agentsclimarketplace
Sign in

Skill verify

Skill redhat-community-ai-tools/harness-eval/skills/skill-verify

Vet a skill or setup before installing. Combines lint + security in one pass. SAFE/CAUTION/UNSAFE verdict. Use when the user wants to check if a downloaded or cloned skill is safe to install.From its SKILL.md

Install
npx -y skills add redhat-community-ai-tools/harness-eval --skill skill-verify

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.4 KB, as published. Nobody here has run it

<!-- evaluator-ignore: content/allowed-tools-auto-approve -->

Skill Verify

Vet a skill or setup for security and quality issues before installing.

Hard Rules

  1. Run the CLI command. Do not skip the scan.
  2. Report the verdict clearly. SAFE, CAUTION, or UNSAFE.
  3. Show all findings with fix suggestions.

Step 1: Get the Path

Ask the user for the path to the skill or setup directory to verify. If they provide a URL, clone it first:

git clone --depth 1 <url> /tmp/skill-to-verify

Step 2: Run the Scan

uvx --from harness-eval harness-eval skill-verify <path> --format json

If uvx is not available, fall back to pip install harness-eval and use harness-eval directly.

Read the JSON output.

Step 3: Present the Results

Report the verdict prominently: SAFE, CAUTION, or UNSAFE.

List all findings with their severity, rule, message, and fix suggestion.

If UNSAFE, tell the user not to install without addressing the findings. If CAUTION, tell the user to review the warnings before installing. If SAFE, tell the user it's safe to install.

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.