Skill Crossroads deploy-helper
rubric v1.2 · deterministic
B+ 89.9/100 overall
Correctness & Structure 100 pass
Triggering & Discoverability 100 pass
Clarity & Instructions 100 pass
Token & Context Cost 100 pass
Safety & Security 64 1 fail
Verifiability & Maintainability 53 1 fail

Top fixes — ranked by score impact

✗ SAFETY-01 No hardcoded secrets
SKILL.md:10— → matches AWS access key id pattern
Possible hardcoded secret (AWS access key id) — AKIA**************LE
AKIA**************LE
config.txt:2— → matches Assigned credential literal pattern
Possible hardcoded secret (Assigned credential literal) — api_**********************************0"
api_**********************************0"
Fix Remove the secret from source, rotate it, and reference it via an environment variable instead.
✗ VERIFY-01 Evals or tests present
SKILL.md:1the skill works → no evals/, tests/, or verification section found
No way to prove the skill does what it claims.
Fix Add an evals/ folder (test prompts + expected outcomes) and a '## Verify' step in the body.
⚠ SAFETY-03 No destructive auto-invocation
SKILL.md:2auto-invocable (no disable-model-invocation) → performs a destructive action ("deploy")
Skill appears to "deploy" but the model can auto-invoke it — a destructive action could fire without the user asking.
deploy
Fix If this action is destructive/irreversible, set `disable-model-invocation: true` so it only runs when explicitly invoked.
★ scores higher than ≈21% of 214 public skills (deterministic rubric v1.2 sample, 2026-07)

Embed this badge

Skill Crossroads grade B+ Always-fresh — it re-scans and updates on its own. 
[![Skill Crossroads](https://skillcrossroads.com/api/badge/sgharlow/skillcrossroads/packages/core/test/fixtures/skills/has-secrets.svg)](https://skillcrossroads.com/s/sgharlow/skillcrossroads/packages/core/test/fixtures/skills/has-secrets)
Grade your own Claude Code skill — evidence-cited, file-and-line, free. Scan your own skill →