Install
$ agentstack add skill-firstp1ck-pi-coding-agent-forge-skill-evaluator ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Skill Evaluator
When to Use
Use this skill when a user asks to review, validate, publish, enable, or quality-gate Pi skills or Agent Skills-compatible SKILL.md directories.
Good triggers include:
- "Evaluate this skill before I enable it."
- "Run a quality gate on all enabled skills."
- "Check whether this skill has valid frontmatter, safety language, scripts, and tests."
- "Add or review routing fixtures for skills."
Lifecycle policy
When evaluation informs skill enablement, publishing, pruning, or merge/update decisions, read the bundled package policy at ../../../../references/SKILL-LIFECYCLE-POLICY.md when available.
Workflow
- Resolve the target skill path. For one skill, use a
SKILL.mdfile or its parent directory. - Prefer the native Pi tools when available:
skill_eval_runfor one skill.skill_eval_allfor discovered or enabled skills.
- Otherwise run the CLI evaluator:
``bash skill_eval_run /path/to/skill/SKILL.md --json-output /tmp/skill-eval.json --markdown-output /tmp/skill-eval.md ``
- For all skills in an explicit root without reading user Pi settings, run:
``bash skill_eval_all --no-settings --skill-root /path/to/skills --json-output /tmp/skill-eval-all.json --markdown-output /tmp/skill-eval-all.md ``
For active-environment coverage, pass the target Pi agent directory explicitly:
``bash skill_eval_all --enabled-only --agent-dir /path/to/pi-agent-dir --json-output /tmp/skill-eval-all.json --markdown-output /tmp/skill-eval-all.md ``
- Treat JSON as the machine-readable source of truth and Markdown as the human review report.
- Fix blocking failures before enabling, publishing, or depending on the skill. Warnings are not blocking but should be reviewed.
- If the user asks for test conventions, read
references/TEST-CONVENTIONS.md.
Verification
Use the package test suite after modifying the evaluator:
cd /vendor/pi-skill-skill-evaluator
npm test
Pilot checks against fixture or installed skills:
skill_eval_run /path/to/skills/repo-explorer/SKILL.md
skill_eval_run /path/to/skills/patch-md/SKILL.md
skill_eval_run /path/to/skills/learnings/SKILL.md
Safety and Failure Modes
- The evaluator is read-only for skill source files.
- Running bundled skill tests can execute code from the target skill. Use
--skip-testsfor untrusted third-party skills or inspect tests first. - Destructive command checks are heuristic. Treat failures as review gates, not proof of malicious intent.
- Pi allows skill names to differ from parent directories; the evaluator warns instead of failing on that Agent Skills portability issue.
- Git or remote package discovery may be incomplete if a package source cannot be resolved to a local install path.
Output Expectations
A successful run returns:
- JSON with
summary, per-skillstatus,failures,warnings, andinfo. - Markdown with a summary table and per-skill issue details.
- Exit code
0when there are no blocking failures. - Exit code
1when one or more blocking failures are present.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Firstp1ck
- Source: Firstp1ck/pi-coding-agent-forge
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.