skill-lint

What is skill-lint?

skill-lint is a security linter for Claude Code and agent skills that you run before installing a skill from the internet. It statically inspects a skill's SKILL.md, bundled scripts, and metadata for the patterns used by real-world malicious skills seen in 2026 — prompt injection, obfuscated payloads, credential exfiltration via environment variables, supply-chain fetches, and agent-state tampering — using 10 rules mapped to the OWASP Agentic Skills Top 10 (AST10) and the Snyk ToxicSkills attack taxonomy. Run via 'npx skill-lint <url>', it returns exit codes 0 (SAFE), 1 (WARN), 2 (TOXIC), or 3 (error), making it pipeable into CI, pre-install hooks, or installers.

Key features

• 10 rules (R01–R10) covering prompt injection, obfuscation (base64/zero-width unicode/homoglyphs), curl|bash shell danger, credential exfiltration (secret env vars in URLs, hardcoded keys, ~/.ssh and ~/.claude reads), external fetch-and-execute, suspicious binaries, persistence tampering (settings.json, CLAUDE.md, hooks, crontab), destructive ops, metadata abuse, and over-privilege
• Rules mapped to the OWASP Agentic Skills Top 10 (AST10) and the Snyk ToxicSkills audit taxonomy
• Severity scoring: CRITICAL=10, HIGH=5, MEDIUM=2, LOW=1; verdict is the sum — score <5 SAFE, 5–9 WARN, ≥10 TOXIC; a single CRITICAL finding alone reaches TOXIC
• Lints a GitHub repo URL, a subdirectory of a skills mono-repo, or a local directory
• Exit codes 0/1/2/3 (SAFE/WARN/TOXIC/error) for CI, pre-install hooks, and custom installers; --json output with structured findings
• --install flag copies the skill into ~/.claude/skills/ only if it passes; --force-install can override WARN but never TOXIC
• Purpose-built for prose payloads in SKILL.md that traditional code scanners miss (e.g. instructions to append $ANTHROPIC_API_KEY to a URL)
• Extensible: add a rule by dropping a file into src/rules/ and registering it, with fixtures and tests; MIT licensed

Who it's for

• Developers about to git clone / npx / manually install a community Claude Code or agent skill
• Teams adding a security gate to CI or a pre-install hook for skill marketplaces and internal skill registries
• Builders of skill installers who want a machine-readable verdict (--json, exit codes) before copying skills into ~/.claude/skills/
• Security-conscious users responding to documented supply-chain campaigns like ClawHavoc (1,184 malicious skills) and the Snyk ToxicSkills findings (36.82% of 3,984 audited skills contained prompt-injection patterns)

When not to use it

skill-lint is not a sandbox and not semantic analysis — it reads but never executes, so payloads hidden behind runtime indirection or novel prompt-injection phrasings can slip through; treat SAFE as 'no obvious smoke,' not 'proven clean.' It also doesn't replace trust signals: a skill from a well-known maintainer with history is still safer than an anonymous one with a clean lint pass.

FAQ