Is aria-skill-test safe to install?

SaferSkills independently audited aria-skill-test (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

aria-skill-test/SKILL.md · 1 file

aria-skill-test/SKILL.md1.9 KB · Markdown

name: aria-skill-test

description: Regression harness for the aria-skills repo. Runs every shipped skill in dry-run mode + asserts clean output (no traceback, no credential leaks, valid SKILL.md frontmatter, README.md present). Text report by default; --junit-xml flag for CI integration. Use when the user says "test the skills", "regression check", "before push", "run the test harness", or any time before opening a PR or pushing to main.

aria-skill-test

Regression harness. Pythonic + zero-dependency. Tests structural correctness across every skill in the repo without making any real API calls.

When to use

Before pushing changes to the public repo
In CI on every PR (use --junit-xml flag)
After running aria-skill-template to confirm the generated stub passes
After editing any skill script — quick sanity check

What gets checked

Per skill directory:

SKILL.md frontmatter parses (YAML between --- markers)
name field in frontmatter matches directory name
description field is 40-600 chars
README.md exists
Executable script found (snake_case or kebab-case .py / .sh)
Dry-run exits 0 (clean) or 2 (needs creds with clear FATAL message)
No Python traceback in stderr
No credential leak patterns in output (Anthropic / Stripe / Resend / Twilio / Cloudflare / EL / AWS / GitHub PAT)

CLI

python3 aria_skill_test.py                              # all skills
python3 aria_skill_test.py --skill <name>               # one skill
python3 aria_skill_test.py --skip <name> --skip <name>  # exclude
python3 aria_skill_test.py --junit-xml results.xml      # CI mode
python3 aria_skill_test.py --repo-root /path/to/repo    # alternate

License

Apache 2.0

aria-skill-test— agent skill

Is aria-skill-test safe to install?

aria-skill-test

When to use

What gets checked

CLI

See also

License

Audit the pieces. Scan the whole. Decide.