# SKILL.md Lint

> Lint a SKILL.md for frontmatter, structure, secrets and size. All 6 tools free.

- name: com.moltlinestudio/skillmd-lint
- version: 1.2.0
- connection class: R0 (autonomous)
- trust: 84/100 flags: duplicate-repo
- quality: 91/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.moltlinestudio%2Fskillmd-lint
- tools: https://api.protogrid.dev/v1/servers/com.moltlinestudio%2Fskillmd-lint/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "skillmd-lint": {
      "type": "http",
      "url": "https://mcp.moltlinestudio.com/skillmd-lint"
    }
  }
}
```


## Trust

- hygiene: 60
- liveness: 99
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-97% ~updated-42d-ago -duplicate-repo(22 names)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 91/100 (strong)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 6 of 6 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,882 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 6, about 1,882 tokens to load them all
- tool set hash: 4a9dc07d3c5f458c292776bf88a969d8
- badge: [![protogrid quality](https://protogrid.dev/badge/com.moltlinestudio/skillmd-lint.svg)](https://protogrid.dev/servers/com.moltlinestudio/skillmd-lint)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.moltlinestudio.com/skillmd-lint (streamable-http, auth none, reachable true, uptime30d 0.9655172)

## Packages

_none_

## Tools (6)

- `cron_explain`: Explain a 5-field cron expression in plain English and flag mistakes. FREE.

Typical input {"expression": "0 9 * * 1-5"} returns {"expression":
"0 9 * * 1-5", "meaning": "at minute 0; at hour 9; every day of month;
every month; day of week 1-5", "issues": ["none"]}; out-of-range fields
are listed in "issues".

Use to read a schedule back in plain English before trusting it. Assumes
5-field cron; not for 6-field or seconds-precision variants. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "expected 5 fields, got <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `diff_texts`: Produce a unified diff between two texts. FREE.

Useful for comparing two SKILL.md versions. Typical input {"a": "<old
text>", "b": "<new text>"} returns {"changed_lines": N, "diff":
"--- \n+++ \n@@ ... @@\n-old line\n+new line"}; identical inputs
return {"changed_lines": 0, "diff": "(identical)"}. The diff is capped
at 400 lines.

Use to show exactly what changed between two versions of a text. Not for
judging the risk of a code change - the codereview server's review_diff
does that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "each text must be at most 500000 characters"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `json_validate`: Validate JSON text and summarize its structure. FREE.

Typical input {"text": "{\"a\": [1, 2]}"} returns {"valid": true,
"structure": {"a": ["array[2]", "int"]}}; invalid JSON returns
{"valid": false, "error": "<parser message>", "line": N, "column": N}
instead.

Use when JSON may be malformed or its shape is unknown. Reports structure,
not conformance to a schema. Not for testing a pattern (regex_test). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "text is empty — pass the JSON document as a raw string"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `lint_skill`: Lint one SKILL.md file the way marketplaces and agents parse it. FREE.

Checks YAML frontmatter presence and required fields (name,
description), description quality, body structure (procedure steps,
rules, degradation), secret/credential leakage, injection-style
phrasing, and size budget. Typical input {"content": "<full SKILL.md
text>"} returns {"verdict": "pass" | "pass-with-warnings" | "fail",
"errors": ["..."], "warnings": ["..."], "stats": {"body_words": N,
"has_frontmatter": bool}}.

Use on the full text of one SKILL.md. Not for the surrounding archive
layout (packaging_check). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "content is empty — pass the full SKILL.md text including frontmatter"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `packaging_check`: Validate a zip layout plan for a skill marketplace before packaging. FREE.

Checks SKILL.md placement rules and flags junk files. Typical input
{"file_paths": ["my-skill/SKILL.md", "my-skill/examples.md"],
"marketplace": "agensi"} returns {"verdict": "pass" | "fail",
"issues": ["..."], "skill_files_found": ["my-skill/SKILL.md"]}.

Use on a planned file layout, before zipping. Not for the content of a
skill file (lint_skill). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "file_paths is empty — list every file that will be inside the zip"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
- `regex_test`: Test a regular expression against sample strings. FREE.

Typical input {"pattern": "v(\\d+)", "samples": ["v12", "beta"]}
returns {"pattern": ..., "results": [{"sample": "v12", "match": true,
"matched_text": "v12", "groups": ["12"]}, {"sample": "beta", "match":
false, ...}], "match_count": 1}.

Use to confirm a pattern matches what you expect before shipping it. Not
for validating JSON (json_validate). The pattern is compiled and run in a
short-lived, CPU-capped child process, so a pattern that backtracks
catastrophically is stopped instead of stalling the server. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "a sample is too long (max 10000 characters); shorten it and retry"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.