← ClaudeAtlas

skill-reviewlisted

Security, safety, and quality review of Claude Code plugin marketplaces, plugins, and skills before install/approval. Use when the user asks to review, audit, vet, or approve a marketplace, plugin, or skill; check allowed-tools/permissions; scan for prompt injection, embedded secrets, or unsafe tool use; or produce a scored go/no-go report on Claude Code extensions.
johnoconnor0/johns-os · ★ 0 · AI & Automation · score 76
Install: claude install-skill johnoconnor0/johns-os
# Skill Review ## Effort & orchestration This skill requests `effort: xhigh` in its frontmatter — the deepest reasoning level settable per-skill on models that support it (Opus 4.8/4.7; older models fall back automatically). `xhigh` is the same reasoning depth that "ultracode" uses. For a **full marketplace audit**, run the session in ultracode first (`/effort ultracode`) before invoking this skill. Ultracode is a session setting — not a frontmatter value — that pairs xhigh with automatic multi-agent workflow orchestration, so Claude Code fans the per-plugin reviews out to parallel subagents on its own. If you don't use ultracode, this skill still delegates per-plugin reviews manually via the `Agent` tool (Phase 2), so orchestration works either way; ultracode just makes it automatic. ## User Context The user request is: $ARGUMENTS Interpret arguments as follows: - **First positional arg** = path to the thing to review. If omitted, default to the current working directory and auto-detect what is present. - `--scope` = `marketplace` | `plugin` | `skill` | `all` (default `all` — review every artifact found under the path). - `--mode` = `static` (deterministic scan + rubric, no external calls) or `full` (adds adversarial prompt-injection reasoning and, if the user connected them, live checks). Default `full`. - `--out` = where to write the report. Default `./skill-review-report.md` next to the reviewed root. Do not ask for anything you can discover by inspecting files.