Skills when-analyzing-skill-gaps-use-skill-gap-analyzer

📦

when-analyzing-skill-gaps-use-skill-gap-analyzer

Name: when-analyzing-skill-gaps-use-skill-gap-analyzer
Author: DNYoussef

v1.0.0 Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access

Analyze Skill Library Gaps

Skill libraries become hard to govern as coverage, overlap, and usage drift. This skill guides Claude, Codex, and Claude Code through structured portfolio analysis.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "when-analyzing-skill-gaps-use-skill-gap-analyzer" from https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer.md Signed manifest GET /api/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/manifest Signed lockfile GET /api/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/lockfile

Test it

Using "when-analyzing-skill-gaps-use-skill-gap-analyzer". A library has 47 skills across development, GitHub automation, testing, optimization, and meta tools.

Expected outcome:

The report identifies low data engineering coverage, four overlapping code review skills, and one over-complex architecture skill. It recommends one new skill, one consolidation project, and one refactor.

Using "when-analyzing-skill-gaps-use-skill-gap-analyzer". A team wants to decide which skills to maintain before a quarterly planning cycle.

Expected outcome:

Coverage gaps are grouped by domain and priority.
Redundant skills are listed with consolidation targets.
Short-term and long-term actions are ranked by impact and effort.

Using "when-analyzing-skill-gaps-use-skill-gap-analyzer". A maintainer provides usage frequency, last-used dates, and average token counts.

Expected outcome:

The analysis flags skills with low usage, high token cost, and low success rate. It suggests archive, promote, split, or simplify actions.

Security Audit

Medium Risk

v8 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown fences, inline backticks, JSON examples, or JavaScript template literals. The real risks are workflow instructions that run npx claude-flow@alpha hooks or memory commands, which can execute external package code and write or disclose task metadata. No prompt injection attempt or deliberate data-exfiltration intent was found in the reviewed files.

Files scanned

1,495

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

PROCESS.md:398

System reconnaissance

npx claude-flow@alpha hooks post-task --task-id "gap-analysis" --metrics "{...}"

The cited line is not system reconnaissance, but it runs an npx claude-flow@alpha post-task hook with metrics. I keep it because automatic external hook execution can disclose task metadata or run unreviewed CLI code.

Medium

PROCESS.md:479

System reconnaissance

--task-id "gap-analysis-q1-2025" \

The process document shows an npx claude-flow@alpha post-task hook with metrics, not host reconnaissance. The security concern is external hook execution and possible telemetry exposure.

Medium

SKILL.md:631

System reconnaissance

npx claude-flow@alpha hooks post-task --task-id "gap-analysis-q1-2025"

The line invokes an npx claude-flow@alpha post-task hook rather than enumerating the system. It still merits review because hook execution can run external package code and record task metadata.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:71-77

Ruby/shell backtick execution

```bash

The bash example instructs running npx claude-flow@alpha and find against the local skill directory. This is not Ruby backtick execution, but it is real external command guidance that can execute third-party CLI code.

Medium

SKILL.md:145-152

Ruby/shell backtick execution

```bash

The bash block stores inventory through npx claude-flow@alpha, which executes an external npm CLI. This creates supply-chain and local state modification risk if run automatically.

Medium

SKILL.md:341-357

Ruby/shell backtick execution

```bash

The optimization phase directs use of npx claude-flow@alpha memory store. The command is purposeful, but it still runs an external package and writes analysis data.

Medium

SKILL.md:617-632

Ruby/shell backtick execution

```bash

The quarterly workflow includes multiple npx claude-flow@alpha commands for hooks and memory retrieval. These are operational shell commands with external package execution risk.

Medium

SKILL.md:635-641

Ruby/shell backtick execution

```bash

The continuous monitoring example runs npx claude-flow@alpha hooks and memory aggregation. This is legitimate workflow integration but remains external command execution.

Detected Patterns

System reconnaissance×3

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/security.svg)](https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-analyzing-skill-gaps-use-skill-gap-analyzer security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/audits/8

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer-2026,
  author = {DNYoussef},
  title = {when-analyzing-skill-gaps-use-skill-gap-analyzer security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/audits/8},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-analyzing-skill-gaps-use-skill-gap-analyzer security audit report (audit version 8)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer/audits/8"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-analyzing-skill-gaps-use-skill-gap-analyzer:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan a New Skill Library

Map required domains, identify missing capabilities, and prioritize the first skills to create.

Run a Quarterly Portfolio Review

Measure coverage, redundancy, utilization, and complexity before planning maintenance work.

Prepare a Refactoring Roadmap

Find overlapping or over-complex skills and turn them into measurable consolidation tasks.

Try These Prompts

Basic Gap Review

Analyze my skill library for missing coverage, duplicate capabilities, and the top three improvement priorities.

Domain Coverage Audit

Review this skill library against development, DevOps, data, AI, and integration domains. Rank gaps by priority and explain the impact.

Redundancy and Refactor Plan

Identify skills with overlapping capabilities, estimate consolidation value, and propose a phased refactor plan with risks and expected savings.

Portfolio Optimization Report

Use skill metadata, usage metrics, success rates, and core scenarios to create a portfolio optimization report with immediate, monthly, and quarterly actions.

Best Practices

Provide current skill metadata, usage metrics, and success metrics before requesting recommendations.
Review command examples before allowing any external tool execution.
Validate recommendations with maintainers before creating, merging, or archiving skills.

Avoid

Do not treat generated priorities as final decisions without human review.
Do not scan private skill directories unless the user has approved the scope.
Do not optimize only for token savings when coverage or reliability would decrease.

Frequently Asked Questions

What does this skill analyze?

It analyzes skill coverage, redundancy, utilization, complexity, scenario readiness, and improvement priorities.

Does it create new skills automatically?

No. It recommends new skills or refactors, but implementation requires a separate user decision.

Can it work with Claude, Codex, and Claude Code?

Yes. The marketplace metadata lists Claude, Codex, and Claude Code as supported tools.

What inputs improve the analysis?

Skill descriptions, tags, categories, agents, complexity, usage frequency, success rates, and token metrics improve results.

Why does the audit mention command risk?

The source includes example npx commands. Users should review and approve those commands before execution.

Is private skill data sent elsewhere?

No evidence found of deliberate exfiltration, but external workflow commands should be disabled or reviewed if privacy is required.

Developer Details

Author

DNYoussef

License

MIT

Author version

v1.0.0

Skillstore revision

Repository

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/meta-tools/when-analyzing-skill-gaps-use-skill-gap-analyzer

Ref

c579efd02184f1128d6741d16e6c8d951d7d4208

Maintenance freshness

7/18/2026

Usage

7 downloads · 164 views

File structure

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

when-analyzing-skill-gaps-use-skill-gap-analyzer

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Plan a New Skill Library

Run a Quarterly Portfolio Review

Prepare a Refactoring Roadmap

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details