Find skills

Skill Yco-0314/strata/skills/l5-meta/find-skills

Strata — a self-measuring skills framework for Claude Code & Codex: best-of-breed engineering skills stacked by altitude, where every skill has to prove it moves a measured number.

Install

npx -y skills add Yco-0314/strata --skill find-skills

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use before recommending, installing, or adding to the backlog any EXTERNAL skill, plugin, or dependency — gates the candidate on reputation (adoption count, verified source, active maintenance) so the framework doesn't take on untrusted supply chain. Triggers: "should we use this skill/library", "find a skill for X", "is this package trustworthy", "add an external borrow".

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

find-skills — L5 supply-chain trust gate

Before any external skill/plugin/dependency enters the framework — recommended to the user, added to backlog.json, or installed — run it through this gate. The framework's whole backlog is external borrows; this is the front door.

The three checks

Adoption — install count (skills.sh leaderboard rank, npm weekly downloads), GitHub stars, fork/issue activity. Above a sane threshold for its age?
Verified source — the repo exists, is owned by the claimed author, and has recent commits (not abandoned). A named org/firm (e.g. Trail of Bits) is a strong signal; an anonymous 0-star pre-release is a weak one.
Non-overlap — does it duplicate something the framework already has? (The anti-overlap law — a high-reputation skill is still a SKIP if it re-does an existing one.)

Install count is a WEAK, gameable signal (self-reported telemetry) — necessary, not sufficient. Pair it with verified source + active maintenance.

Verdict (one line per candidate)

PULL — reputation + source + maintenance all clear, and it's non-overlapping → vendor it (then it still must clear skill-eval/skill-validator before shipping).
PATTERN-ONLY — the idea is good but the package is untrusted (low adoption, pre-release, unmaintained) → lift the technique into your own code, don't vendor the dependency.
SKIP — duplicates an existing skill, or unmaintained with no redeeming pattern.

Why no Δ is expected

This is a trust gate, not a behavior-changer — like complexity-router, it has no skill-eval Δ to chase. Its value is preventing a supply-chain mistake, measured by what it keeps OUT.

Retroactive check (it agrees with calls already made): the skill-tools PostToolUse plugin was PATTERN-ONLY (early/unproven at the time — Strata lifted the hook pattern rather than vendoring the dependency); Trail of Bits' security pack was PULL-grade (5.9k stars, active security firm) and its diff-scoped review technique was borrowed into review. Composes with improve-loop (gate a borrow before it reaches the backlog) and skill-eval (a PULL still has to move a number).