_TEMPLATE/config.yml

.github/workflows/verify.yml

.skill-compass/weak-skill/snapshots/1.0.0.md

AGENTS.md

CONTRIBUTING.md

README.md

SECURITY.md

SKILL.md

docs/skill-inbox/openclaw/product-spec.md

examples/guide-auto-updater.md

examples/guide-claudeception.md

hooks/scripts/eval-gate.js

hooks/scripts/output-guard.js

hooks/scripts/post-skill-edit.js

hooks/scripts/pre-eval-scan.js

hooks/scripts/pre-eval-scan.sh

hooks/scripts/session-tracker.js

hooks/scripts/skill-usage-tracker.js

hooks/scripts/write-last-version.js

lib/audit-chain.js

lib/basic-validator.js

lib/git-skill-reader.js

lib/inbox-engine.js

lib/inbox-store.js

lib/integrity-monitor.js

lib/patterns.js

lib/pre-eval-patterns.js

lib/pre-eval-scan.js

lib/quick-scan.js

lib/security-validator.js

lib/structure-validator.js

lib/trigger-validator.js

lib/update-checker.js

lib/usage-reader.js

oc/package-lock.json

oc/package.json

oc/src/commands/sc.ts

oc/src/cron/weekly-digest.ts

oc/src/hooks/after-tool.ts

oc/src/hooks/plugin-lifecycle.ts

oc/src/locale.ts

oc/src/plugin.ts

oc/src/renderers/digest-formatter.ts

oc/src/rules/r15-clawhub-update.ts

oc/src/runtime.ts

oc/src/types/openclaw.d.ts

package-lock.json

package.json

prompts/d3-security.md

prompts/d4-functional.md

schemas/eval-result.json

schemas/feedback-signal.json

schemas/merge-result.json

schemas/version-manifest.json

scripts/eval-v2/analyze-results.js

scripts/eval-v2/batch-eval-v6.sh

scripts/eval-v2/codespace-setup.sh

scripts/eval-v2/download-skills.sh

scripts/eval-v2/sample-skills.js

scripts/fetch-fixtures.sh

scripts/hud-extra.js

`SKILL.md`

`.claude-plugin/plugin.json`

`.github/ISSUE_TEMPLATE/config.yml`

`.github/workflows/verify.yml`

`.skill-compass/weak-skill/snapshots/1.0.0.md`

`AGENTS.md`

`CONTRIBUTING.md`

`README.md`

`SECURITY.md`

`SKILL.md`

`docs/skill-inbox/openclaw/product-spec.md`

`examples/guide-auto-updater.md`

`examples/guide-claudeception.md`

`hooks/scripts/eval-gate.js`

`hooks/scripts/output-guard.js`

`hooks/scripts/post-skill-edit.js`

`hooks/scripts/pre-eval-scan.js`

`hooks/scripts/pre-eval-scan.sh`

`hooks/scripts/session-tracker.js`

`hooks/scripts/skill-usage-tracker.js`

`hooks/scripts/write-last-version.js`

`lib/audit-chain.js`

`lib/basic-validator.js`

`lib/git-skill-reader.js`

`lib/inbox-engine.js`

`lib/inbox-store.js`

`lib/integrity-monitor.js`

`lib/patterns.js`

`lib/pre-eval-patterns.js`

`lib/pre-eval-scan.js`

`lib/quick-scan.js`

`lib/security-validator.js`

`lib/structure-validator.js`

`lib/trigger-validator.js`

`lib/update-checker.js`

`lib/usage-reader.js`

`oc/package-lock.json`

`oc/package.json`

`oc/src/commands/sc.ts`

`oc/src/cron/weekly-digest.ts`

`oc/src/hooks/after-tool.ts`

`oc/src/hooks/plugin-lifecycle.ts`

`oc/src/locale.ts`

`oc/src/plugin.ts`

`oc/src/renderers/digest-formatter.ts`

`oc/src/rules/r15-clawhub-update.ts`

`oc/src/runtime.ts`

`oc/src/types/openclaw.d.ts`

`package-lock.json`

`package.json`

`prompts/d3-security.md`

`prompts/d4-functional.md`

`schemas/eval-result.json`

`schemas/feedback-signal.json`

`schemas/merge-result.json`

`schemas/version-manifest.json`

`scripts/eval-v2/analyze-results.js`

`scripts/eval-v2/batch-eval-v6.sh`

`scripts/eval-v2/codespace-setup.sh`

`scripts/eval-v2/download-skills.sh`

`scripts/eval-v2/sample-skills.js`

`scripts/fetch-fixtures.sh`

`scripts/hud-extra.js`

`scripts/release/prepare-clawhub-canary.js`

`scripts/tests/README.md`

`scripts/tests/collect-results.js`

`scripts/tests/lib/assert.sh`

`scripts/tests/lib/helpers.sh`

`scripts/tests/phase-a-hooks.sh`

`scripts/tests/phase-b-core.sh`

`scripts/tests/phase-c-version.sh`

`scripts/tests/phase-d-compound.sh`

`scripts/tests/phase-e-integration.sh`

`scripts/tests/phase-vm.sh`

`scripts/tests/run-all.sh`

`scripts/tests/verify-clawhub.js`

`scripts/tests/verify-local.js`

`scripts/tests/verify-oc-event-flow.js`

`shared/tool-instructions.md`