Skill Listing Polisher

Improve a skill's public listing before publish. Use when tightening title, description, tags, changelog, and scan-friendly packaging so the listing looks cl...

Security Scan

The skill's code, instructions, and scope match its stated purpose (polishing skill listings); it runs local checks on a provided skill directory and does not request credentials or perform network activity.

Purpose & Capability

The name/description match the included assets: SKILL.md instructs reviewers to run the bundled check script, and the script inspects a skill package for long descriptions, internal filenames, and sensitive-looking strings. There are no unrelated environment variables, binaries, or install steps requested.

Instruction Scope

Runtime instructions are narrow and explicit: run ./scripts/check-listing.sh /path/to/skill. The script only reads files within the provided skill directory, extracts the description via a short Python snippet, and searches for suspicious filenames/strings. It does not transmit data externally or access other system areas by design. Note: the script expects python3 and ripgrep (rg) to be available; it doesn't declare these dependencies.

Install Mechanism

No install specification — it's instruction-only with a small bundled shell script. Nothing is downloaded or written to disk by an installer, and there are no archive/extract steps or remote fetches.

Credentials

The skill requests no environment variables, credentials, or config paths. The script scans the provided directory for tokens/secret-like strings (to warn), which is coherent with the skill's purpose.

Persistence & Privilege

The skill is not forced always-on, does not modify other skills or global agent settings, and has no apparent persistence or elevated privileges. It runs only when invoked against a supplied directory.

Assessment

This skill is coherent and low-risk: it locally scans a supplied skill package for listing issues and sensitive-looking strings and prints warnings. Before running it, confirm you point it only at the skill package you intend to inspect (it reads files under that directory). Ensure python3 and ripgrep (rg) are available or install them; the script may fail otherwise. The warnings are heuristics and can produce false positives, so manually review flagged files. Because it runs locally and does not transmit data, it's safe to run in a normal environment; if you prefer extra caution, run it inside an isolated container or VM.

Use this skill before publishing or updating a public ClawHub skill.

What to improve

• title clarity
• description length and truncation risk
• tags that match the actual use case
• changelog that says what changed in plain language
• public package surface that looks normal in review

Review order

1. shorten the public description if it gets cut off
2. remove internal-only scripts and private identifiers
3. tighten tags to actual buyer intent
4. make the changelog specific and boring
5. check that the package only contains user-facing files

Fast checks

Run the bundled script:

./scripts/check-listing.sh /path/to/skill

Output style

When reviewing a skill, return:

1. what weakens trust
2. what weakens discoverability
3. the smallest edit that improves both