English Français العربية

skilllint — vet an agent skill before you install it

Official registry Security

Vet an agent skill before you install it: structure, triggers, secrets.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http skilllint-vet-an-agent-skill-before-you- 'https://rta.lat/skilllint/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "skilllint-vet-an-agent-skill-before-you-": {
            "type": "http",
            "url": "https://rta.lat/skilllint/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. skilllint
  2. Rules
  3. Use it
  4. Signed verdicts

skilllint

Private lint of agent skills (SKILL.md). Nothing leaves the machine.

Existing scanners (for example NVIDIA SkillSpector - 71 patterns, AST, YARA, CVE lookup) answer "is this artifact dangerous", and they ship the inspected content to their provider. We do something narrower and complementary:

  • privacy - the check runs locally; only a verdict, a score and a hash go out;
  • reproducibility - the verdict is bound to a sha256 of the file, so it can be signed and verified later;
  • comparison - rank several candidates from different registries instead of scanning one artifact at a time.

Rules

idseveritycheck
R-001criticalfrontmatter missing
R-002highname missing or invalid
R-003highdescription missing or too long
R-004mediumno trigger ("when to use") in description
R-005mediumdead instructions (TODO / deprecated / placeholder)
R-006criticalsecret-shaped literals
R-007criticalprompt-injection / exfiltration markers
R-008mediumreferences to files that do not exist
R-009lowfile larger than 60 KB
R-010highworld-writable scripts
R-011mediumunbounded autonomy instructions

Verdict: PASS (>=80, no critical) | WARN | FAIL (any critical).

Use it

python3 mcp_server.py                            # stdio
python3 mcp_server.py --http 8191                # streamable http
npx -y mcp-remote https://rta.lat/skilllint/mcp  # hosted

Tools: lint_skill(path) | compare_skills(paths) | lint_rules()

Signed verdicts

lint_skill returns {verdict, score, sha256, findings[]}. That hash is what attest signs and drift enforces as an allowlist - see Verified Tool Registry.

Locales: en, hi. India (Bharata) is supported from day one; legal claims require official sources, otherwise report pending.

License: MIT

Frequently asked questions

What is skilllint — vet an agent skill before you install it?

Vet an agent skill before you install it: structure, triggers, secrets.

How do I install skilllint — vet an agent skill before you install it?

It runs as a remote server. In Claude Code: claude mcp add --transport http skilllint-vet-an-agent-skill-before-you- 'https://rta.lat/skilllint/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does skilllint — vet an agent skill before you install it need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is skilllint — vet an agent skill before you install it open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains skilllint — vet an agent skill before you install it?

It is published by mrpkk. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.