# Review Skills

> Review skills that the skill-extractor mined from your Claude Code traces — inspect each candidate's definition and confidence/utility scores, edit it, then install it as a real skill or reject it with a comment. Use when the user runs /review-skills, asks to "review discovered/mined skills", or a session-start banner reports pending skills.

- **Type:** Skill
- **Install:** `agentstack add skill-surenode-ai-skill-extractor-review-skills`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [surenode-ai](https://agentstack.voostack.com/s/surenode-ai)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [surenode-ai](https://github.com/surenode-ai)
- **Source:** https://github.com/surenode-ai/skill-extractor/tree/main/skills/review-skills

## Install

```sh
agentstack add skill-surenode-ai-skill-extractor-review-skills
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Review discovered skills

The skill-extractor mines reusable procedures ("skills") from Claude Code
conversation + coding traces, scores each by **confidence** (is this a real,
generalizable skill?) and **utility** (how valuable if reused?), and queues the
strong, novel ones for human review. This flow lets the user approve, edit, or
reject them. Every candidate — approved or not — stays on record so mining
improves over time.

The engine lives at `~/.claude/skill-extractor/`. Use the review CLI for all
actions (never hand-edit the state files). Resolve the paths first:

```
PY=$(cat ~/.claude/skill-extractor/extension-config.json | python3 -c "import json,sys;print(json.load(sys.stdin)['python'])")
ENGINE=$(cat ~/.claude/skill-extractor/extension-config.json | python3 -c "import json,sys;print(json.load(sys.stdin)['engineDir'])")
```
(Fallback: `PY=python3`, `ENGINE=~/Nesh/skill-extractor/engine`.)

## Steps

1. **List pending candidates:** run `"$PY" "$ENGINE/review.py" list`. This returns
   JSON with `id`, `name`, `title`, `description`, `confidence`, `utility`,
   `composite`, and `trace_outcome` for each. If empty, tell the user there's
   nothing to review and optionally offer to run the miner now
   (`"$PY" "$ENGINE/extractor.py"`).

2. **Present them** to the user as a concise ranked list (highest `composite`
   first): title, one-line description, and the scores like
   `confidence 88% · utility 77% · trace: success`. Briefly note what each score
   means the first time.

3. **For the one(s) the user wants to look at,** run
   `"$PY" "$ENGINE/review.py" show ` and show the full `body` (the procedure),
   `trigger`, and `outcome_reason`.

4. **Take the user's decision** for each candidate:
   - **Install (optionally with edits):** if the user wants changes, write a JSON
     file with only the changed fields (any of `name`, `title`, `description`,
     `trigger`, `body`, `tags`) to a temp path, then run
     `"$PY" "$ENGINE/review.py" install  --edits /tmp/edits.json --comment ""`.
     With no edits, drop `--edits`. This writes
     `~/.claude/skills//SKILL.md` so it becomes a live skill.
   - **Reject:** run
     `"$PY" "$ENGINE/review.py" reject  --comment ""`.
     Always try to capture a short reason — it's the training signal for future
     mining. The candidate stays in the scratch store; it is not deleted.

5. **Confirm** what happened (installed path, or rejection recorded) and, if the
   user installed a skill, remind them it's available immediately in new
   sessions.

## Notes
- Never delete candidates. Reject keeps them; install promotes them. This is by design.
- If the user asks to see *everything* mined (not just pending), use `list --all`.
- The same actions are available via the VS Code popup ("Discovered Skills"
  panel); this command is the terminal equivalent and stays in sync with it.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [surenode-ai](https://github.com/surenode-ai)
- **Source:** [surenode-ai/skill-extractor](https://github.com/surenode-ai/skill-extractor)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-surenode-ai-skill-extractor-review-skills
- Seller: https://agentstack.voostack.com/s/surenode-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.