Skip to content
Back to skills

Skill Spec Lint

ASecurity

Validate Agent Skills YAML, field types, naming, lengths, and discovery layout. Use when authoring, reviewing, or checking SKILL.md files. Requires PyYAML; uv runs it in an isolated environment.

  • 4 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 6, 2026
ai-agentspythongobash

Works with

  • cli

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 6, 2026

npx -y skills add fakoli/fakoli-plugins --skill skill-spec-lint --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Skill Spec Lint?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Skill Spec Lint
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/fakoli-skill-spec-lint/badge)](https://www.skillsdirectory.com/skills/fakoli-skill-spec-lint)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: skill-spec-lint
description: Validate Agent Skills YAML, field types, naming, lengths, and discovery layout. Use when authoring, reviewing, or checking SKILL.md files. Requires PyYAML; uv runs it in an isolated environment.
---

# Skill Spec Lint

Resolve the plugin root from the loaded skill (`../..`) or the host's plugin-root variable, then run:

```bash
uv run --script "<plugin-root>/scripts/skill_spec_lint.py" [PATH ...]
```

Inputs may be `SKILL.md`, a skill directory, a plugin, or a repository. Overlapping paths are counted once. `--help` shows the CLI. With no paths, scan the current directory.

The linter parses complete YAML, rejects duplicate keys, and validates name/directory agreement, required strings, optional types, string metadata, and length bounds. A missing YAML dependency is an error, never a reduced-coverage pass. `uv` may download PyYAML on first use; validation itself is local. If PyYAML is already installed, direct Python invocation also works.

Errors return 1; CLI/dependency errors return 2. Unknown host extensions, nested discovery layout, and the recommended 500-line body budget are warnings. Warnings do not fail the run. Discovery layout is a repository convention, not a universal host guarantee.

Report concrete findings. This validates structure, not whether a skill activates appropriately or supports good decisions. See [README](../../README.md) and the [Agent Skills specification](https://agentskills.io/specification).

Files in this skill

  • SKILL.md1.5 KB
  • agents/openai.yaml186 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.