Skill Crossroads deploy-all
rubric v1.2 · deterministic
C+ 79.8/100 overall
Correctness & Structure 100 pass
Triggering & Discoverability 88 1 warn
Clarity & Instructions 100 pass
Token & Context Cost 100 pass
Safety & Security 14 3 fail
Verifiability & Maintainability 53 1 fail

Top fixes — ranked by score impact

✗ SAFETY-01 No hardcoded secrets
SKILL.md:11— → matches AWS access key id pattern
Possible hardcoded secret (AWS access key id) — AKIA**************LE
AKIA**************LE
Fix Remove the secret from source, rotate it, and reference it via an environment variable instead.
✗ SAFETY-02 allowed-tools least-privilege
SKILL.md:1allowed-tools: * → grants every tool (wildcard)
`allowed-tools` grants all tools via a wildcard — the opposite of least-privilege.
*
Fix List only the specific tools the skill needs; never `*`/`all`.
✗ SAFETY-04 No shell-injection in `!` blocks
SKILL.md:9— → user arguments interpolated into a shell command
Dynamic `!` block interpolates user input into a shell command — a shell-injection surface.
!`git log --oneline $ARGUMENTS`
Fix Don't pass `$ARGUMENTS`/`$1`/`${…}` straight into a shell command. Validate/quote the input, or avoid the dynamic block.
✗ VERIFY-01 Evals or tests present
SKILL.md:1the skill works → no evals/, tests/, or verification section found
No way to prove the skill does what it claims.
Fix Add an evals/ folder (test prompts + expected outcomes) and a '## Verify' step in the body.
⚠ SAFETY-03 No destructive auto-invocation
SKILL.md:2auto-invocable (no disable-model-invocation) → performs a destructive action ("deploy")
Skill appears to "deploy" but the model can auto-invoke it — a destructive action could fire without the user asking.
deploy
Fix If this action is destructive/irreversible, set `disable-model-invocation: true` so it only runs when explicitly invoked.
⚠ TRIGGER-02 Description long enough to anchor invocation
SKILL.md:1description will trigger invocation → 97 chars — under the ~100-char reliable-trigger band
Description is thin — likely under-specifies when to invoke.
Deploy the app and delete stale branches. Use when the user says "deploy" or …
Fix Add the concrete use case and user phrasing (e.g. 'Use when the user says …').
★ scores higher than ≈4% of 214 public skills (deterministic rubric v1.2 sample, 2026-07)

Embed this badge

Skill Crossroads grade C+ Always-fresh — it re-scans and updates on its own. 
[![Skill Crossroads](https://skillcrossroads.com/api/badge/sgharlow/skillcrossroads/packages/core/test/fixtures/skills/vulnerable.svg)](https://skillcrossroads.com/s/sgharlow/skillcrossroads/packages/core/test/fixtures/skills/vulnerable)
Grade your own Claude Code skill — evidence-cited, file-and-line, free. Scan your own skill →