Skip to content

SKILL.md Lint

by moltlinestudio.com · remote · no sign-in to list tools · v1.2.0 · published by com.moltlinestudio

Lint a SKILL.md for frontmatter, structure, secrets and size. All 6 tools free.

Changes · 2

6 tools: 2 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http skillmd-lint https://mcp.moltlinestudio.com/skillmd-lint

Findings

Matches of fixed checks, with the text they matched.

1 info
  • The description mentions "credential".

    Matched text

    description: "...dure steps, rules, degradation), secret/credential leakage, injection-style phrasing, and..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 2Claude Code: ask
  • lint_skillLint one SKILL.md file the way marketplaces and agents parse it.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...dure steps, rules, degradation), secret/credential leakage, injection-style phrasing, and..."

      What this check looks for
    Description, as the server wrote it
    Lint one SKILL.md file the way marketplaces and agents parse it. FREE. Checks YAML frontmatter presence and required fields (name, description), description quality, body structure (procedure steps, rules, degradation), secret/credential leakage, injection-style phrasing, and size budget. Typical input {"content": "<full SKILL.md text>"} returns {"verdict": "pass" | "pass-with-warnings" | "fail", "errors": ["..."], "warnings": ["..."], "stats": {"body_words": N, "has_frontmatter": bool}}. Use on the full text of one SKILL.md. Not for the surrounding archive layout (packaging_check). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "content is empty — pass the full SKILL.md text including frontmatter"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Lint Skill
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • regex_testTest a regular expression against sample strings.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Test a regular expression against sample strings. FREE. Typical input {"pattern": "v(\\d+)", "samples": ["v12", "beta"]} returns {"pattern": ..., "results": [{"sample": "v12", "match": true, "matched_text": "v12", "groups": ["12"]}, {"sample": "beta", "match": false, ...}], "match_count": 1}. Use to confirm a pattern matches what you expect before shipping it. Not for validating JSON (json_validate). The pattern is compiled and run in a short-lived, CPU-capped child process, so a pattern that backtracks catastrophically is stopped instead of stalling the server. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "a sample is too long (max 10000 characters); shorten it and retry"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Regex Test
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 4Claude Code: allow
  • cron_explainExplain a 5-field cron expression in plain English and flag mistakes.No findings

    Why it is in this group

    • The name "cron_explain" says "explain": a word for reading.
    Description, as the server wrote it
    Explain a 5-field cron expression in plain English and flag mistakes. FREE. Typical input {"expression": "0 9 * * 1-5"} returns {"expression": "0 9 * * 1-5", "meaning": "at minute 0; at hour 9; every day of month; every month; day of week 1-5", "issues": ["none"]}; out-of-range fields are listed in "issues". Use to read a schedule back in plain English before trusting it. Assumes 5-field cron; not for 6-field or seconds-precision variants. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "expected 5 fields, got <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Cron Explain
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • diff_textsProduce a unified diff between two texts.No findings

    Why it is in this group

    • The name "diff_texts" says "diff": a word for reading.
    Description, as the server wrote it
    Produce a unified diff between two texts. FREE. Useful for comparing two SKILL.md versions. Typical input {"a": "<old text>", "b": "<new text>"} returns {"changed_lines": N, "diff": "--- \n+++ \n@@ ... @@\n-old line\n+new line"}; identical inputs return {"changed_lines": 0, "diff": "(identical)"}. The diff is capped at 400 lines. Use to show exactly what changed between two versions of a text. Not for judging the risk of a code change - the codereview server's review_diff does that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "each text must be at most 500000 characters"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Diff Texts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • json_validateValidate JSON text and summarize its structure.No findings

    Why it is in this group

    • The name "json_validate" says "validate": a word for reading.
    Description, as the server wrote it
    Validate JSON text and summarize its structure. FREE. Typical input {"text": "{\"a\": [1, 2]}"} returns {"valid": true, "structure": {"a": ["array[2]", "int"]}}; invalid JSON returns {"valid": false, "error": "<parser message>", "line": N, "column": N} instead. Use when JSON may be malformed or its shape is unknown. Reports structure, not conformance to a schema. Not for testing a pattern (regex_test). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "text is empty — pass the JSON document as a raw string"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Json Validate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • packaging_checkValidate a zip layout plan for a skill marketplace before packaging.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate a zip layout plan for a skill marketplace before packaging. FREE. Checks SKILL.md placement rules and flags junk files. Typical input {"file_paths": ["my-skill/SKILL.md", "my-skill/examples.md"], "marketplace": "agensi"} returns {"verdict": "pass" | "fail", "issues": ["..."], "skill_files_found": ["my-skill/SKILL.md"]}. Use on a planned file layout, before zipping. Not for the content of a skill file (lint_skill). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "file_paths is empty — list every file that will be inside the zip"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

    Annotations the server declares

    • title: Packaging Check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http skillmd-lint https://mcp.moltlinestudio.com/skillmd-lint

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__skillmd-lint__packaging_check",
      "mcp__skillmd-lint__json_validate",
      "mcp__skillmd-lint__diff_texts",
      "mcp__skillmd-lint__cron_explain"
    ],
    "ask": [
      "mcp__skillmd-lint__lint_skill",
      "mcp__skillmd-lint__regex_test"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as skillmd-lint. Review it before you use it.