Skill Tester & Analyzer
A meta-skill for deeply testing and auditing other Claude skills. It instruments test runs to capture raw API call traces, records all script stdin/stdout/stderr with timing, and runs deterministic security scans followed by dedicated security and code review subagents against any scripts embedded in the skill.
Session Directory Layout
<report_root>/<skill_name>_<YYYYMMDD_HHMMSS>/
├── manifest.json # Validation results and session metadata (created by setup_test_env.py)
├── sandbox/ # Isolated workspace for script execution
├── inventory.json # Skill structure scan
├── scan_results.json # Deterministic security findings (B9 — runs first)
├── prompt_lint.json # Deterministic prompt quality findings (B11 — runs first)
├── prompt_review.json # AI prompt quality analysis (receives prompt_lint as input)
├── api_log.jsonl # All Claude API calls (one JSON object per line)
├── script_runs.jsonl # All script executions with I/O
├── security_report.json # AI security analysis (receives scan_results as input)
├── code_review.json # Code quality review
├── session_report.html # Claude Code session trace (API calls, tool use, conversation)
└── report.html # Unified interactive HTML report
Modes
| Mode |
Description |
Phases Run |
Command |
| Full (default) |
Complete analysis: scan → prompt-lint → test → security → review → report |
All (2-9) |
/st:run |
| Audit |
Static analysis only, no test execution |
2-4, 6-7, 9 |
/st:audit |
| Trace |
Runtime capture only, no security/code review |
2, 5, 8, 9 |
/st:trace |
| Report |
Re-generate HTML from existing session data |
9 only |
/st:report |
Commands
| Command |
Mode |
Phases |
Purpose |
/st:init |
All |
1 |
Set up session: target, mode, prompts, report location |
/st:run |
Full |
2-9 |
Execute all analysis phases |
/st:audit |
Audit |
2-4, 6-7, 9 |
Static analysis only |
/st:trace |
Trace |
2, 5, 8, 9 |
Runtime capture only |
/st:report |
Report |
9 |
Regenerate HTML from session data |
/st:status |
N/A |
— |
Show session state |
/st:resume |
Any |
Variable |
Resume interrupted session |
Interpreting Results
Security Severity Levels
| Level |
Meaning |
Action |
CRITICAL |
Active exploit risk (e.g., shell injection, RCE, hardcoded production key) |
Block — do not use skill; fix immediately |
HIGH |
Likely data exposure or privilege escalation |
Fix before production |
MEDIUM |
Defense-in-depth gap; not immediately exploitable |
Fix in next iteration |
LOW |
Style/practice issue with minor security implications |
Note in report |
INFO |
Observation, no risk |
Informational only |
Code Quality Score (0–10)
| Range |
Interpretation |
| 9–10 |
Production-ready |
| 7–8 |
Minor improvements needed |
| 5–6 |
Significant gaps — refactoring advised |
| < 5 |
Major issues — rework required |
