skill preflight

skill-preflight runs the reviewer's checks on your machine so you pass review the first time instead of losing a 24-48h round-trip to a rejection. It scans your SKILL.md package against the 8-point security rubric marketplaces reject on — hardcoded secrets, outbound data leaks, dangerous commands, obfuscated payloads, credential access, privilege escalation, injected-instruction phrasing, and undisclosed network calls — and adds the listing-quality checks that trigger soft rejections (missing frontmatter, weak description, no "use when..." trigger). You get a pass/fail report with the exact file:line and a fix for every finding. FAIL = a hard reject reason; WARN = a likely flag or quality gap; PASS = clean. Fully offline and static: it never executes your skill's code, never makes a network request, and never reads anything outside the path you give it. Works with any SKILL.md-compatible agent (Claude Code, Codex CLI, Cursor, Copilot, Gemini CLI). Requires Python 3.8+. Run: python3 scripts/preflight.py