Skills Explorer Add Skills

marketplace-health-check

An agent skill by daymade, from daymade/claude-code-skills. Tags: audit, documentation, security, triage, validation, workflow.

What it does

Run a full 6-dimension health check of this Claude Code skills marketplace repo — code/script safety, documentation/SSOT consistency, security/PII leaks, open-PR triage, open-issue triage, and marketplace-manifest integrity — via a parallel fan-out Dynamic Workflow, then verify the serious findings and report them by priority. Use this whenever the user asks to check the repo, run a health check, do a full sweep/audit before a release, 全面体检, 检查仓库状态, 看看仓库健康吗, 审计一下仓库, or asks whether the PRs / issues / docs / versions / PII are in good shape across the board — even if they never say the word "workflow". Reach for it for any broad "is this whole repo OK" request, not just one-file checks.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill marketplace-health-check

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/marketplace-health-check ~/.claude/skills/marketplace-health-check

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only repo audit, but it does reach out to GitHub and launches parallel Workflow agents to inspect files, PRs, and issues. The main risks are networked access via authenticated `gh`, potential exposure of sensitive repo/issue content in the audit output, and prompt text that nudges the agent to treat the user request as sufficient opt-in.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)`scripts/scout_repository.py` runs `subprocess.run(["gh", *arguments], ...)`, and `scripts/repo-health-check.workflow.js` is meant to launch parallel Workflow agents, so installing it grants real command execution.
Network access2 (moderate)The scout queries GitHub with `gh api graphql`, `gh repo view`, and `gh issue view`, so the skill sends repo context over the network and depends on authenticated remote access.
Filesystem reach1 (low)It reads repo files like `.claude-plugin/marketplace.json` and asks to preserve scout output outside the source tree, but it does not edit or delete project files.
Secrets & credentials2 (moderate)The workflow explicitly scans for PII/secrets and reads PR/issue content, so sensitive text present in the repo or issue tracker can be surfaced in the report.
Privilege & persistence0 (none)There is no `sudo`, global install, service registration, shell-startup editing, or other privilege escalation in the shipped files.
Instruction hijack surface2 (moderate)`SKILL.md` says a user asking to "run the health check" "IS that opt-in, so proceed," which pushes the agent toward treating the request as blanket permission; it also points the agent at remote workflow docs.
Irreversible actions0 (none)The workflow is explicitly read-only: `do NOT modify files, comment on PRs/issues, or push`, so it does not autonomously change external state.
Transparency0 (none)All shipped code is plain text and readable; there are no binaries, packed blobs, or decoded-at-runtime payloads.

Before installing

Rated 2026-10-20 by an automated review of 5 files from the skill's repository.

Source

Repository
daymade/claude-code-skills (all skills from this repository)
Path
marketplace-health-check/SKILL.md
Branch
main
Updated
2026-09-20