Skip to main content

skill-lint

Linter for AI instruction files — skills, prompts, and agent specs.

skill-lint scans AI instruction files (CLAUDE.md, AGENTS.md, GEMINI.md, SKILL.md, .cursorrules, .github/copilot-instructions.md, .github/instructions/, and agent/skill directories) for issues that cause token waste, hallucination risk, and unpredictable agent behavior. 50 rules across 12 categories with fix suggestions.

Quick Start

pip install ai-skill-lint   # or: pipx install ai-skill-lint

skill-lint .                                    # Scan current project
skill-lint /path/to/project                     # Scan a local directory
skill-lint https://github.com/org/repo          # Scan a GitHub repo
skill-lint . --format sarif --fail-on warning   # CI gate (severity)
skill-lint . --fail-under 80                    # CI gate (score)
skill-lint . -v                                 # Verbose
skill-lint . --exclude "vendor/*.md"            # Exclude patterns
skill-lint rule TCOST001                        # Explain a rule
skill-lint rule                                 # List all 50 rules

What It Checks

Category Rules Examples
Token cost 11 Oversized files, duplicates, filler phrases, hedging
Description 7 Too long, spec limit, overlap detection, missing trigger conditions
Hallucination risk 5 Vague instructions, no output format, prompt injection, destructive ops
Framing 4 Prohibition overuse, emphasis overuse, bare directives
Output quality 3 No examples, no verification, no role statement
Best practice 6 No model, no error handling, model-complexity mismatch, options without default
Structure 7 Broken refs, encoding, file too large
Cross-file 1 Contradictions between CLAUDE.md and skill files
Agent safety 3 Math traps, regex generation, structured data editing
Supply chain 1 Dangerous hook commands (curl|sh, eval, base64, dotfile execution)
Security 1 Hardcoded API keys and credentials (16 provider patterns)
Content 1 Unclosed code fences hiding content from analysis

Each file scored 0-100 with actionable fix suggestions.

CI Integration

GitHub Actions (recommended)

# Basic — one line
- uses: rajusem/skill-lint@v0

# With SARIF upload to GitHub Code Scanning
- uses: rajusem/skill-lint@v0
  with:
    format: sarif
    fail-on: warning
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: results.sarif

# Score gate — fail if average score below 80
- uses: rajusem/skill-lint@v0
  with:
    fail-under: '80'

Manual (any CI)

pip install ai-skill-lint
skill-lint . --fail-on warning

pre-commit

repos:
  - repo: https://github.com/rajusem/skill-lint
    rev: v0.4.0
    hooks:
      - id: skill-lint

Baseline (incremental adoption)

skill-lint . --save-baseline   # Save current findings
skill-lint . --diff            # Show only NEW issues

Common include/exclude patterns

Layout Pattern
Prompt directory --include "prompts/*.md"
Nested agent docs --include "docs/agents/**/*.md"
Custom instruction dir --include "instructions/**/*.md"
Exclude vendor --exclude "vendor/*.md"
Exclude generated --exclude "generated/**/*.md"

Inline Suppression

<!-- skill-lint: disable TCOST005 -->
<!-- skill-lint: disable TCOST003, HRISK001 -->

Configuration

For VS Code/Cursor autocomplete, add to the top of your .skill-lint.yaml:

# yaml-language-server: $schema=https://raw.githubusercontent.com/rajusem/skill-lint/main/skill-lint-schema.json

Option 1: .skill-lint.yaml

disable:
  - HRISK002
  - OQUAL001
fail_on: warning
fail_under: 80        # exit 1 if avg score < 80
thresholds:
  max_tokens: 8000   # default: 5000
  max_lines: 800     # default: 500
include:
  - "prompts/*.md"
  - "docs/agents/**/*.md"
exclude:
  - "vendor/*.md"

Option 2: pyproject.toml

[tool.skill-lint]
disable = ["HRISK002", "OQUAL001"]
fail_on = "warning"
fail_under = 80
thresholds = {max_tokens = 8000, max_lines = 800}
include = ["prompts/*.md", "docs/agents/**/*.md"]
exclude = ["vendor/*.md"]

Precedence: CLI flags > .skill-lint.yaml > pyproject.toml

Custom Rules

Write your own rules by extending the Rule base class:

from skill_lint.scanner import Rule, Issue, register_rule

class MyRule(Rule):
    id = "CUSTOM_001"
    description = "Check for company-specific patterns"

    def check(self, ctx):
        issues = []
        if "legacy API" in ctx.content:
            issues.append(Issue(
                category="best-practice",
                severity="suggestion",
                message="References legacy API",
                fix="Use the new v2 API instead",
                rule_id=self.id,
            ))
        return issues

register_rule(MyRule())

Custom rule IDs must use the CUSTOM_ prefix. The ctx object provides: content, lines, regions, filepath, root, tokens, and content_text (code-fence-filtered).

Philosophy

  1. Help, don't restrict — every finding is a suggestion, not a gate
  2. Show, don't enforce — display impact, let users decide
  3. Honest numbers — no inflated claims; validated across 88+ repos

Agent Integration

Want Claude to fix your instruction files automatically? Copy our official skill:

cp -r examples/fix-instruction-files/ .claude/skills/fix-instruction-files/

The skill runs skill-lint, interprets findings, and proposes fixes with before/after diffs. See examples/fix-instruction-files/SKILL.md.

Rule Reference

See docs/rules.md for detailed documentation on all 44 rules.

License

Apache-2.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ai_skill_lint-0.4.0.tar.gz (63.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ai_skill_lint-0.4.0-py3-none-any.whl (38.3 kB view details)

Uploaded Python 3

File details

Details for the file ai_skill_lint-0.4.0.tar.gz.

File metadata

  • Download URL: ai_skill_lint-0.4.0.tar.gz
  • Upload date:
  • Size: 63.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ai_skill_lint-0.4.0.tar.gz
Algorithm Hash digest
SHA256 2df1cb9c5bea347691093411c9749a72b2ec9b65c8f791084895416bd412fde7
MD5 83b3f515ca46a11479066438599ddb2a
BLAKE2b-256 dcadd544a37806e5ab099ce1e3bfa5cdcd09eef354103f6ece71d0587a81939d

See more details on using hashes here.

Provenance

The following attestation bundles were made for ai_skill_lint-0.4.0.tar.gz:

Publisher: publish.yml on rajusem/skill-lint

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ai_skill_lint-0.4.0-py3-none-any.whl.

File metadata

  • Download URL: ai_skill_lint-0.4.0-py3-none-any.whl
  • Upload date:
  • Size: 38.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ai_skill_lint-0.4.0-py3-none-any.whl
Algorithm Hash digest
SHA256 3fac73aa159db90e1dbd55e45ffb8ce139c2674ffc121ae2bc3db7cca9ea152f
MD5 e8a088fa6bdf6f5a5d50572fead4dcd4
BLAKE2b-256 180196acb10a82fe69751868a1c616f7edbedf7446b1a57bf2fd18ea92d2d63f

See more details on using hashes here.

Provenance

The following attestation bundles were made for ai_skill_lint-0.4.0-py3-none-any.whl:

Publisher: publish.yml on rajusem/skill-lint

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.6.0

2 files

0.5.0

2 files

This release

0.4.0 This release

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

0.1.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page