How to Vet and Maintain Claude Code Skills

Before installing a Claude Code skill, read what it can access, scan its bundled resources and decide whether it duplicates something you already use. After installation, keep a record of its source and test any change against the problem it is meant to solve.

This guide uses the Skill Forge CLI for that review cycle. It covers two different jobs: vetting a new candidate and maintaining an installed skill. A passing scan is one input to the decision, not a certificate of safety or usefulness.

Which tool provides this workflow now?

The older rhize-meta plugin was removed from the Rhize marketplace in July 2026. Its governance capabilities moved to @rhize/skill-forge. The commands below were checked against the published 0.22.0 release; do not install an old rhize-meta copy to follow this guide.

Use the CLI when you need a repeatable review record across skills and projects. Claude Code can help interpret findings and propose changes, while the CLI owns explicit scan, report and refinement operations.

Separate a new install from an existing-skill fix

For a new candidate, ask what it does, where it came from, what permissions it expects and whether you need it. For a failing installed skill, capture a concrete example of expected versus actual behavior before proposing a change.

These are different decisions. A safety scan does not prove task performance. A successful task does not prove that a skill is safe to install. Review both, and keep the scope of each finding clear.

A practical review cycle

Start by identifying the task you need help with and the skills already available. Record the candidate source and version where possible. Do not infer that a high install count or a familiar repository name is sufficient review.

When a candidate contains only a useful fragment, keep the proposed extraction small and review it as a new change. Copying the entire folder can introduce scripts or instructions unrelated to your task.

1. Configure the roots you intend to review

Run npx @rhize/skill-forge@0.22.0 init. Inspect the proposed skill roots and promotion target before saving them. A configured directory is a review scope, not permission for an agent to make unrelated edits.

2. Scan a candidate before installing it

Run npx @rhize/skill-forge@0.22.0 scan owner/name --json, substituting the candidate you intend to inspect. Scan stages the candidate, profiles it and reports detected risks without promoting it into a live skill directory.

Read the report and the source. Check scripts, tool dependencies, file access, external destinations and licensing. The built-in scanner uses static rules; a clean result cannot prove that the instructions will behave correctly in every host.

3. Make an explicit install decision

If the review supports installation, run npx @rhize/skill-forge@0.22.0 add owner/name and inspect the final decision. Under the default block-high policy, HIGH or CRITICAL findings prevent promotion. Hold a candidate when you need more evidence rather than bypassing the finding.

A held candidate appears in list. Use promote <id> only after resolving the questions that caused the hold; promotion re-checks the candidate. Use reject <id> to discard a candidate you do not want.

SkillSpector adds another static scan when installed; its absence leaves the built-in gate. Optional skills.sh discovery uses find and has its own authentication requirements. You do not need that discovery service to scan a local candidate.

4. Audit what is already installed

Use the configured roots to define the audit scope, then review findings against the work the team actually does.

Run npx @rhize/skill-forge@0.22.0 audit --json against your saved configuration. Add --claude-plugins when you want enabled Claude Code plugin skills included. Findings and usage-based recommendations are review inputs; unobserved usage is not proof that a skill is useless.

5. Turn one observed failure into a small refinement

For a targeted fix, record the skill, the failing example, the expected result and the smallest proposed change. Use refine with --dry-run to inspect a project-scoped override before applying it. Capture does not modify the original base SKILL.md.

Use refine which <skill> to see the resolved scopes when a change appears not to take effect. A project override can shadow a broader copy. Test the exact file and host invocation rather than assuming a written patch was loaded.

6. Activate and test the refinement

A captured patch is not the same as a runtime-verified skill. Use refine activate with the exact source directory, a unique project skill name and --host claude or codex. Preview it with --dry-run --json and review the complete file list and safety result before confirming.

Open a fresh host task, invoke the exact activated skill and retry the original failing case. Record both successful and failing behavior. The activation result starts with runtimeVerified: false because file creation alone does not establish host use.

Example requests to your assistant

"Review this skill for our PDF workflow. Show its scripts, permissions, source and overlap with installed tools before recommending an install."

"This skill failed on a test fixture. Reproduce the failure, propose a project-scoped fix and show the dry-run diff before applying it."

"Check whether the activated project skill is the one this fresh task loaded, then rerun the original example."

When should a local fix become a shared default?

A pattern becomes eligible for generalization only after it recurs in a second, genuinely different project. Review refine patterns, preview refine promote <PATTERN-ID> --dry-run and inspect the changed files. The tool makes a backup for rollback; that does not remove the need to test the promoted behavior.

For ongoing maintenance, use watch to identify upstream drift and audit to review the installed set. Plugin caches remain host-managed: do not patch installed cache files as a durable fix.

Keep the review proportional to the task

Start with one candidate or one reproduced failure. Read the Skill Forge command reference for the exact release before using mutation commands. Source: https://github.com/Rhize-Media/skill-forge/tree/v0.22.0

The install-checking guide covers the candidate pipeline in more detail. This guide adds the ongoing loop: observe a failure, propose a small correction, preview it, activate the exact project skill and verify the result.