lint_skill
Проверить SKILL.md: структура, триггеры, секреты, инъекции, битые ссылки, автономия. Возвращает вердикт, балл и sha256.
Parameters
pathrequired
skilllint — vet an agent skill before you install it
lat.rtaPublished by rta.latOfficial publisherv0.1.0Updated Oct 26, 2026
Vet an agent skill before you install it: structure, triggers, secrets.
The publisher's own server: Try
Overview
AI-generated overview
Lints an agent skill's SKILL.md file for structure, triggers, secrets and injection markers, returning a verdict, score and sha256 hash.
- What you can do
- Lint a skill file: check frontmatter, name and description, trigger phrases, dead instructions, secret-shaped literals, prompt-injection markers, broken file references, size and world-writable scripts, returning a verdict, score, sha256 and findings.
- Compare several candidate skills from different registries and rank them by verdict and evidence.
- List the linter's rules with their identifiers and severity levels.
- When to use it
- Useful when you are choosing between third-party agent skills and want a quick, repeatable check of their manifest before installing, or when you need a hash-bound verdict to record or compare later.
- Requirements
- A remote streamable HTTP endpoint; the README also describes running it locally with Python or via npx mcp-remote. No authentication, environment variables or headers are declared.
Before you install
The README says checks run locally and only a verdict, score and hash leave the machine, but the hosted endpoint is remote, so confirm where the inspected file content is processed before sending private skills. Verdicts are heuristic rule checks, not a guarantee of safety.
Installation
In SourceWeft
- Open skilllint — vet an agent skill before you install it in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/lat.rta%2Fskilllint/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config.
{
"mcpServers": {
"skilllint-vet-an-agent-skill-before-you": {
"type": "http",
"url": "https://rta.lat/skilllint/mcp"
}
}
}README
skilllint
Private lint of agent skills (SKILL.md). Nothing leaves the machine.
Existing scanners (for example NVIDIA SkillSpector - 71 patterns, AST, YARA, CVE lookup) answer "is this artifact dangerous", and they ship the inspected content to their provider. We do something narrower and complementary:
- privacy - the check runs locally; only a verdict, a score and a hash go out;
- reproducibility - the verdict is bound to a sha256 of the file, so it can be signed and verified later;
- comparison - rank several candidates from different registries instead of scanning one artifact at a time.
Rules
Verdict: PASS (>=80, no critical) | WARN | FAIL (any critical).
Use it
Tools: lint_skill(path) | compare_skills(paths) | lint_rules()
Signed verdicts
lint_skill returns {verdict, score, sha256, findings[]}. That hash is what attest signs and drift enforces as an allowlist - see Verified Tool Registry.
Locales: en, hi. India (Bharata) is supported from day one; legal claims require official sources, otherwise report pending.
License: MIT
Source: README.md at commit ebe65c3
Tools
3compare_skills
Сравнить нескольких кандидатов из разных реестров и ранжировать по вердикту и доказательной базе.
Parameters
pathsrequiredlint_rules
Список правил линтера с идентификаторами и severity.
Takes no parameters.
Version history
1- v0.1.0LatestOct 21, 2026
Score
100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listedRequired15 pts
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
Other Install integrations
Try
md.installOfficial publisher
Lets an assistant create guides as MCP servers that instruct coding agents how to use a given library or API.
Streamable HTTPWeb executable
Developer Tools13 toolsOct 24, 2026
MCP Registry Search: Find, Discover & Install MCP Servers & Tools | Directory, Catalog, Marketplace
Published by GitHub account lbesecker195
A remote MCP registry server that lets an assistant search a catalog of 31k+ MCP servers, inspect one server's manifest and install snippets, and submit new MCP
Streamable HTTPWeb executable
Knowledge & Memory3 toolsOct 24, 2026
MCP Registry Search: Find, Discover & Install MCP Servers & Tools | Directory, Catalog, Marketplace
Published by GitHub account lbesecker195
Remote MCP registry that lets an assistant search a catalog of 31k+ MCP servers, inspect one server's manifest and install snippets, and submit new listings.
Streamable HTTPWeb executable
Knowledge & MemoryNot indexed yetOct 2, 2026
Office Suite All Servers One Install
com.bestremotetools
A local stdio proxy that runs many bundled office and accounting MCP servers as child processes and exposes all their tools behind one config entry.
STDIODesktop only
Productivity & WorkflowNot validated yetOct 26, 2026