{
  "markdown": "# SkillCheck Free\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Claude Code](https://img.shields.io/badge/Claude_Code-Skill-green?logo=anthropic&logoColor=white)](https://docs.anthropic.com/en/docs/claude-code)\n[![Claude Projects](https://img.shields.io/badge/Claude-Projects-orange?logo=anthropic&logoColor=white)](https://support.claude.com/en/articles/12512180-using-skills-in-claude)\n[![Cursor](https://img.shields.io/badge/Cursor-Rules-purple)](https://cursor.com/docs/context/rules)\n\n[![skillcheck passed](https://raw.githubusercontent.com/olgasafonova/skillcheck-free/main/skills/skill-check/passed.svg)](https://getskillcheck.com)\n\nValidate AI coding assistant skills against the [agentskills specification](https://agentskills.io). Works with Claude Code, Claude Desktop/Web, and Cursor. Catch issues before your users do.\n\n## Why SkillCheck?\n\nAgent Skills are now an open standard adopted by Claude Code, Cursor, and dozens of coding agents. Your skill needs to work everywhere and follow best practices.\n\nSkillCheck validates:\n- Does the YAML frontmatter follow the spec?\n- Will it trigger when users actually need it?\n- Are the instructions clear and unambiguous?\n\n## Installation\n\n### Claude Code\n\nThe simplest path — use the [skills CLI](https://github.com/vercel-labs/skills):\n\n```bash\nnpx skills add olgasafonova/SkillCheck-Free\n```\n\nOr copy the folder manually:\n\n```bash\ncp -r skills/skill-check ~/.claude/skills/\n```\n\nOr clone directly:\n\n```bash\ngit clone https://github.com/olgasafonova/SkillCheck-Free.git\ncp -r SkillCheck-Free/skills/skill-check ~/.claude/skills/\n```\n\n### Claude Desktop/Web (Projects)\n\n1. Open [claude.ai](https://claude.ai) or Claude Desktop app\n2. Create a new Project (or open an existing one)\n3. Go to Project settings → Custom instructions\n4. Copy the contents of [`skills/skill-check/SKILL.md`](skills/skill-check/SKILL.md) (everything after the `---` frontmatter)\n5. Paste into the custom instructions field\n\nNo file installation needed - the skill runs directly from your Project instructions.\n\n### Cursor\n\nCopy the rule file to your project's `.cursor/rules` directory:\n\n```bash\nmkdir -p .cursor/rules\ncp cursor-rules/skill-check.mdc .cursor/rules/\n```\n\nOr clone directly:\n\n```bash\ngit clone https://github.com/olgasafonova/SkillCheck-Free.git\nmkdir -p .cursor/rules\ncp SkillCheck-Free/cursor-rules/skill-check.mdc .cursor/rules/\n```\n\n## Where to find SkillCheck-Free\n\nSkillCheck-Free is listed in:\n\n- **[skills.sh registry](https://skills.sh/olgasafonova/SkillCheck-Free)** — install via `npx skills add olgasafonova/SkillCheck-Free`\n- **[antigravity-awesome-skills](https://github.com/sickn33/antigravity-awesome-skills)** — included in sickn33's 1,239+ universal agentic skills collection\n\n## Usage\n\nIn Claude Code, Claude Desktop/Web, or Cursor, say any of:\n- \"skillcheck my skill\"\n- \"check skill at path/to/SKILL.md\"\n- \"validate my skills\"\n\n## Example Output\n\n```\n## SkillCheck Results: my-awesome-skill\n\n### Summary\n- Critical: 1 | Warnings: 2 | Suggestions: 3 | Passed: 44\n\n### Critical Issues\n**[1.2-desc-what]** Line 3: Description missing action verb\n**Fix**: Start description with Create, Generate, Build, Convert, etc.\n\n### Warnings\n**[4.2-ambiguous-term]** Line 47: Vague term \"several\" found\n**Fix**: Specify exact count or range\n\n### Strengths\n- Skill includes example section\n- Skill documents prerequisites\n- Description includes activation triggers\n```\n\n## What It Checks\n\n### Structure (1.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 1.1-name | Invalid name format, reserved words |\n| 1.2-desc | Missing or weak description (WHAT verb + WHEN trigger recommended) |\n| 1.3-tools | Unknown or deprecated tool formats |\n| 1.4-category | Invalid category format |\n| 1.9-xml | XML angle brackets in frontmatter (prompt injection risk) |\n| 1.9-arg-hints | Missing argument-hint in frontmatter when $ARGUMENTS is used |\n| 1.10-readme | README.md inside skill folder (docs belong in SKILL.md) |\n\n### Body (2.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 2.1-lines | File too long (500+ lines warning) |\n| 2.3-date | Hardcoded dates that will go stale |\n| 2.4-empty | Empty sections with no content |\n| 2.8-antipattern-format | Anti-pattern sections using prose instead of tables/bullets |\n| 2.9-mcp-tool-unqualified | Unqualified MCP tool names missing server prefix |\n\n### Naming (3.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 3.1-vague | Generic names like \"helper\", \"utils\" |\n| 3.2-length | Names too short or too long |\n| 3.3-single | Single-word names lacking specificity |\n| 3.4-gerund | Gerund naming (\"writing-helper\" instead of verb-noun) |\n\n### Semantic (4.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 4.1-contradiction | Conflicting instructions |\n| 4.2-ambiguous | Vague terms like \"several\", \"appropriate\" |\n| 4.3-output | Output mentioned but no format specified |\n| 4.6-wisdom | Generic advice/platitudes instead of actionable instructions |\n| 4.7-desc-workflow-steps | Description summarizes workflow steps (causes agents to skip body) |\n\n### Design Pattern Classification (19.x)\nSkillCheck classifies each skill into one of five design patterns from the Google ADK taxonomy:\n\n| Pattern | What It Means | Example Skills |\n|---------|--------------|----------------|\n| Reviewer | Evaluates output against criteria | skill-check, code-review |\n| Generator | Produces structured artifacts from templates | linkedin-post, brand-assets |\n| Inversion | Asks user questions before acting | grill-me, feature-scoping |\n| Pipeline | Chains multiple steps with checkpoints | sift, tapestry |\n| Tool Wrapper | Wraps an API with context-aware instructions | lmwtfy |\n\nPro adds deep checks: validates pattern-specific requirements (criteria for Reviewers, output specs for Generators, etc.).\n\n### Quality Patterns (8.x) - Strengths\nSkillCheck also recognizes good practices:\n\n| Check | What It Recognizes |\n|-------|-------------------|\n| 8.1 | Has example section |\n| 8.2 | Documents error handling or limitations |\n| 8.3 | Description includes activation triggers |\n| 8.4 | Specifies output format with examples |\n| 8.5 | Uses structured instructions (numbered steps) |\n| 8.6 | Documents prerequisites |\n| 8.7 | Includes negative triggers to prevent over-triggering |\n| 8.8 | Uses `${CLAUDE_SKILL_DIR}` for portable path references |\n\n### Knowledge Density (22.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 22.7 | Gotchas/troubleshooting sections with only generic filler and no concrete knowledge |\n\nPro adds: threshold detection (22.1), consequence patterns (22.2), experience markers (22.3), debugging sequences (22.4), decision density (22.5), and concrete code references (22.6).\n\n### Plugin Manifest (24.x)\n\nWhen the input is a Claude Code plugin manifest (`.claude-plugin/plugin.json`), SkillCheck Free validates it against Anthropic's reference schema:\n\n| Check | What It Catches |\n|-------|-----------------|\n| 24.1 | `name` not in kebab-case |\n| 24.2 | `version` not canonical semver (no `v` prefix, must be MAJOR.MINOR.PATCH) |\n| 24.3 | `description` missing or empty |\n| 24.4 | `author.name` missing or empty |\n| 24.5 | Command file collides with bundled Claude Code commands (`simplify`, `batch`, `debug`, `loop`, `claude-api`, `security-review`) |\n| 24.6 | `.claude-plugin/` contains files other than `plugin.json` (commands/skills/hooks belong at plugin root) |\n\nSchema-floor rule: any rule that rejects Anthropic's own reference plugins is mis-calibrated. Validation stays compatible with the four-field minimum.\n\nPro adds Cat 24 marketplace governance: cross-plugin dedup detection, naming convention enforcement against an org taxonomy, change-gate eval integration, maintainers and deprecation provenance recommendations, and cross-skill dependency graphs.\n\n### MCP Tool List (23.x, Free hook)\n\nWhen the input is an MCP server's `tools/list` response (standard MCP shape), SkillCheck Free surfaces two Agent Integration Readiness signals:\n\n| Check | What It Catches |\n|-------|-----------------|\n| 23.1-tool-count-high | Server exposes >20 tools (consider intent grouping or code-orchestration) |\n| 23.1-tool-count-strong | Server exposes >40 tools (strong code-orchestration candidate, Cloudflare 2-tool reference) |\n| 23.1-api-mirror | 3+ CRUD verb prefixes against the same noun (1:1 OpenAPI mirror smell) |\n\nPro adds full Cat 23: CIMD-OAuth detection, MCP Apps usage, code-orchestration adoption, server-delivered skills pairing, remote vs local availability, destructive flag annotations, and user-vs-agent distinction enforcement.\n\n### OWASP Agentic Top 10 (26.x)\n\nMaps the OWASP Top 10 for Agentic Applications (2026) onto author-time text signals. The category only scores a skill with an agent surface (declares tools beyond Read/Glob/Grep, ingests external content, orchestrates subagents, or performs consequential actions); a plain text-formatting skill reports not-applicable. SkillCheck Free runs the 8 items with a deterministic signal:\n\n| Check | What It Catches |\n|-------|-----------------|\n| ASI-02 Tool Misuse | `allowed-tools: *`/`all` (critical), unconstrained `Bash`, or 5+ tools with no rationale |\n| ASI-03 Identity Abuse | caller-identity-override params (`as_user`, `impersonate`, `run_as`, etc.) |\n| ASI-04 Supply Chain | unpinned dependency installs (`pip install x`, `npm install x`, `npx x@latest`) |\n| ASI-05 Code Execution | `eval`/`exec`/`pickle.loads`/`subprocess shell=True` or `curl ... \\| sh` |\n| ASI-08 Cascading Failure | uncapped loops or fan-out (\"retry until\", \"loop until\") |\n| ASI-09 Trust Exploitation | destructive op (`rm -rf`, `git push --force`, send/merge) with no confirmation gate nearby |\n| ASI-10 Rogue Agents | safeguard-disabling flags (`--no-verify`, `--force`) or long-running tasks with no kill switch |\n| ASI-11 Untraceability | consequential actions with zero logging/audit language |\n\nPro adds the 7 grader items (ASI-01 goal hijack, ASI-06 memory poisoning, ASI-07 subagent trust, and the intent-reading halves of ASI-02/03/09/10): SkillCheck builds an evidence-loaded rubric pack and your own AI agent judges it, with no API key needed.\n\n### Invisible Unicode (30.x)\n| Check | What It Catches |\n|-------|-----------------|\n| 30.1-ascii-smuggling | Instructions hidden in Unicode tag characters; the hidden payload is decoded and shown in the finding |\n| 30.2-bidi-override | Trojan-source BiDi controls (CVE-2021-42574) that make displayed text differ from actual text |\n| 30.3-invisible-run | Runs of 10+ consecutive invisible characters (hidden-data encoding channel) |\n| 30.4-invisible-char | Isolated or grouped zero-width characters |\n\nLegitimate emoji never fire: flag emoji tag sequences, zero-width joiners in family emoji, and variation selectors are all exempt, and a byte-order mark at file start is ignored.\n\n## Severity Levels\n\n| Level | Meaning | Action |\n|-------|---------|--------|\n| Critical | Skill may not function | Must fix |\n| Warning | Best practice violation | Should fix |\n| Suggestion | Could be improved | Nice to have |\n| Strength | Good practice detected | Keep it up |\n\n## Free vs Pro\n\n| Feature | Free | Pro |\n|---------|------|-----|\n| Structure validation | Yes | Yes |\n| Body & naming checks | Yes | Yes |\n| Semantic consistency | Yes | Yes |\n| Quality patterns | Yes | Yes |\n| **Design Pattern Classification** | Detection | Deep checks |\n| **Knowledge Density** | Hollow content | Full density analysis |\n| **OWASP Agentic Top 10** | 8 deterministic checks | Grader pack your AI evaluates |\n| Artifact Contract Validation | - | Yes |\n| Trigger Collision Detection | - | Yes |\n| **Eval Kit (test prompt generation)** | - | Yes |\n| Anti-slop detection | - | Yes |\n| Security scanning | - | Yes |\n| Token budget analysis | - | Yes |\n| WCAG accessibility | - | Yes |\n| Enterprise readiness | - | Yes |\n| Production readiness | - | Yes |\n| Agent Readiness (L0-L3) | - | Yes |\n| MCP server integration | - | Yes |\n| CI/CD binary | - | Yes |\n\n**Get Pro**: [getskillcheck.com](https://getskillcheck.com)\n\n## Prerequisites\n\n- Claude Code (or any AI assistant with file Read capability)\n- Works on macOS, Linux, Windows\n- No dependencies required\n\n## How It Works\n\nSkillCheck Free is itself a skill/rule file. When you say \"skillcheck\", your AI assistant reads the validation rules and applies them to your target skill. No external API calls, no binaries - just your assistant following instructions.\n\n## Contributing\n\nFound a bug or have a suggestion? Open an issue at [github.com/olgasafonova/SkillCheck-Free/issues](https://github.com/olgasafonova/SkillCheck-Free/issues)\n\n## Links\n\n- Website: [getskillcheck.com](https://getskillcheck.com)\n- Specification: [agentskills.io](https://agentskills.io)\n- Pro version: [SkillCheck Pro](https://getskillcheck.com)\n\n## License\n\nMIT - see [LICENSE](LICENSE)\n\n---\n\nBuilt by [Olga Safonova](https://github.com/olgasafonova)\n",
  "bytes": 12988,
  "sha": "6016b385b368e50614a98070504d5b474cc9ef12c48f59b456c994011e809ed4",
  "repo_slug": "olgasafonova/skillcheck-free",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_olgasafonova_skillcheck_free_skillcheck__f355cdb6/readme"
}