skill-check
Validate Agent Skills Before Release
Skill authors need evidence that a skill works and does not expose users to avoidable risk. SkillCheck reviews structure, security, evals, scripts, and outputs through tiered checks.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "skill-check" from https://skillstore.io/skills/jckjhns-skill-check.md and its manifest at https://skillstore.io/api/skills/jckjhns-skill-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "skill-check". Quick Check the chart skill before I share it.
Expected outcome:
A concise report with a verdict, passed checks, failed checks, security findings, and prioritized fixes.
Using "skill-check". Run a Standard Check on a skill that converts CSV files to reports.
Expected outcome:
A validation report covering eval results, script execution status, mock input files, output format checks, and warnings.
Using "skill-check". Review this community skill for marketplace safety.
Expected outcome:
A security-focused assessment that separates confirmed risks, false positives, execution concerns, and required remediation.
Security Audit
SafeAll 118 static findings are false positives after contextual review. They occur in Markdown documentation, evaluation expectations, or deliberately insecure fixtures that teach the skill to identify unsafe code. The operational instructions require a security review before script testing and provide no evidence of prompt injection, data exfiltration, or unauthorized execution.
Risk Factors
⚡ Contains scripts (5)
📁 Filesystem access (24)
⚙️ External commands (38)
🌐 Network access (1)
🔑 Env variables (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/jckjhns-skill-check/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/jckjhns-skill-check?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/jckjhns-skill-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jckjhns-skill-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/jckjhns-skill-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
JckJhns. (2026). skill-check security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jckjhns-skill-check/audits/7BibTeX citation
@techreport{jckjhns-jckjhns-skill-check-2026,
author = {JckJhns},
title = {skill-check security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/jckjhns-skill-check/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-check security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "JckJhns"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/jckjhns-skill-check/audits/7"
identifiers:
- type: other
value: "skillstore:jckjhns-skill-check:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Pre-release skill validation
Run a structured check before publishing a new skill to users or a marketplace.
Regression testing after changes
Re-run evals, script tests, and output checks after updating a skill.
Security-focused marketplace review
Inspect scripts, file access, instructions, and execution risks before accepting a community skill.
Try These Prompts
Run a Quick Check on the skill at ./my-skill. Report structural, security, and best practice issues.
Run a Standard Check on the skill at ./my-skill. Include eval regression, script checks, and I/O contract validation.
Audit the skill at ./my-skill for instruction security and script risks. Ask before running any code that is flagged.
Run a Deep Check on ./my-skill. Include edge cases, workflow simulation, eval regression, and prioritized remediation.
Best Practices
- Start with Quick Check for unknown skills, then decide whether execution-based tests are safe.
- Review the test plan before Standard or Deep checks run target skill scripts.
- Use an isolated workspace for mock files, generated outputs, and captured test evidence.
Avoid
- Do not run target scripts after critical security findings without explicit user approval.
- Do not treat the best practice score as the same thing as the functional verdict.
- Do not skip discovery and read only SKILL.md when a skill has supporting files.
Frequently Asked Questions
Does SkillCheck create or modify skills?
What is the default check depth?
Can it run without executing target scripts?
How does it handle dangerous scripts?
Does it support Claude, Codex, and Claude Code?
What evidence does a report include?
Developer Details
Author
JckJhnsLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
6c98d8e1adf5233bd8052190e71e23dd9a585772
Maintenance freshness
7/21/2026
Usage
5 downloads · 50 views