Update installed skills with diff review, backups, approved migrations, verification, and rollback.
Security
skill-usefulness-audit
Audit skill usage, overlap, burden, and risk evidence before making manual cleanup decisions.
What it does
Audit installed agent skills using available usage, history, ablation, community, metadata, and bundle evidence. The bundled script classifies skills as API, tool, or general, then produces a concise report and optional Markdown evidence or ablation plan. Cleanup actions remain manual, and structure-only findings are not grounds for deletion.
When to use it
- Reviewing rarely used installed skills
- Finding overlapping skill instructions and resources
- Planning focused ablation tests for general skills
- Preparing conservative cleanup recommendations
The skill document
Skill Usefulness Audit
Manual Trigger Only
Use this skill only after a direct request to audit installed agent skills, their usage, overlap, cleanup options, or a structure-only inventory. Do not invoke it during normal tasks or use it for ordinary repository/source-code review, general security audit, or employee/human skill assessment.
Safety
Never delete, merge, quarantine, isolate, or disable skills automatically.
Treat delete, merge-delete, and quarantine-review as manual-review recommendations.
Do not delete skills based only on a structure-only report.
This tool does not automatically replay historical conversations; it generates ablation plans and reads ablation result files that the user provides.
Audit Scope
Audit these layers in order:
- Usage evidence, including recency and source quality.
- Installed metadata, instructions, and functional overlap.
- User-provided skill-on versus skill-off results for general skills.
- Runtime and bundle burden, including over-triggering, context cost, weak progressive disclosure, redundant resources, script failures, and private-looking files.
- Static health and risk hints.
- Optional offline community or registry metrics.
Treat API and tool skills as protected capability skills during ablation. Examples: Excel, DOCX, PDF, browser automation, deployment, OCR, external API wrappers, MCP/API gateway helpers.
Workflow
- Collect user-provided roots before host-local defaults.
- Load only the usage, history, ablation, and community evidence that is available.
- Inspect each
SKILL.mdand its script/reference/asset metrics. - Let the bundled script classify each skill as
api,tool, orgeneraland calculate its score. Read{baseDir}/references/scoring-rubric.mdonly when checking or explaining a score, verdict, or action. - Print the short usefulness report and, when requested, write Markdown evidence or an ablation plan.
Ablation Rules
Read {baseDir}/references/ablation-protocol.md only when running replays, preparing normalized ablation records, or reviewing mixed or delete-boundary results. The script can generate an ablation plan without loading the protocol.
Replay only selected general candidates with identical prompts/artifacts and pairwise judging.
Do not fake no-tool ablation for api or tool skills; use the rubric's protected-capability branch.
Run the Audit
Run the audit after collecting available evidence:
REPORT_LANGUAGE=en # use zh-CN when the current user invocation is Chinese
python "{baseDir}/scripts/skill_usefulness_audit.py" audit \
--skills-root ./skills \
--report-language "$REPORT_LANGUAGE" \
--markdown-out ./skill-audit-report.md
OpenClaw expands {baseDir} to the installed skill directory. Use it for bundled scripts and references.
Add evidence only when available:
--usage-file: JSON, JSONL, CSV, or TSV with per-skill usage.--history-file: raw transcripts used only when direct usage is weak or missing; mentions remainhistory_mentions/suspected_invocations, notcalls.--ablation-file: normalized JSON or JSONL skill-on/skill-off results.--community-file: offline JSON, JSONL, CSV, or TSV registry metrics.--ablation-plan-out: a cost estimate and focused replay plan; its case counts can be overridden with the four--ablation-*-casesoptions documented by--help.--json-out: machine-readable evidence only when requested or needed by another tool.
Pass --report-language zh-CN for a Chinese invocation and --report-language en for an English invocation. auto reads SKILL_AUDIT_REPORT_LANGUAGE or the process locale, then falls back to English.
Run without extra files only when you need a structure-only audit. Usage, community, and ablation evidence become lower-confidence in that mode. History and usage files may contain sensitive conversations, local paths, project names, and customer data. Missing env means not configured in the current audit process, not proof that the skill is broken in every host.
Output Contract
Use one run for both output layers; do not ask the user to choose a quick or full mode.
Standard output is a short natural-language report. Its opening paragraph states the audited skill count and the total characters plus approximate tokens of loaded entry descriptions. Lead with actual usage, not static risk or bundle health, and keep scores, internal codes, risk flags, and tables out of this layer.
When --markdown-out is provided, write the detailed evidence—with scores, action codes, missing evidence, burden, and risk notes—in the same run.
Match the user's language: clean Chinese for zh-CN and clean English for en, except for skill names and unavoidable paths or commands.
Copy the short report to chat verbatim, apart from making its evidence path clickable. Do not paste raw JSON or the full Markdown evidence unless the user asks. Read {baseDir}/references/report-narration-prompt.md only when another agent or host must deliver an already-generated report.
JSON includes report_mode, per-skill score_breakdown, quality_penalty, quality_penalty_uncapped, quality_evidence, community_breakdown, action_advice, and risk_review. It includes ablation_plan only when --ablation-plan-out is used. JSON emits both risk_* and static_risk_* with identical values, and total_score as an alias of local_score; treat risk_* and local_score as canonical.
Keep deletion advice conservative for system or host-core skills, and prefer narrowing or merging when overlapping skills still serve distinct host integrations.
Resources
{baseDir}/scripts/skill_usefulness_audit.py: compatibility wrapper for the modular audit package.{baseDir}/scripts/skill_usefulness_audit_lib/: collect metadata, score skills, scan static risk hints, and render Markdown reports plus optional JSON artifacts.{baseDir}/references/report-narration-prompt.md: concise prompt for turning the report into a user-facing conversational summary.{baseDir}/references/scoring-rubric.md: 10-point scoring rules, confidence logic, community prior, and action thresholds.{baseDir}/references/ablation-protocol.md: normalized replay method for historical conversations.
Questions people ask
- Can it delete, disable, merge, or quarantine skills for me?
- No. Delete, merge-delete, and quarantine-review are manual-review recommendations, and a structure-only report must not be used by itself to delete skills.
- What evidence can the audit use?
- It can use per-skill usage files, raw history when direct usage is weak or missing, normalized skill-on/skill-off results, offline community metrics, and installed skill metadata and resources. Without extra files, it runs a lower-confidence structure-only audit.
- How does it handle API and tool skills during ablation?
- API and tool skills are treated as protected capabilities. It does not fake no-tool ablations for them; selected general skills can instead be replayed with identical prompts and artifacts for pairwise judging.
Related skills
Browse and install a weekly updated collection of 11,211+ OpenClaw agent skills.
Find and revise AI-writing patterns while preserving unaffected prose and protected content.
Inspect token usage for six AI agents from local data through a menu, direct selection, or live monitoring.
Inspect skill packages locally and produce a structured report on capabilities, risks, warnings, and trust dependencies.
Check NanoClaw skills for known vulnerabilities before installation and during ongoing audits.