SkillHub TRACE Evaluator

Problem

As the number of Skill packages grows, reading only SKILL.md is not enough to judge whether a package is trustworthy, maintainable, or suitable for a real workflow. Manual review can miss recurring issues: dependencies, output contracts, error handling, and convention fit may look fine in description text but behave inconsistently in practice. This skill frames the review around the TRACE five-dimension standard: Trust, Reliability, Adaptability, Convention, and Effectiveness, so the assessment is evidence-based and reproducible.

How It Works

The evaluator first locates the target package. It supports local directories, local zip files, installed skill paths, or a slug after a local copy is obtained. If the package cannot be found, it stops instead of guessing. It then follows references/explore.md to list files, read SKILL.md and key documents, and sample large files only where needed. Scoring is done one dimension at a time using the matching reference. Each subitem receives a score in (0, 5.0], a developer-facing reason, and a plain-user-facing userReason. trust.scan is fixed as skipped because this skill does not perform security scanning; it evaluates items such as trust.domestic. Finally, it assembles JSON according to output-schema.md and runs validation. The result is delivered only when validation returns exit 0.

Boundaries

It is best used for structured quality review of local Skill packages. The output includes a readable five-dimension table, subitem scores, brief reasons, and two summaries, plus the full validated JSON. It should not be treated as a security scanner, dependency reachability tester, or complete functional test. If only a slug is available without a local copy, evaluation should be stopped.