# Validate Agent Skills Before Release

Skill authors need evidence that a skill works and does not expose users to avoidable risk. SkillCheck reviews structure, security, evals, scripts, and outputs through tiered checks.

## Install

```bash
npx skillstore add jckjhns/skill-check
```

## Metadata

- Status: approved
- Slug: jckjhns-skill-check
- Skillstore revision: r1
- Version status: missing
- Tree hash: 91065dce60734df8ce9d5bd127ee70e64ed267c7fb15a687f232ecf8f3a3b010
- Author: JckJhns
- GitHub username: JckJhns
- License: MIT
- Repository: https://github.com/JckJhns/skill-check/tree/main/
- Ref: 6c98d8e1adf5233bd8052190e71e23dd9a585772
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, filesystem, external\_commands, network, env\_access
- Quality score: 80
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/jckjhns-skill-check
- Manifest: https://skillstore.pages.dev/api/skills/jckjhns-skill-check/manifest

## Capabilities

- Runs Quick, Standard, and Deep validation workflows for existing skill directories.
- Checks SKILL.md frontmatter, references, assets, paths, dependencies, and cross-file consistency.
- Compares documented script invocations with actual script arguments and outputs.
- Reviews skill scripts and instructions for dangerous security patterns.
- Processes evals/evals.json cases and records pass or fail evidence.
- Generates mock inputs for common text, document, image, archive, and code file types.

## Use Cases

- Pre-release skill validation: Run a structured check before publishing a new skill to users or a marketplace.
- Regression testing after changes: Re-run evals, script tests, and output checks after updating a skill.
- Security-focused marketplace review: Inspect scripts, file access, instructions, and execution risks before accepting a community skill.

## Prompt Templates

### Quick structure check

```
Run a Quick Check on the skill at ./my-skill. Report structural, security, and best practice issues.
```

### Standard functional check

```
Run a Standard Check on the skill at ./my-skill. Include eval regression, script checks, and I/O contract validation.
```

### Security review only

```
Audit the skill at ./my-skill for instruction security and script risks. Ask before running any code that is flagged.
```

### Deep release gate

```
Run a Deep Check on ./my-skill. Include edge cases, workflow simulation, eval regression, and prioritized remediation.
```

## Limitations

- Standard and Deep checks may execute target skill scripts, so unsafe skills need sandboxing.
- Binary mock generation may require optional Python packages that are not installed.
- Static review can miss novel vulnerabilities or context-specific misuse.
- It reports findings for existing skills and does not create or edit skills.

## Best Practices

- Start with Quick Check for unknown skills, then decide whether execution-based tests are safe.
- Review the test plan before Standard or Deep checks run target skill scripts.
- Use an isolated workspace for mock files, generated outputs, and captured test evidence.

## Anti Patterns

- Do not run target scripts after critical security findings without explicit user approval.
- Do not treat the best practice score as the same thing as the functional verdict.
- Do not skip discovery and read only SKILL.md when a skill has supporting files.

## Security Audit

- Audited at: 2026-07-21T07:37:02.346\+00:00
- Summary: All 118 static findings are false positives after contextual review. They occur in Markdown documentation, evaluation expectations, or deliberately insecure fixtures that teach the skill to identify unsafe code. The operational instructions require a security review before script testing and provide no evidence of prompt injection, data exfiltration, or unauthorized execution.

## Stats

- Views: 50
- Downloads: 10
- Favorites: 0
- Popularity score: 0