To transform Agentic Awesome Skills from a collection of scripts into a trusted platform, every skill must meet a specific standard of quality and safety.
The following checks describe contributor expectations. Passing a structural check does not award a general reliability badge. Semantic review must identify its exact content, scope, reviewer or process, actual checks and remaining limitations.
The SKILL.md frontmatter must be valid YAML and contain:
name: Kebab-case, matches folder name.description: Under 200 chars, clear value prop. Empty descriptions and the known skill-template placeholder fail npm run validate; describe the actual task and when to invoke it.risk: One of [none, safe, critical, offensive, unknown]. Use unknown only for legacy or unclassified skills; prefer a concrete level for new skills.source: URL to original source (or “self” if original).The skill MUST have a section explicitly stating when to trigger it.
## When to Use, ## Use this skill when, ## When to Use This Skill.Every skill must declare its risk level:
At least one code block or interaction example that a user (or agent) can immediately use.
A list of known edge cases or things the skill cannot do.
If a skill includes command examples, remote fetch steps, secrets, or mutation guidance, the PR must document the risk and pass npm run security:docs in addition to normal validation.
For pull requests that add or modify SKILL.md, GitHub also runs the automated skill-review workflow. Treat that review as part of the normal PR quality gate and address any actionable findings before merge. A successful result is reused when a later push has the identical changed-skill content; if Tessl credits are unavailable, the workflow records manual-review-required for exact-head maintainer attestation instead of pretending an automated review passed.
Automated checks are necessary, but they do not replace manual reviewer judgment on logic, safety, and likely failure modes.
npm run security:docs enforces a repo-wide scan for:
curl ... | bash, wget ... | sh, irm ... | iex,<!-- security-allowlist: ... -->.Use npm run audit:skills when you need a repo-wide report that goes beyond schema validation and answers:
#365),Risk labels remain declared metadata. The audit validates their presence and shape, while ambiguous risk: unknown cases require semantic review rather than lexical inference.
Source attribution identifies origin; it does not prove current maintenance, efficacy or security. Do not infer reliability from “official”, “community”, a risk label or an unqualified “verified” badge. Keep original attribution and license notices when editing; record modifications without inventing upstream endorsement.
The compatibility map explicitly records retained duplicate IDs. Aliases keep complete local instructions and support files for offline use; they are not separate capabilities, recommendations or eligibility rules. Correct the primary editorial path and every alias together, and verify their body/bundle equality. Do not remove callable IDs or omit support files simply to improve duplicate counts.
The 2026-09-05 content review records a bounded cohort, file fingerprints, actual checks, retained aliases and remaining whole-corpus debt. A content fingerprint binds bytes, not truth or effectiveness. Review evidence becomes stale when those bytes change and cannot replace the exact-head merge gate.
The canonical validator is tools/scripts/validate_skills.py, but the recommended entrypoint is npm run validate before submitting a PR:
npm run validate
npm run audit:skills
npm run validate:references
npm test
npm run security:docs
Notes:
npm run validate is the operational contributor gate.npm run audit:skills is the maintainer-facing compliance/usability report for the full library.npm run security:docs is required for command-heavy or risky skill content.SKILL.md also get an automated skill-review GitHub Actions check.npm run validate:strict is a useful hardening pass, but the repository still contains legacy skills that do not yet satisfy strict validation.