skill-check

Name: skill-check
Author: thedaviddias

Security Community

Repo stars 177
Author updated Live
Author repo skill-check

Fluxly profile Facts only: domain, agents, trust score, runtime, permissions and network

Domain: Security
Compatible agents: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
Trust score: 83 / 100 · community maintained
Author / version / license: @thedaviddias · no license declared
Token usage: Lean
Setup complexity: Plug-and-play
External API key: Not required
Operating systems: macOS · Linux · Windows
Runtime requirements: Node.js
Permissions: Read-only
Write / modify
Network behavior: External requests
Install commands: 26 variants

Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.

Heads up: 未限定 allowed-tools，默认拥有全部工具权限。; 检出高风险片段：pipe_curl_to_shell

Output preview skill-check.preview

---
name: skill-check
description: Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they…
category: security
runtime: Node.js
---

# skill-check output preview

## PART A: Task fit
- Use case: Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they say "validate these skills," "check this repo's skills," "lint SKILL.md files," or "audit skills in [repo URL]." Run skill-check locally or against a cloned GitHub repo and summarize findings..
- Inputs: target material, constraints, expected output, and acceptance criteria.
- Evidence boundary: follow “Installation / When to use / Local validation” and do not present inference as author intent.

## PART B: Execution result
- **01** The card summarizes the use case; runtime output centers on “Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they say "validate these skills," "check this repo's skills," "lint SKILL.md files," or "audit skills in [repo URL]." Run skill-check locally or against a cloned GitHub repo and summarize findings.”.
- **02** When the source has headings, the agent prioritizes “Installation / When to use / Local validation” so the result follows the author’s structure.
- **03** Typical output includes task judgment, concrete steps, required commands or file edits, validation, and follow-up options.
- **04** Risk context follows the fingerprint: read files, write/modify files; may access external network resources; usually needs no extra API key.

## Running Rules
- read files, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding scope.
- Return the result, validation criteria, and next iteration options.

SKILL.md SKILL.md

---
name: skill-check
description: Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they…
category: security
source: thedaviddias/skill-check
---

# skill-check

## When to use
- Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they say "validate these sk…
- Use it when the task has clear inputs, repeatable steps, and validation criteria.

## What to provide
- Target material, scope, expected result, and forbidden changes.
- Whether network, commands, file writes, or external services are allowed.

## Execution rules
- Organize steps around “Installation / When to use / Local validation” and keep inference separate from source facts.
- read files, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding the task.

## Output requirements
- Return the deliverable, key evidence, validation method, and next action.
- Mark missing information as unknown; do not invent commands, platforms, or dependencies.

Evidence boundary and execution chain

The author source anchors workflow facts; repository files anchor sources and commands; Fluxly only adds fit, limitations, and quality judgment.

skill "skill-check" {
  input      -> user goal + target files + boundaries + acceptance criteria
  context    -> Installation / When to use / Local validation
  rules      -> SKILL.md triggers / order / output contract
  runtime    -> Node.js | read files, write/modify files | may access external network resources
  guardrails -> usually needs no extra API key + small-sample validation + diff/log review
  output     -> copyable result + checklist + next iteration
}

Interpretation is structured for decision-making; original keeps the upstream SKILL.md unchanged.

Decide Fit First

Core job: Use when the user wants to validate, lint, or audit agent skill files (SKILL.md). Use when they say "validate these skills," "ch…
Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

Structure: The skill is organized around “Installation”, “When to use”, “Local validation”, “GitHub repo validation”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
Invocation: Name skill-check directly; if the source includes slash commands, start with the command and then add task context.
Validation: Start small and check whether the result follows “Installation / When to use / Local validation” before expanding.

Boundaries And Review

Dependencies: It usually needs no extra API key, so start with a small validation task.
Permissions: Declared permissions include read / write; ask the agent to state file, command, and rollback boundaries before acting.
Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.

skill-check

Validate agent skill files (SKILL.md) using the skill-check tool. Support both local paths and GitHub repos.

Installation

Ensure skill-check is available before running checks:

No install (recommended for one-off or agent use): npx skill-check — uses npm to run the latest version; requires Node.js and network on first run.
Global install (curl): curl -fsSL https://raw.githubusercontent.com/thedaviddias/skill-check/main/scripts/install.sh | bash — installs a global skill-check binary.
Homebrew: brew tap thedaviddias/skill-check https://github.com/thedaviddias/skill-check then brew install skill-check.

If the user has not installed skill-check, use npx skill-check so no prior install is needed. To confirm the tool is available, run npx skill-check rules and expect a list of built-in rule IDs.

When to use

User asks to validate, lint, or check skill files
User provides a local path (e.g. ~/.cursor/skills, ./skills, or a repo root)
User provides a GitHub repo URL and wants skills in that repo validated

Local validation

Run skill-check against the given path:
- Quick lint only: npx skill-check check <path> --no-security-scan --format json
- Full check (includes security scan): npx skill-check check <path> --format json
Parse the JSON output to get diagnostics (ruleId, severity, message, file, line).
Summarize results for the user: number of skills found, errors vs warnings, and any suggested fixes.

Use --format json when you need to parse output programmatically. Use default text format when showing output directly to the user.

GitHub repo validation

Clone the repo shallowly into a temp directory, e.g. git clone --depth 1 <url> /tmp/skill-check-<short-hash> (or use a system temp path).
Run npx skill-check check /tmp/skill-check-<hash> (with --format json if you will parse results).
Report findings to the user.
Remove the temp directory when done.

Commands reference

npx skill-check check [path] — run validation (+ optional security scan). Default path is .
npx skill-check check [path] --no-security-scan — lint only, skip security scan
npx skill-check check [path] --format json — machine-readable output with quality scores
npx skill-check check [path] --format github — GitHub Actions ::error / ::warning annotations
npx skill-check check [path] --format html --no-open — self-contained HTML report
npx skill-check check [path] --fix — auto-fix supported findings
npx skill-check check [path] --fix --interactive — prompt before each fix (TTY only)
npx skill-check check [path] --baseline baseline.json — compare against previous run
npx skill-check new <name> — scaffold a new skill directory
npx skill-check watch [path] — re-run on file changes
npx skill-check diff <pathA> <pathB> — compare diagnostics between two directories
npx skill-check rules — list all built-in rules with severity and fixable status
npx skill-check rules <id> — show detail for a specific rule
npx skill-check report [path] — generate a markdown health report

Interpreting results

error — spec or rule violation; should be fixed.
warn — recommendation; may be acceptable depending on context.
suggestion — every diagnostic includes an actionable suggestion text.
quality score — 0-100 per skill, weighted across frontmatter (30%), description (30%), body (20%), links (10%), file (10%).
duplicates — duplicates.name / duplicates.description warnings when multiple skills share the same name or description.
Exit code 0 means no errors; non-zero means validation failed or security scan found issues.

Testing this skill

To verify this skill and the skill-check CLI work:

Check CLI is available: Run npx skill-check rules. You should see a list of built-in rules (e.g. frontmatter.required, body.max_tokens, etc.).
Validate this repo's skills: From the skill-check repo root, run npx skill-check check skills/ --no-security-scan. Expect one skill (skills/skill-check/SKILL.md) and zero diagnostics (PASS).
Scaffold a test skill: Run npx skill-check new test-skill --dir /tmp. Verify /tmp/test-skill/SKILL.md was created, then npx skill-check check /tmp/test-skill --no-security-scan should pass.
Optional — validate with security scan: Run npx skill-check check skills/ (no --no-security-scan). Requires mcp-scan or uv/pipx for the security scan step.

Install command

One-click installPick a runner, click Copy, paste into your terminal, press enter

npx skills add thedaviddias/skill-check/skills/skill-check -y

Open general install guide

View skill source

Works with

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

Security audit

83 / 100

Community

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。
检出高风险片段：pipe_curl_to_shell

Metadata

Source: github
thedaviddias/skill-check
中文

Category & tags

Category Security

Decide Fit First

Design Intent

How To Use It

Boundaries And Review

skill-check

Installation

When to use

Local validation

GitHub repo validation

Commands reference

Interpreting results

Testing this skill

Discussion