Install
$ agentstack add skill-surenode-ai-skill-extractor-review-skills ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Review discovered skills
The skill-extractor mines reusable procedures ("skills") from Claude Code conversation + coding traces, scores each by confidence (is this a real, generalizable skill?) and utility (how valuable if reused?), and queues the strong, novel ones for human review. This flow lets the user approve, edit, or reject them. Every candidate — approved or not — stays on record so mining improves over time.
The engine lives at ~/.claude/skill-extractor/. Use the review CLI for all actions (never hand-edit the state files). Resolve the paths first:
PY=$(cat ~/.claude/skill-extractor/extension-config.json | python3 -c "import json,sys;print(json.load(sys.stdin)['python'])")
ENGINE=$(cat ~/.claude/skill-extractor/extension-config.json | python3 -c "import json,sys;print(json.load(sys.stdin)['engineDir'])")
(Fallback: PY=python3, ENGINE=~/Nesh/skill-extractor/engine.)
Steps
- List pending candidates: run
"$PY" "$ENGINE/review.py" list. This returns
JSON with id, name, title, description, confidence, utility, composite, and trace_outcome for each. If empty, tell the user there's nothing to review and optionally offer to run the miner now ("$PY" "$ENGINE/extractor.py").
- Present them to the user as a concise ranked list (highest
composite
first): title, one-line description, and the scores like confidence 88% · utility 77% · trace: success. Briefly note what each score means the first time.
- For the one(s) the user wants to look at, run
"$PY" "$ENGINE/review.py" show and show the full body (the procedure), trigger, and outcome_reason.
- Take the user's decision for each candidate:
- Install (optionally with edits): if the user wants changes, write a JSON
file with only the changed fields (any of name, title, description, trigger, body, tags) to a temp path, then run "$PY" "$ENGINE/review.py" install --edits /tmp/edits.json --comment "". With no edits, drop --edits. This writes ~/.claude/skills//SKILL.md so it becomes a live skill.
- Reject: run
"$PY" "$ENGINE/review.py" reject --comment "". Always try to capture a short reason — it's the training signal for future mining. The candidate stays in the scratch store; it is not deleted.
- Confirm what happened (installed path, or rejection recorded) and, if the
user installed a skill, remind them it's available immediately in new sessions.
Notes
- Never delete candidates. Reject keeps them; install promotes them. This is by design.
- If the user asks to see everything mined (not just pending), use
list --all. - The same actions are available via the VS Code popup ("Discovered Skills"
panel); this command is the terminal equivalent and stays in sync with it.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: surenode-ai
- Source: surenode-ai/skill-extractor
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.