Skills lint-and-validate

📦

lint-and-validate

Name: lint-and-validate
Author: sickn33

Content revision r1 High Risk ⚙️ External commands

Run Lint and Type Validation

Code changes often fail because lint, type, or audit checks are skipped. This skill guides agents through repeatable validation for Node.js and Python projects.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

Quality Assurance Suite · 3 skills Install whole pack

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "lint-and-validate" from https://skillstore.io/skills/sickn33-lint-and-validate.md and its manifest at https://skillstore.io/api/skills/sickn33-lint-and-validate/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-lint-and-validate.md Signed manifest GET /api/skills/sickn33-lint-and-validate/manifest Signed lockfile GET /api/skills/sickn33-lint-and-validate/lockfile

Test it

Using "lint-and-validate". Validate a TypeScript project after a component update.

Expected outcome:

Lint passed with no remaining style errors.
Type checking failed in one component because a required prop was missing.
Recommended next step: update the prop usage and rerun validation.

Using "lint-and-validate". Review a Python project before marking a bug fix complete.

Expected outcome:

Ruff found formatting issues and corrected them.
Mypy reported two missing annotations in changed functions.
Recommended next step: add the annotations and repeat the check.

Using "lint-and-validate". Check whether a repository has validation tools configured.

Expected outcome:

The project has lint and type checks configured, but no security audit command was detected. Add one before release validation.

Security Audit

High Risk

v5 • 7/9/2026 Open versioned report

The Python runner genuinely executes lint commands in the target project, including project-defined npm lint scripts. Several SKILL.md command examples are actionable because the skill allows Bash, while pure command-name and filename mentions are false positives. No prompt injection or explicit data-exfiltration intent was found.

Files scanned

393

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/lint_runner.py:35-45 scripts/lint_runner.py:80-87 scripts/lint_runner.py:104-105

Project-Controlled Commands Run During Validation

The runner reads package.json and executes npm lint scripts in the target directory. A malicious project can define lint scripts that run arbitrary local commands during validation.

The code maps package.json lint scripts to npm run lint and executes them with subprocess.run in the provided project path. This is expected for linting but unsafe for untrusted repositories.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/lint_runner.py:80

Python subprocess.run

proc = subprocess.run(

subprocess.run executes linter command arrays inside the selected project directory. The npm lint path can invoke project-controlled package scripts, so untrusted repositories can execute local commands.

Medium

SKILL.md:14

Ruby/shell backtick execution

1. **Lint/Fix:** `npm run lint` or `npx eslint "path" --fix`

The line instructs the agent to run npm lint or npx eslint with Bash access. npm run lint executes project-defined scripts, which is risky in untrusted repositories.

Medium

SKILL.md:15

Ruby/shell backtick execution

2. **Types:** `npx tsc --noEmit`

The line instructs the agent to run npx tsc, which executes a project tool from the local environment. This is expected validation behavior but still external command execution.

Medium

SKILL.md:16

Ruby/shell backtick execution

3. **Security:** `npm audit --audit-level=high`

The line instructs the agent to run npm audit. This invokes an external package manager command and may disclose dependency metadata to the configured npm registry.

Medium

SKILL.md:19

Ruby/shell backtick execution

1. **Linter (Ruff):** `ruff check "path" --fix` (Fast & Modern)

The line instructs the agent to run ruff with fix mode over a path. It is legitimate linting guidance, but it executes an installed binary and can modify files.

Medium

SKILL.md:20

Ruby/shell backtick execution

2. **Security (Bandit):** `bandit -r "path" -ll`

The line instructs the agent to run Bandit recursively over a path. This is normal security scanning, but it is still external command execution on repository contents.

Medium

SKILL.md:21

Ruby/shell backtick execution

3. **Types (MyPy):** `mypy "path"`

The line instructs the agent to run mypy on a path. This is legitimate type checking, but it executes an installed external tool in the project context.

Medium

SKILL.md:25

Ruby/shell backtick execution

2. **Run Audit:** `npm run lint && npx tsc --noEmit`

The quality loop instructs npm run lint followed by npx tsc. The npm script component can execute arbitrary commands from package.json in an untrusted project.

Medium

SKILL.md:43

Ruby/shell backtick execution

| `scripts/lint_runner.py` | Unified lint check | `python scripts/lint_runner.py <project_path>` |

The line documents running the bundled lint runner with a project path. That runner executes external lint commands, including project-defined npm scripts.

Risk Factors

⚙️ External commands (13)

scripts/lint_runner.py:80 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:25 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:43 SKILL.md:44

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-lint-and-validate/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-lint-and-validate/security.svg)](https://skillstore.io/skills/sickn33-lint-and-validate?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-lint-and-validate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-lint-and-validate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-lint-and-validate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). lint-and-validate security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-lint-and-validate/audits/5

BibTeX citation

@techreport{sickn33-sickn33-lint-and-validate-2026,
  author = {sickn33},
  title = {lint-and-validate security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-lint-and-validate/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lint-and-validate security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-lint-and-validate/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-lint-and-validate:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Pre-commit Validation

Run lint and type checks before reporting a code change as complete.

Agent Quality Gate

Give Claude, Codex, or Claude Code a consistent checklist after edits.

Repository Health Review

Check whether a project has common validation tools configured and usable.

Try These Prompts

Run Basic Validation

Validate the current project after my changes. Run the appropriate lint and type checks, then summarize any failures.

Fix Lint Failures

Run the project lint workflow. Fix clear style or syntax issues, then rerun validation until the lint check passes or needs my decision.

Check Types and Security

Run lint, type checks, and configured security audit commands for this repository. Report each result and the remaining risk.

Audit Validation Coverage

Inspect the repository validation setup. Identify missing lint, type, or audit configuration, then propose the smallest practical improvements.

Best Practices

Run validation from the repository root so tools find their configuration files.
Review commands before running them in repositories from unknown sources.
Rerun failed checks after fixes and report the final result clearly.

Avoid

Do not run project-defined scripts from untrusted repositories without user approval.
Do not treat passing lint as proof that the code is correct or secure.
Do not ignore missing tool configuration when a project should enforce standards.