Auditing

Runs a 10-category diagnostic sweep across your bundle-plugin project: structure, version drift, skill quality, workflow integration, hooks, docs, and security scanning (7 attack surfaces including SKILL.md injection, hook configs, and MCP risks). Auto-detects whether you're auditing a full project, single skill, or workflow layer. Outputs a scored JSON baseline plus a layered markdown report with Go/No-Go verdict. Pure measurement tool, it won't fix anything, just tells orchestrating skills like blueprinting or releasing what's broken. Supports local paths, GitHub URLs, or zip files. If you're shipping a plugin or adding new skills to an existing bundle, this catches the structural rot and security holes before they ship.