360 Secure SkillHub
360 安全技能中心

Skill Preflight

发布前对目标 SKILL.md 做确定性检查:验证 frontmatter 是否存在,name、description、version 是否非空,version 是否为 N.N.N 语义化版本,metadata.openclaw.requires.bins 是否声明,以及每个声明的二进制能否在 PATH 中解析;以 JSON 返回 ok、reason 和逐项 checks,并用退出码区分通过与失…

leonting1010
leonting1010
热度 15.71
最近更新 2026-07-06 17:48:03
分类:开发依赖:代码执行 / 读写文件应用场景:代码审查 / 调试排错 / 工作流

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add tap-skill-preflight
Metadata
name
tap-skill-preflight
description
Validate a SKILL.md before publishing — checks frontmatter completeness, semver, and that every declared bin actually resolves on PATH. Use before `clawhub publish`, or when a skill fails to load / shows as missing requirements.
version
1.0.0
metadata
{"openclaw":{"emoji":"✅","requires":{"bins":["python3"]}}}

Skill Preflight

A deterministic, self-validating skill: it runs a real check with python3 and returns an honest machine-readable outcome. ok:true proves the target SKILL.md passed every check below — nothing more, nothing less.

This is the executable-validation pattern: encode the process, run it with a real tool, and gate the result on a postcondition instead of trusting a vibe.

Trigger

  • /skill-preflight <path-to-SKILL.md | skill-folder>
  • Natural language: "check my skill before publishing", "why is my skill missing requirements", "validate this SKILL.md".

Execution

Run the bundled checker against the target skill:

python3 scripts/preflight.py <path-to-SKILL.md | skill-folder>

It emits JSON { ok, reason, checks[] } and exits 0 on pass, 1 on fail, 2 on usage/IO error.

Checks (the validation gate)

  1. frontmatter-present — a --- … --- YAML block exists.
  2. has-name / has-description / has-version — required keys are present and non-empty.
  3. version-semver — version matches N.N.N.
  4. requires.bins-declared — metadata.openclaw.requires.bins is declared (an empty list is fine; absent is not).
  5. bin: — every declared binary actually resolves on PATH (shutil.which). This is the real-execution gate: a skill that declares a tool it can't find will show as "missing requirements" at load time.

Honest outcome contract

  • ok:true → the SKILL.md passed all checks above. It does not guarantee the skill's behaviour is correct, only that its manifest is loadable and its declared tools are present.
  • ok:false → reason names the failing checks; checks[] gives per-check detail. Fix those before clawhub publish.

Examples

$ python3 scripts/preflight.py ./my-skill/SKILL.md
{ "ok": true, "reason": "all checks passed", "checks": [ ... ] }

$ python3 scripts/preflight.py ./broken/SKILL.md
{ "ok": false, "reason": "failed: version-semver, bin:jq", "checks": [ ... ] }

Notes

  • Pure Python standard library — no pip install, no network.
  • Parses frontmatter without PyYAML so it runs anywhere python3 exists.