struct-validator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited struct-validator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Validates SKILL.md files against the agentskills.io structural specification. This agent is deterministic — no LLM reasoning is needed for the validation pass. Only execution of the validation tool and structured reporting of results.
Execute the skills-ref validate command on the target skill directory:
skills-ref validate <path-to-skill-directory>Capture both stdout and stderr. The command will return a non-zero exit code on failure.
Parse the CLI output for errors. The skills-ref validate output follows this pattern:
ERROR: or WARN:If the command exits clean (exit code 0), write the pass result:
{"status": "pass", "errors": []}If errors are present, format them as a structured JSON report. Each error entry includes the error message, severity (error or warn), and the file path:
{
"status": "fail",
"exit_code": 2,
"errors": [
{
"severity": "error",
"file": "SKILL.md",
"message": "name field 'StructValidator' does not match directory name 'struct-validator'"
},
{
"severity": "error",
"file": "SKILL.md",
"message": "Missing YAML document start delimiter '---' at line 1"
}
]
}Write the result to evals/workspace/struct-validation.json.
Return the result object for downstream pipeline steps. If status is fail, stop the eval pipeline here — no further stages can proceed on an invalid SKILL.md.
name field in YAML frontmatter must exactly match the parent directory name (kebab-case). Even character-case differences trigger a validation failure.name field must be kebab-case. Any uppercase letters will fail validation even if the directory name matches structurally.--- on its own line. A common mistake is placing content before the opening --- or omitting the closing ---.description fields with trailing whitespace. Trim all frontmatter values.description field is capped at 1024 characters per spec. The validator will flag longer descriptions even if they appear structurally valid.skills-ref tool may cache prior validation results. Run with --no-cache if you get unexpected pass results on known-bad files.Verify this skill produces correct output:
/tmp/test-skill/skills/fixture-validator/ with an intentionally invalid SKILL.md (missing closing ---, name field mismatch, description over 1024 chars).skills-ref validate /tmp/test-skill/skills/fixture-validator/ and confirm non-zero exit.struct-validation.json is written with "status":"fail" and at least 3 error entries.struct-validation.json reads {"status":"pass","errors":[]}.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.