Skill Auto-Router

Automatically discover and route relevant installed skills for the current task, plus run a daily skill audit. Use when you want pre-task skill matching acro...

Security Scan

The skill's code and runtime instructions are consistent with its stated purpose (local discovery and lightweight routing/audit of SKILL.md files); it performs only local file reads and scoring and does not request credentials, call network endpoints, or install external components.

Purpose & Capability

The name/description (auto-routing and daily audit of installed skills) matches what the provided script does: it discovers SKILL.md files under reasonable skill roots, tokenizes frontmatter name/description, ranks candidates, and provides an audit. No unrelated credentials, binaries, or install steps are required.

Instruction Scope

SKILL.md instructs running the local Python script and integrating it into AGENTS/HEARTBEAT. The script reads SKILL.md frontmatter and returns names/paths/scores — this is expected for the purpose. Note: the script prints absolute paths and skill names, so running it or logging its output can expose filesystem paths and skill metadata; also ensure SKILL.md frontmatter does not contain sensitive data before integrating into automated logs or heartbeat processes.

Install Mechanism

There is no install spec and the skill is instruction-only plus a small Python script. Nothing is downloaded or written to disk by the skill beyond reading existing files. This is low-risk and proportionate to the stated functionality.

Credentials

The skill requests no environment variables, no credentials, and no special config paths beyond searching several plausible local skill-root locations. These roots are consistent with locating installed skills; no unrelated secrets are required.

Persistence & Privilege

The skill does not request permanent/always-on presence (always:false) and does not modify other skills or system settings. It merely provides a script intended to be invoked manually or wired into existing hooks; autonomous invocation capability is platform-default and not introduced here.

Assessment

This skill appears to do what it says: locally scan SKILL.md frontmatter and return ranked candidates and a daily audit. Before enabling automated/heartbeat runs: (1) inspect your existing SKILL.md files to ensure no sensitive data is stored in frontmatter (the script prints names and paths), (2) consider limiting or customizing the skill roots passed to the script so it only scans intended directories, and (3) if you will log or send the audit output to shared systems, review those logs for leakage of internal filenames or paths. If you accept those visibility characteristics, the skill is coherent and appropriate to use.

Run a lightweight preflight before non-trivial work so the agent loads the right skills instead of guessing.

Quick Start

1) Pre-task routing (before work starts)

python scripts/skill_router.py --task "<user task text>"

This returns ranked skill candidates with match reasons.

2) Daily audit (once per day)

python scripts/skill_router.py --daily

This reports:

• discovered skill count
• duplicate/overlapping trigger language
• weak or vague descriptions that reduce trigger quality

Recommended Integration

To make this behavior automatic, wire it into your workspace steering:

1. In AGENTS.md pre-task checklist: run pre-task routing for non-trivial tasks.
2. In HEARTBEAT.md: run --daily once per day and log result.

Use references/setup-checklist.md for copy/paste snippets.

Operating Rules

• Prefer top 1-3 matching skills only (avoid loading everything).
• If no good match is found, continue without skill load.
• If multiple matches tie, choose the most specific skill description.
• Never claim a skill was loaded unless it actually was.

scripts/

• scripts/skill_router.py — deterministic local matcher + daily audit

references/

• references/setup-checklist.md — integration snippets for AGENTS/HEARTBEAT