Install
$ agentstack add skill-alibaba-skill-up-skill-upper Open-source listing — not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Pipes remote content directly into a shell (remote code execution).
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
use-skill-up-cli
Help the user set up, run, and interpret evaluations for Agent Skills via the skill-up CLI.
Manual:
Language Policy
Default to English when responding to the user. If the user writes in Chinese (or any other language), switch to that language and stay consistent with the user's input throughout the session.
Detection rules (highest priority first):
- The user explicitly specifies a language in the current message (e.g. "answer in English" / "用中文回答") → follow the user's instruction.
- The natural language used in the user's current message → match it.
- None of the above → use English (default).
Regardless of the response language, technical identifiers in this SKILL — CLI commands, eval.yaml / case.yaml field names, report field names, etc. — MUST stay in their original English form. Do not translate them.
Language Rules for Generated Artifacts
When creating or editing eval.yaml, case.yaml, grading scripts, README snippets, final replies, or any other user-visible artifact, treat the language of the user's current message as the output language for this turn:
- If the user asks in Chinese, write the final response and all generated natural-language content in Chinese, including YAML comments,
title,description,input.prompt,expectkeywords, andjudge.criteria. - If the user asks in English, write the final response and all generated natural-language content in English, including YAML comments,
title,description,input.prompt,expectkeywords, andjudge.criteria; do not leave Chinese or CJK characters in generated case files. - If the target Skill itself is written in Chinese but the user asks in English, translate the Skill's functional intent into English test prompts and assertions instead of copying Chinese prose from the target Skill or templates.
- In an English context, deterministic keywords in
rule_basedcases, includingexpect.must_containandjudge.success.output_contains, must also be English keywords. Translate terms such as资源泄漏,关闭, and异常处理intoresource leak,close, andexception handling; do not write bilingual parentheticals like"资源" (resources). - Keep technical identifiers unchanged, such as
schema_version,environment.type,engine.name,rule_based,agent_judge,script_path, file paths, and commands. - Treat
assets/*.tmplas structural references only. Rewrite placeholder prose and comments into the current output language; in an English context, translate or remove every Chinese comment and Chinese placeholder before writing generated files. - In an English context, after generating all files but BEFORE submitting the final reply, you MUST perform a CJK self-check: open every
evals/cases/*.yamlandevals/eval.yamland scan for CJK characters (Unicode ranges\u4e00-\u9fff\u3400-\u4dbf\uf900-\ufaff\u3000-\u303f\uff00-\uffef), including but not limited totitle,description,input.prompt,expectkeywords,judge.criteria, and YAML comments. If any CJK character is found, replace it with an equivalent English expression before finishing the task. This step is mandatory and must not be skipped.
What is skill-up
skill-up is an evaluation CLI for Agent Skill authors. It installs the Skill into a real Agent Engine (Claude Code, Codex, qodercli, etc.), spins up an execution environment for each case, runs the prompt, then grades the result via declared rules / LLM judges / custom scripts, and finally produces a report.
Typical layout:
my-skill/
SKILL.md
evals/
eval.yaml
cases/
.yaml
fixtures/
When to trigger
Use this skill in any of the following situations:
- The user asks to "run / evaluate / verify / test this skill".
- The user wants to "add evals, test cases, or regression cases to a skill".
- The user wants to edit
eval.yaml/case.yaml, or asks you to choose an appropriatejudgetype. - The user mentions
skill-up run/validate/list-cases/report/import/init. - The user wants to migrate from Anthropic
evals.jsonto skill-up. - The current working directory contains
evals/eval.yamlorevals/evals.jsonand the user wants to run it.
Main flow (follow this order strictly)
Step 0: Make sure skill-up is installed
Before doing anything, verify skill-up is available:
command -v skill-up && skill-up --version
If a version is printed, continue. If you see command not found, on macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/alibaba/skill-up/main/install.sh | bash
export SKILL_UP_VERSION=v0.1.0
curl -fsSL https://raw.githubusercontent.com/alibaba/skill-up/main/install.sh | bash
export INSTALL_DIR="$HOME/bin"
curl -fsSL https://raw.githubusercontent.com/alibaba/skill-up/main/install.sh | bash
> Platform: skill-up currently supports macOS / Linux only; Windows is not supported.
After installing, run skill-up --version again. If the command is still missing, add ~/.local/bin to PATH.
More details: references/install.md.
Step 0.5 (optional): User config and telemetry
For OTLP defaults, runtime_kwargs (e.g. OpenSandbox base_url), etc.:
skill-up init
skill-up init --local
skill-up init --print
skill-up init --force
Precedence (low → high): embedded empty defaults /evals/eval.yaml`.
- Copy
assets/case.yaml.tmplto/evals/cases/.yaml.
Adapt language per "Language Rules for Generated Artifacts". In an English context, it is prohibited to copy Chinese placeholder text from the templates into generated files — all prose must be rewritten in English. The Chinese in the templates is for structural reference only, not to be carried over.
Selection guidelines:
environment.type: usenonefor pure-text Skills; useopensandboxwhen you need a remote sandbox (setOPENSANDBOX_API_KEY, put non-secrets inenvironment.kwargs).engine.name+engine.model: defaultclaude_code;modelis optional. Forqodercli, often omitmodel.judge.type:rule_based(preferred),script,agent_judge(expensive) — seereferences/judge-types.md.- Case ID = filename without
.yaml; prompts should exercise real Skill value.
See references/eval-yaml.md and references/case-yaml.md.
Step 3: Fill the gaps (when evals already exist)
skill-up list-cases- Review
eval.yamland representative cases; avoidagent_judgeabuse. - Add or edit YAML under
cases/as needed.
Step 4: Validate the configuration
skill-up validate /evals/eval.yaml
Expect: ✓ eval.yaml is valid (loaded N case(s)).
Step 5: Prepare credentials
Priority: --api-key > env (ANTHROPIC_API_KEY, OPENAI_API_KEY, QODER_PERSONAL_ACCESS_TOKEN) > ~/.skill-up/credentials.yaml.
printenv | grep -E 'ANTHROPIC_API_KEY|OPENAI_API_KEY|QODER_PERSONAL_ACCESS_TOKEN'
If missing, stop and ask; do not write secrets into YAML without consent.
For opensandbox, also ensure OPENSANDBOX_API_KEY (and related env) as needed.
Step 6: Run the evaluation
skill-up run /evals/eval.yaml
| Scenario | Command | | -------------------------------- | ------------------------------------- | | Subset | --include-case-name "basic-*" | | Exclude | --exclude-case-name "*-flaky" | | HTML report | --format html | | Engine override | --engine codex --model openai/gpt-4 | | Parallelism | --parallelism 4 (1–256) | | Anthropic JSON | --auto | | N rounds | --iteration 3 | | Auto-append after last iteration | --iteration 0 (default behavior) | | Verbose | -v, -vv |
Exit 0 = all passed; 1 = failure or error — suitable for CI.
Step 7: Interpret the report
Artifacts under /-workspace/iteration-N/:
result.json,benchmark.json, optionalreport.html/with_skill/grading.json,outputs/
Summarize: pass rate and timing; for failures, case id, assertion text, and evidence; benchmark deltas if enabled; offer HTML path or skill-up report result.json --format html.
Command quick reference
| Command | Purpose | | --------------------------------------------- | --------------------------------- | | skill-up validate | Validate before run. | | skill-up list-cases | List cases. | | skill-up run [eval.yaml] | Run evals. | | skill-up run --auto | Run from evals/evals.json. | | skill-up report --format html | Re-render reports. | | skill-up import | Convert Anthropic format to YAML. | | skill-up init | Write user-config template. | | skill-up debug judge | Debug judge. | | skill-up debug report | Debug report. |
Full flags: references/cli.md.
Common pitfalls
- Model IDs vs proxy aliases — preserve what works for the user's
base_url. opensandboxwithoutOPENSANDBOX_API_KEY— auth failures.- Chinese
expect.must_containvs English model output — align language in prompts/assertions. - Abusing
agent_judge. - Anthropic
evals.jsonexpectations → defaultagent_judge; useimport+ hand edits for deterministic checks. - Paths relative to Skill root (
SKILL.mddirectory). --iteration 0appends after the latest existing iteration; positive--iteration Nruns N rounds.
References
references/install.mdreferences/eval-yaml.mdreferences/case-yaml.mdreferences/judge-types.mdreferences/cli.mdreferences/migrate-anthropic.mdassets/eval.yaml.tmpl,assets/case.yaml.tmpl
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: alibaba
- Source: alibaba/skill-up
- License: Apache-2.0
- Homepage: https://alibaba.github.io/skill-up/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.