Audits libraries, CLIs, and SDKs using 38 rules for public contracts, package exports, piped output, errors, and configuration. Use when asked to "audit my CLI", "review my SDK", or diagnose package type resolution. For public site or docs agent scores use agent-ready; for agentic product trust use ax-audit; for docs prose use ghostwriter.
Ask your Agent
Use this Skill: https://skilld.dev/gh/mblode/agent-skills/dx-audit
This session only. Nothing lands on disk.
≈154 tokens on demand. Your agent reads this file only when SKILL.md points to it.
One or two sentences on why the rule matters; name the developer-facing failure, not just the best practice. Set impact higher than the category default only when the failure mode justifies it.
Incorrect (what is wrong and why):
// Minimal failing example: only the lines that violate the ruleCorrect (what the fix looks like):
// Same example, fixed; diff against the incorrect block should be obviousSource: SKILL.md on GitHub
The dx-audit skill is a developer experience auditing tool designed to review public APIs, CLIs, and SDKs. It demonstrates a strong security posture by including explicit instructions to validate inputs against path traversal and shell injection, and by warning the agent to inspect potentially malicious lifecycle scripts in audited repositories before running packaging probes. All external tools mentioned are industry-standard utilities.
No alerts
Risk: LOW · No issues
Signed by skilld at b690e67. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.
Last checked against GitHub 2 days ago.