skills-qa

Evaluates AI skills against a thirteen-parameter legal design framework with injection scanning and verdicts.

Updated Jun 17, 2026
One-click install
npx skills add https://github.com/tk1cntt/PhapChe --skill skills-qa-tk1cntt
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: skills-qa
Source: https://github.com/tk1cntt/PhapChe/tree/main/docs/claude-for-legal-main/legal-builder-hub/skills/skills-qa
Command: npx skills add https://github.com/tk1cntt/PhapChe --skill skills-qa-tk1cntt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Legal teams installing community-built or first-party AI skills have no structured way to judge whether a skill is well-designed, safe, or trustworthy before it touches their workflows. This Skill provides a rigorous quality-assurance review that surfaces design gaps, security risks, and legal-specific failure modes before installation or deployment. ## Core Features & Use Cases - Thirteen-Parameter Design Evaluation: Scores audience, work shape, delegation threshold, input requirements, versioning, confidence bands, failure modes, scope boundaries, escalation logic, trust surface, freshness, schema, and conflicts with installed skills. - Prompt-Injection Heuristic Scan: Flags override instructions, authority claims, out-of-scope reads/writes, hidden content, external URLs, and credential asks, with fail-closed regression checks on skill updates. - Legal Failure Mode Check: Separately assesses legal advice vs. legal support, privilege implications, and accountability gaps, then issues a Ready / Some Concern / Material Concerns / Refuse verdict. - Use Case: Before installing a community NDA-review skill from a registry, run this QA to get a dependency map, injection scan results, a parameter-by-parameter gap table, and a clear verdict on whether to trust it. ## Quick Start Run /legal-builder-hub:skills-qa on the path to the skill directory you want to evaluate before installing it.

Frequently Asked Questions about skills-qa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a community AI skill is safe to install?

Run /legal-builder-hub:skills-qa with the path to the skill directory. It performs a prompt-injection heuristic scan, maps dependencies, evaluates thirteen design parameters, and returns a Ready, Some Concern, Material Concerns, or Refuse verdict.

What does the skills-qa evaluation check for?

It checks thirteen design parameters including audience, delegation threshold, escalation logic, trust surface, freshness of bundled references, schema structure, and conflicts with installed skills. It also separately assesses three legal failure modes: legal advice vs. support, privilege, and accountability.

Can I evaluate a skill if I only have its SKILL.md file?

Yes, you can paste SKILL.md content directly or provide just the file path. The evaluation proceeds but flags that dependency mapping is incomplete, since commands, agents, and hooks files affect the trust surface assessment.

Does the injection scan guarantee a skill is safe?

No. It is a heuristic AI scan, not a security audit, and explicitly states that a clean scan is not a guarantee. The skill recommends reading the raw SKILL.md yourself and, in enterprise settings, installing only from allowlisted registries.

What happens when skills-qa finds a malicious skill?

It issues a REFUSE verdict listing each finding with file, line, and quoted text, and refuses to present any install prompt or override path. It suggests reporting the skill, finding a safe alternative, or escalating to a security team.

When does skills-qa run automatically?

It runs automatically as part of /legal-builder-hub:skill-installer and is invoked by the auto-updater against new skill versions before applying updates, failing closed if the new version introduces findings the old one did not have.