Skillrot

Skill mishanefedov/skillrot/skills/skillrot

Audit agent skills for CLI drift: find skills that call external tools with flags/subcommands the installed version no longer accepts.

Install

npx -y skills add mishanefedov/skillrot --skill skillrot

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit installed agent skills for CLI drift. Finds skills that call external tools (codex, gh, docker, bun, supabase, ...) with flags or subcommands the installed version no longer accepts — the silent failure where a skill keeps emitting a dead command and breaks mid-task. Use when the user says "check my skills", "skill drift", "skillrot", "are my skills out of date", "audit skills", or after upgrading a CLI a skill depends on.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

skillrot — skill CLI drift audit

Skills that shell out to external CLIs rot silently: the tool ships a new version, a flag is renamed or a subcommand removed, and the skill keeps generating the old command. You only find out when an agent fails mid-task.

skillrot reads each skill's bash, extracts the command subcommand --flags it uses, and checks them against the installed CLI's own --help. It only ever appends --help / --version — never the skill's real subcommands — which is low-risk (a binary could in principle act before parsing args, so it's not a hard read-only guarantee).

Run it

When installed as a plugin, skillrot is already on PATH:

skillrot ~/.claude/skills          # scan all personal skills
skillrot ~/.claude/skills --fix    # self-heal: rewrite confident flag renames in place
skillrot ~/.claude/skills --cost   # context-cost audit: tokens each skill adds per session
skillrot .                         # scan the current skill folder
skillrot ~/.claude/skills --json   # machine-readable
skillrot ~/.claude/skills --tools codex,gh,docker

When a finding shows → did you mean '--X'?, run with --fix to rewrite it (or apply the suggestion yourself). --fix only changes high-confidence matches.

If skillrot: command not found, run it with no install via npx skillrot <dir> (or bunx skillrot <dir>), or install it permanently with npm i -g skillrot or brew install mishanefedov/tap/skillrot.

<dir> is a folder where each subdirectory is one skill, or a single skill directory containing SKILL.md. It scans SKILL.md bash fences and *.sh scripts.

Interpreting output

✗ error — a long flag or subcommand the installed CLI no longer accepts. Fix the skill.
! warning — a missing short flag, an uninstalled tool, or a --help that couldn't be read. Eyeball it.
✓ — every checked invocation matches the installed CLIs.

Exit code is 1 when any error-level drift is found, so it can gate a commit hook.

Scope (v1)

Catches removed/renamed flags, dead subcommands, and uninstalled tools. It does NOT yet catch semantic constraints (e.g. "flag A can't be combined with flag B") — that needs sandboxed replay of the real arg shape and is the v2 roadmap.