ml-engineer.md:1allowed-tools: * → grants every tool (wildcard)
`allowed-tools` grants all tools via a wildcard — the opposite of least-privilege.
*
Fix List only the specific tools the skill needs; never `*`/`all`.
overall
Correctness & Structure
100
pass
Triggering & Discoverability
85
1 warn
Clarity & Instructions
100
pass
Token & Context Cost
100
pass
Safety & Security
64
1 fail
Verifiability & Maintainability
not yet scored
Top fixes — ranked by score impact
ml-engineer.md:3auto-invocable (no disable-model-invocation) → performs a destructive action ("deploys")
Skill appears to "deploys" but the model can auto-invoke it — a destructive action could fire without the user asking.
deploys
Fix If this action is destructive/irreversible, set `disable-model-invocation: true` so it only runs when explicitly invoked.
ml-engineer.md:1description will match user requests → no explicit cue ('use when …', 'triggers on …', quoted user phrases) found
Pure what-it-does prose — the model has to guess when to invoke it.
Implements and deploys machine learning models. Manages the complete ML lifec…
Fix State the trigger explicitly: 'Use when the user says "…", "…", or wants to …'.
Partial grade — some applicable rubric categories were not scored on this scan (e.g. LLM-assisted checks without a key) and are excluded from the overall.
Embed this badge
Always-fresh — it re-scans and updates on its own.
Grade your own Claude Code skill — evidence-cited, file-and-line, free.
Scan your own skill →