Agent Skill Production Kit
Official scaffolding gets you a well-formed skill. It doesn't check whether that skill is safe for a stranger to install. A recent audit of 22,511 public skills found about 6.3 issues each, and Snyk's ToxicSkills research found prompt injection in 36% of skills tested.This kit is the layer scaffolding skips: a CI schema validator for skills, agents, commands, hooks and plugin manifests, and a static review harness that flags credential access, network egress and prompt-injection-shaped instructions before an installer finds them.What's in the box validator/validate.js — schema validator: required frontmatter fields, kebab-case + directory-name match, hook shape, plugin/marketplace manifest fields. Exits non-zero on failure — CI-gate ready. review-harness/review.js — static security scanner: credential access, network egress, prompt-injection shape, dangerous exec, over-broad tool grants. block/warn severities. scaffolds/ — ready-to-copy templates for skill / agent / command / hook. examples/good-skill/ + examples/risky-skill/ — two real, tested fixtures. The risky one is structurally valid (passes the validator clean) and the review harness is the only thing that catches it. release/release.sh — version bump, tag, changelog template. docs/distribution-playbook.md — real marketplace-listing guidance. npm test runs both tools against the bundled fixtures — real output, not a mockup.Not a certification. The review harness is a heuristic static scanner — the same category of tool as a linter. It is not affiliated with or endorsed by Anthropic and does not guarantee any skill is safe.License: solo license — one developer's own projects. Team ($149) and Agency ($349) tiers at https://upshiftsites.com/store/skill-kit/
Get it → upshifted2.gumroad.com