Auditing Plumbline, the coding plugin I built, I found that it ships 43 files, about 50,000 tokens, that the AI never loads. ##What it is I built Walkdown, a pre-flight check for AI skills. You give it a GitHub link or a folder, and it reads the instruction layer: the SKILL.md files, agent definitions, hooks, manifests and CLAUDE.md, the English a model loads and runs with your permissions. For each finding it answers two questions, cited to a file and line. What does this text ask the model to do? What does installing it grant? Run it before you install someone else's skill, or before you ship your own. I built it for security. Most of what it taught me was about writing better skills. ## What you can learn from a run The summary page asks four questions: - **Size and shape.** What it costs in tokens every session and at its largest, against the context you expect. If you run local models, add `--context 8k` and watch the percentages move. It also lists the files that ship and never get used. - **Will it work somewhere else?** Hard-coded paths, programs it needs and never declares, and which AI tools besides Claude Code it's ready for. Got a CLAUDE.md and no AGENTS.md? You'll see it. - **Does it ask only for the tools it needs?** Tools granted and never used, loops with no stated limit, hooks that fire on every prompt. - **Anything to be careful about.** Hidden characters the model reads and you can't see. Dead links and files nothing points to. Instructions to go fetch more instructions from somewhere else. Simon Willison's lethal trifecta (can it read your data, take outside input, and send data out?). Leftover TODOs and pinned model IDs land here too. You can get deep into the details of everything it caught. Each finding also says how often that pattern turns up in other repos, so you can tell a common habit from an odd one. `review.html` walks you through each place one card at a time so you can mark it.