Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    Pre-Submit Linter: Skill Package Validator

    2

    Lint a skill folder or ZIP before upload: AST-based import and call checks, credential patterns, ZIP safety and SKILL.md frontmatter, one line per finding.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Pre-Submit Linter: Skill Package Validator

    Pre-Submit Linter: Skill Package Validator

    Example session with this skill installed

    Before I upload, lint my skill in ./example-skill. Also check my builds/ folder, and tell me what blocks submission.

    • Read your context and instructions
    • Compiled the pre-submit linter

    The skill runs the linter. This is its own output, with the test key shortened to sk-...:

    $ python scripts/presubmit.py --dir example-skill/
block | example-skill/scripts/run.py | 2 | pattern resembling a secret (heuristic): "api_key = 'sk-..."
block | example-skill/scripts/run.py | 1 | process-launch module import detected (AST)
RESULT block=2 warn=0 info=0

$ python scripts/presubmit.py --dir builds/
block | . | - | multiple subdirectories with SKILL.md: alpha, beta
RESULT block=1 warn=0 info=0

$ python scripts/presubmit.py --zip skill-presubmit-linter.zip
RESULT block=0 warn=0 info=0

    example-skill: 2 blocks.

    • scripts/run.py line 1 imports a process-launch module. Remove it, or do the work without starting a subprocess.
    • scripts/run.py line 2 has a string that looks like a hard-coded API key. Move it out of the package and read it at runtime instead.

    builds/: 1 block. The folder holds two skills, alpha and beta. Point --dir at one skill folder at a time.

    The linter's own package: block=0, so it passes this checklist.

    Run the linter again after the fixes. block=0 means the package passed this checklist, not that it is secure.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Use when you are about to upload a skill package and want an automated check before submission, or a package came back from QA with compliance failures and you need a list of what to fix.

    What it checks:

    • Imports and call sites in .py and .pyw files, read through Python's AST, so comments and string literals do not trigger them
    • Credential-like patterns such as hard-coded API keys (a heuristic)
    • ZIP safety: path traversal and symlinks that escape the package
    • Forbidden files such as caches and version-control folders
    • SKILL.md frontmatter, including a name that does not match the folder

    --dir takes the skill folder itself, or a parent folder with exactly one skill subfolder. Output is one line per finding (severity | path | line | message) plus RESULT block=N warn=N info=N. The exit code is 1 on any block.

    Do not use when you want to run the skill's own unit tests, or when you need a full security audit beyond this checklist.

    Only Python files (.py and .pyw) are scanned for imports and calls; shell, JavaScript and other scripts are not. The credential check is a heuristic and will not catch split or obfuscated secrets. block=0 means the package passed this checklist, not that it is secure. Not affiliated with any marketplace platform.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 8 days ago

    Requires

    Python 3.9 or later (standard library only)
    Python

    Permissions

    Terminal / Shell
    Read Files
    Listed8 days ago
    Updated4 days ago

    What's inside

    Frequently Asked Questions

    No. Import and call checks read the AST of `.py` and `.pyw` files only, so comments and string literals are ignored.

    No. It means the package passed this checklist. The credential check is a heuristic and will not catch split or obfuscated secrets.

    Yes. Pass `--profile <path>` with your own JSON. `assets/profiles/generic.json` is the default.