SkillCheck Free
An offline, read-only validation skill that checks your AI assistant SKILL.md files against the agentskills specification, catching issues before your users do.
The skill declares read-only tools (Read Glob Grep), no network access, no env vars, no side effects; workflow includes execution limits and idempotency; data flow is explicit. Deducted: unverified publisher, attribution relies on self-declared author metadata only, no rollback/confirmation mechanisms documented (largely unnecessary for read-only checks, but false-positive handling for security checks rests on heuristic claims). No red-line risks found.
SKILL.md is internally consistent: four-step workflow, execution caps, error table, failure feedback (report when a file cannot be read), and disclosed false-positive rates (4.6, ~5%). Deducted: static review only, no committed test suite covering key check paths, correctness of regex rules (Unicode ranges, BiDi exemptions) unverifiable, and heuristic checks depend on model execution which introduces nondeterminism.
Triggers are explicit (check skill, skillcheck, validate SKILL.md), negative triggers clearly exclude Pro/LinkedIn scopes, input/output contract defined, fully offline so mainland-China reachability is not affected. Deducted: English only, no Chinese-language support; boundaries around Claude Code extension fields are documented but utility is narrower on other agents.
MIT license, version 3.32.0, author attribution, maintenance path (GitHub issues), layered docs (SKILL.md + references files), and Free/Pro scope disclosure are all present. Deducted: no CHANGELOG, the CLI referenced in references/cli.md links to a separate repo whose relationship is unexplained, no version history backing the 3.32.0 claim, minor rule overlap between marketplace-checks.md and the main file.
The core task (validating SKILL.md against the agentskills spec) has concrete rules, worked examples, and a defined output format; marginal value over manual review is clear. Deducted: static review cannot verify representative output correctness/completeness, the 0-100 summary score has no defined calculation rule, and output still requires human review.
Rules ship with a worked-examples file, README sample output, and registry inclusion claims. Deducted: no CI workflow tests the checks themselves (the present CI is only a Claude code-review bot, not execution evidence), no independent third-party reproduction material, and the registry listings are not corroborated within the repository.
- Static review executed nothing; actual check behavior and false-positive rates must be verified by the user. Author-disclosed ~5% false-positive rates exist for heuristic checks (4.6/4.9).
- references/cli.md points to a separate repo (skillcheck-cli) whose relationship and maintenance status are unexplained; do not conflate it with this skill.
- No CHANGELOG; version 3.32.0 has no traceable history; publisher identity is unverified by any registry.
- The skill is English-only; applicability of semantic checks to Chinese-language skills is undeclared.
What does this skill do, and when should you use it?
SkillCheck Free is a validator distributed as a skill, checking AI assistant skill files against the agentskills spec and Anthropic guidelines. It is itself a SKILL.md rules file: when triggered, your AI assistant reads the rules and applies them to the target skill — fully offline, read-only, no API keys. The free tier covers structural, naming, semantic-consistency, knowledge-density, plugin-manifest, MCP tool-list, deterministic OWASP Agentic Top 10 checks, and invisible-Unicode smuggling detection. It outputs a report with severity, line numbers and fixes, plus a separate strengths list. Deeper features like anti-slop detection, security scanning and Eval Kit are reserved for the paid Pro tier.
Reads target SKILL.md files and any references/*.md in the same folder; runs four stages: locate files with Glob, read content, apply validation rules, produce a report. Validation covers: required and optional YAML frontmatter fields, XML angle-bracket prompt-injection risk, name format and vague names, WHAT+WHEN trigger structure in descriptions, contradictions and ambiguous wording, hollow content, design-pattern classification (Reviewer/Generator/Inversion/Pipeline/Tool Wrapper), plugin manifest schema, tool-count signals from MCP tools/list responses, 8 deterministic OWASP checks (unpinned dependency installs, eval/exec, --no-verify flags, etc.), and Grep-based detection of Unicode tag characters, bidirectional controls and zero-width characters. Each finding includes a check ID, severity (Critical/Warning/Suggestion), line number and fix; strengths are reported separately.
- A Claude Code user who wants to confirm their hand-written skill's frontmatter, naming and description meet the agentskills spec before publishing
- A skill author worried about hidden Unicode injection or prompt-injection vectors in SKILL.md, needing a read-only scan
- A maintainer of a skill collection (personal/team/namespaced directories) who wants to validate every skill in a directory
- A Claude Desktop/Web Projects user who pastes the rules into custom instructions and validates skills in conversation
- A Cursor user who drops the rule file into .cursor/rules and validates skills inside their project
- An MCP server or Claude Code plugin author who wants quick tool-count, manifest-schema or supply-chain signals
What are this skill's strengths and limitations?
- Fully offline and read-only: no environment variables, API keys, or network calls; idempotent and safe to re-run
- Broad coverage even in the free tier: structure, naming, semantics, knowledge density, plugin manifests, MCP signals, and 8 deterministic OWASP checks
- Invisible-Unicode detection decodes and quotes hidden payloads, with careful exemptions for legitimate emoji and RTL text
- Mature cross-platform distribution: dedicated install paths for Claude Code, Claude Desktop/Web, and Cursor, plus listings in the skills.sh registry and the antigravity-awesome-skills collection
- Every finding carries a check ID, severity, line number, and concrete fix — highly actionable reports
- Many deep features (anti-slop detection, security scanning, token budgets, Eval Kit, CI/CD binary) are Pro-only and unavailable in the free tier
- As an instruction-driven skill, validation quality depends on the host AI assistant correctly executing the rules, not on a deterministic standalone test suite
- The OWASP category only scores skills with an agent surface; plain text-formatting skills report not-applicable
- Unknown artifact types in produces/consumes only warn and rely on manual registration in rules/artifact-passing.md — the ecosystem is still evolving
- The README offers no automated test evidence for the claimed platforms (Cursor, Codex CLI, etc.); compatibility rests largely on documentation
How do you install this skill?
Claude Code: run npx skills add olgasafonova/SkillCheck-Free, or copy manually with cp -r skills/skill-check ~/.claude/skills/, or clone the repo and copy the folder. Claude Desktop/Web: create or open a Project, go to Project settings → Custom instructions, and paste the contents of skills/skill-check/SKILL.md (everything after the frontmatter). Cursor: copy cursor-rules/skill-check.mdc into your project's .cursor/rules directory (mkdir -p .cursor/rules, then cp). No other installation methods are documented in the source.
How do you use this skill?
Once installed, trigger it in Claude Code, Claude Desktop/Web, or Cursor by saying things like "skillcheck my skill", "check skill at path/to/SKILL.md", or "validate my skills". You can also point it at a skill path to validate a single skill or a whole directory of skills, producing one report per skill. For Claude Desktop/Web Projects, the same trigger phrases work since the rules live in custom instructions.
How does this skill compare with similar options?
SkillCheck Pro (getskillcheck.com) is the paid tier of the same product, adding anti-slop detection, security scanning, token analysis, Eval Kit, and a CI/CD binary; the free tier suits basic spec validation for individuals and small teams.