Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Skill Preflight: Catch Packaging Bugs Before You Submit

    1

    You build a skill in one agent on one operating system, it works, and you submit it.

    $7.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Skill Preflight: Catch Packaging Bugs Before You Submit

    Skill Preflight: Catch Packaging Bugs Before You Submit

    Example session with this skill installed

    I'm about to submit this skill. I only tested it in one agent on Windows. Check the package and my listing draft and tell me what will break for other buyers.

    • Read your context and instructions
    • Compiled the preflight

    Skill preflight: broken-skill. 4 failures, 10 warnings, 36 passed, 4 not run. Exit code 2. Nothing from the package was executed.

    Blocking, in fix order

    CheckWhereWhat breaks for a buyer
    REF-02SKILL.md lines 17 and 22scripts/Run.py is scripts/run.py on disk. Works on Windows and default macOS volumes, fails on Linux.
    DISC-02scripts/helper.py line 2Uses the network (urllib.request) and nothing declares it.
    DISC-09scripts/helper.py line 4Imports requests, which is declared nowhere. Import error on a clean machine.
    PORT-01run.shShell helper with no Python equivalent. Doesn't run on a stock Windows machine.

    Warnings (10 checks): no "Use when" cue in the description, orphan notes.md, an absolute /home/dev/... path, a run command that names only python3, no test file, WebFetch and TodoWrite named as tools, and four listing checks.

    Listing: 2 of 4 bullets have no evidence in the package: "Exports the report to PDF" and "Works in every agent, always". Guarantee wording on lines 3 and 8: 'guaranteed', 'pass review', 'always'. The draft sits inside the skill folder and would ship with it.

    Disclosure table: scripts/run.py has no network code of its own, but it imports scripts/helper.py, which contacts the network and needs requests. run.sh is not analysed.

    Next: you asked for a check, so I changed nothing. You tested on Windows, so REF-02 is the one you could not have seen. If you want fixes, I'd correct the path case, port run.sh to Python, paste the disclosure wording into SKILL.md and the listing, then rerun. This is a creator-side quality check. It is not a malware scan and it doesn't predict any marketplace's review.

    SKILL.md

    Connects securely to your tools. The creator never sees your data.

    About this skill

    You build a skill in one agent on one operating system, it works, and you submit it. Then a buyer on Linux gets a missing file because SKILL.md says scripts/Run.py and the file is scripts/run.py. Or the helper needs bash, or a script makes a network call your listing never mentions. None of that shows up on your own machine, and each one costs a review cycle or a bad rating.

    What your agent does

    • Runs one static check on the skill folder: 54 checks in 9 groups, each with a status and a fix hint.
    • Finds reference bugs: files named in SKILL.md that were never bundled, paths that differ in letter case, and bundled files nothing points to.
    • Reads each Python script with ast and writes a disclosure table: network, subprocess, file writes, environment reads, dynamic code, deletes and third-party imports. Behaviour reached through a bundled module is shown as well. Well-known third-party network clients such as requests and httpx are matched by import name (heuristic), and any other third-party package shows as not analysed.
    • Flags portability signals: shell-only helpers, absolute paths, CRLF under a shebang, names Windows can't create, run commands that name only python3.
    • Compares your listing with the package: every bullet gets its best evidence or "no evidence found", and guarantee wording is flagged.
    • Reports context weight: SKILL.md lines, an estimated token range and the largest sections to move into references.

    Built-in guard rails

    • Nothing in your package is executed unless you agree to --run-tests or --smoke, and the report states what was run.
    • The agent doesn't edit your package unless you asked for fixes.
    • It won't tell you the skill will pass a marketplace review, and it won't call the result a security scan.
    • The script writes only to the report folder and has no network code.

    What's inside

    • SKILL.md: nine-step workflow, commands, output guide, hard rules, limits.
    • scripts/skill_check.py: one standard-library script that writes four report files per run.
    • assets/rules.json: default limits and name lists you can override.
    • 5 reference files: check catalog, portability, disclosure table, description writing, promise coverage.
    • 11 fixture files: one clean skill, one broken skill, two listing drafts.
    • 242 unit tests in 8 test files.

    Static analysis covers Python only. Shell and other scripts are listed as not analysed, and network use inside third-party packages is only a name-based guess.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Prompt & Skill Engineering.

    Python only; shell and other scripts are listed as not analysed. Third-party network use is found by package name, so unlisted packages show as not analysed. It can't see run-time imports. Listing checks are keyword matches. It isn't a malware scan or a review predictor.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed today

    Windows only

    Software
    Python 3 (3 point 8 or later)The skill folder to check
    Claude Code
    orCodex
    orCursor
    Git
    Optional
    Your listing draft as MarkdownConsent to run the package testsYour own rules file with limits

    Permissions

    Terminal / Shell
    Read Files
    Write Files

    Allowed Hosts

    x
    Listedtoday

    What's inside

    Frequently Asked Questions

    No. Review criteria aren't fully published and the tool doesn't model them. It finds packaging, portability and disclosure problems you can fix before you submit.

    No. The disclosure table lists imports and calls visible in Python source, and a "no" there means nothing was found, which is weaker than proof. Calls through third-party libraries are matched by package name from a short list, and other packages show as not analysed. Use a separate security scan if you need one.

    Not by default. If you agree, `--run-tests` runs the package's own unittest discovery and `--smoke` calls scripts with `--help`, each in a child process with a timeout. A script that ignores `--help` runs its normal work, and the report states what was executed.

    No. It reads portability signals such as agent-specific tool names, shell-only helpers and path case. It doesn't load the skill in any agent.

    New in Prompt & Skill Engineering