Automated summary
Runs the `nook doctor` diagnostic, explains each gap with its fix, repairs the part that belongs to the agent, and lists the decisions only the owner can make, then confirms the guards actually fire.
Strengths
- A short, ordered procedure: doctor in JSON then plain text, fixes, and a final re-check.
- Clearly splits what the agent can repair (a missing block, a missing rule file) from what needs an owner decision (a conflicting rule, a nonexistent pack, a secret path).
- Goes beyond the report by testing the hook with a canary read through the Read tool and stating "guards: on" or "guards: off".
- Names the real traps: a clean doctor with a dead hook means a broken desk, and a hook with a wrong path blocks nothing.
Limitations
- Depends entirely on the `nook` CLI and its output format; without it there is nothing to run.
- Automatic repairs stop at `nook init --update` and the managed block: `nook.yml` and `CLAUDE.md` are not freely edited.
- The canary test deliberately reads `.env.nook-canary`, so if the hook is not running the real content may surface and must never be reproduced in the report.
Use it when the owner asks for a checkup, says something feels off about the desk, or right after a Nook update.
Skip it when Nook is not installed, or when the problem is unrelated to the desk configuration and its guards.
Security analysis
CautionThe skill is a diagnostic/repair workflow: it runs `nook doctor`, explains gaps, runs `nook init --update`, and verifies that a protective hook blocks a canary secret read. There is no network exfiltration, no obfuscation, no destructive filesystem command, and no instruction to disable safety controls — the canary read is explicitly a negative test. Risk is limited to the broad `cat *` wildcard (arbitrary file reads) and a state-changing init step, both plausible for the stated job, so the rating is caution rather than safe or risky. The content contains no embedded instructions attempting to redirect the auditor.
- •Allowed tools include Bash(cat *) with an unrestricted wildcard, permitting reads of arbitrary files (including secrets) beyond the skill's stated purpose
- •Step 4 deliberately reads `.env.nook-canary` through the Read tool to test that the hook blocks it; this is a local guard verification, but it normalizes attempted secret reads and depends on the hook actually firing
- •Step 3 runs `nook init --update`, which mutates the project configuration — a state-changing action, though scoped and legitimate
- •Bash(nook *) and Bash(cat *) grant broad shell execution and arbitrary file reads; `cat` is unrestricted by path, so any readable file (including real .env files) could be dumped into the transcript even though the skill only needs doctor output.
- •Step 3 runs `nook init --update`, which mutates project configuration files without per-action confirmation; the skill does constrain itself to the managed block of nook.yml/CLAUDE.md, which limits but does not eliminate write risk.
- •Step 4 deliberately attempts to read `.env.nook-canary`; the safety property depends entirely on an external hook being installed and enabled. If the hook is absent the read succeeds and the file contents enter context (mitigated by it being a canary, not a real secret).
- •No destructive, obfuscated, or exfiltrating commands (no curl|sh, no rm -rf, no outbound network calls) and no attempt to alter the auditor's instructions were found.
Examples
Run a checkup on my desk and tell me what needs my attention.Something feels off with my agent setup since this morning — run a checkup and fix what you can.I just updated Nook. Do a checkup, fix the agent side, and confirm the guards are actually running.name: checkup description: "Run nook doctor and explain each gap with its fix, then fix the part that is the agent's and list the part that is the owner's. Use when the owner says checkup, something feels off, or after a Nook update." disable-model-invocation: true allowed-tools: Bash(nook *), Bash(cat *), Read, Glob
Goal: the owner knows what is wrong in this desk and what to do, in one short report.
Order
- Run
nook doctor --jsonandnook doctor. - For each gap, say in one line what it means for the work, and the fix. Group the gaps: the agent can fix (a missing block, a missing rule file), the owner must decide (a conflicting rule, a pack that does not exist, a secret path).
- Fix the agent's part: run
nook init --updatewhen a gap names it. Do not editnook.ymlorCLAUDE.mdoutside the block. - Prove that the guards work: ask to read
.env.nook-canarythrough the Read tool. The hook must refuse. Report "guards: on" or "guards: off, the hook did not run". - Run
nook doctoragain and report what is left.
Gotchas
- A doctor that reports no gap and a guard that does not run is a broken desk. Always do step 4.
- A hook that cannot start (a wrong path) does not block. When the canary read goes through, say that the plugin is not installed or not enabled for this user.
- The report starts with what waits for the owner, or "Nothing waits for you".
From the file to a first result
The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.
View the source and supporting filesThis download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.
1. Download the file
Download SKILL.mdFrom the root of a test project, save the file as .skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.
Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.
mkdir -p '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/nook-checkup-and-guard-verification-mvg6txlw/download' --output '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md.part' && mv '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md.part' '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md'2. Check prerequisites
Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.
Tools declared by the author (check availability in your agent): Bash(nook *), Bash(cat *), Read, Glob
No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.
The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.
3. Load the skill
After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.
Claude Code
test -f '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md' && test -s '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/checkup' && cp -R '.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw' '.claude/skills/checkup'OpenSkills
OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.
Official OpenSkills installationopenskills install './.skill-downloads/nook-checkup-and-guard-verification-mvg6txlw'openskills read 'nook-checkup-and-guard-verification-mvg6txlw'Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.
For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.
openskills syncManual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.
4. Try a first task
Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:
Read .skill-downloads/nook-checkup-and-guard-verification-mvg6txlw/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.
Configure a Chat Channel with SecretRefs
DevOps
Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.
Investigate ClickHouse CI Failures
DevOps
Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.
Ansible PR Review
DevOps
Reviews an Ansible PR following the project's standardized process, including changelog checks, test coverage validation, and feedback tracking.