confluent-skill-reviewer

Audits Confluent agent skills against the Agent Skills spec, repo conventions, and eval contracts.

Updated Jul 7, 2026
One-click install
npx skills add https://github.com/ricardolui/gcp-custom-agent-skills --skill confluent-skill-reviewer-ricardolui
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: confluent-skill-reviewer
Source: https://github.com/ricardolui/gcp-custom-agent-skills/tree/main/confluent-skill-reviewer
Command: npx skills add https://github.com/ricardolui/gcp-custom-agent-skills --skill confluent-skill-reviewer-ricardolui

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Reviewing a new or modified agent skill for spec conformance, trigger collisions, weak evals, and leaked PII is manual and error-prone. This Skill walks an agent through a structured five-phase audit of any skill in the repo and returns a single severity-grouped Markdown report with a merge recommendation. ## Core Features & Use Cases - Spec and convention checks: Validates frontmatter shape, naming rules, lazy-loaded references, anti-trigger clauses, platform scoping, credential handling, and plan-before-execute rules, optionally delegating to the external skill-validator binary with a native fallback. - Trigger overlap and eval contract validation: Detects keyword collisions between skill descriptions and enforces the repo's standardized evals.json schema, including fixture sync and assertion specificity. - PII scanning and PR gates: Scans skill files for SSNs, payment cards, AWS keys, and real emails, and in PR-diff mode verifies the PR-template checklist (docs updated, 90% eval score, SME and DTX/DevRel reviewers). - Use Case: Before merging a PR that adds a new Kafka skill, ask for a pre-merge review and receive a report listing Blocking findings (e.g., inlined references, missing fixtures) plus the PR-template checklist status. ## Quick Start Review the skill at skills/my-new-skill and give me a pre-merge report with any blocking findings.

Frequently Asked Questions about confluent-skill-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Confluent agent skill before merging a PR?

Invoke the review on your branch or PR and it enters PR-diff mode, running all five audit phases on changed skills under skills/. The output is a Markdown report grouping findings by severity plus the PR-template checklist covering docs, eval score, and reviewer assignments.

What does the skill review check in evals.json files?

It validates the standardized schema: top-level skill_name and evals keys, required id/prompt/expected_output/files fields, and assertions as a list of strings. The legacy expectations key and object-form assertions are Blocking findings, and missing on-disk fixture paths are flagged.

Does the review work if skill-validator is not installed?

Yes. The wrapper script probes for the binary and exits cleanly when absent; the review notes the missing validator as a Warning and falls back to native spec checks covering frontmatter parsing, name rules, directory matching, link resolution, and code-fence balance.

How is trigger overlap between skills detected?

A script tokenizes each skill's description, filters stopwords and domain-broad terms like kafka or schema, and reports keyword collisions between pairs. Three or more overlapping keywords without mutual anti-trigger clauses is Blocking; two is a Warning.

Can the reviewer modify or fix the skill it audits?

No. The review is read-only by design and never edits the skill under review. It emits findings with suggested fixes, but the author applies changes; it also does not run the skill's own evals or analyze runtime behavior.

What kinds of sensitive data does the PII scanner catch?

The scanner flags US SSNs, Luhn-valid payment card numbers, AWS access key ids, and private key blocks as Blocking, plus emails on non-example domains and phone numbers as Warnings. Documentation domains like example.com and placeholder tokens are treated as synthetic and skipped.