Review a third-party skill

Third-party skills are installed by npx skills add <owner/repo> -s <name> as real directories under .agents/skills/<name>, linked from .claude/skills/<name>, and recorded in skills-lock.json at the workspace root. Committing one commits prose that will steer future sessions, so review it like code from a stranger.

Steps

1. Find what is new: git diff HEAD -- skills-lock.json, or every entry if the file is untracked. If the user names a skill, review only that one.
2. Read every file under .agents/skills/<name>/ in full. Short skills hide their dependencies in a single line.
3. Run the checks below.
4. Report a verdict.

Checks

Dependencies. Everything the skill references must exist here.

• Other skills, whether Skill tool calls, /name invocations, or "use the X skill": each must be present in .agents/skills/ or skills/. A skill that only delegates to a missing sibling is not valid on its own. Fix: npx skills add <source> -s <missing> from the same source, or drop this one.
• Files and scripts relative to the skill directory, and commands it expects on PATH.
• Anything that assumes an agent or runtime this workspace does not run.