Skills Check CI v1.2.1

Skills Check CI v1.2.1

The missing quality toolkit for Agent Skills — freshness, security, linting, and more, as a GitHub Action.

Features

• 10 commands available via the action: check, audit, lint, budget, verify, policy, test, report, refresh, init
• Flexible command selection — use commands: "check,audit,lint" or individual toggle inputs
• Per-command thresholds — audit-fail-on, lint-fail-on, budget-max-tokens, policy-fail-on
• CI-first — JSON output, strict exit codes, configurable failure thresholds
• Isolation zones for audit and test commands
• Automatic issue management — opens/updates GitHub issues when skill staleness is detected

Quick Usage

- uses: voodootikigod/skills-check@v1
  with:
    commands: "check,audit,lint"
    audit-fail-on: "high"

Or use individual toggles:

- uses: voodootikigod/skills-check@v1
  with:
    check: "true"
    audit: "true"
    lint: "true"

Outputs

┌──────────────┬─────────────────────────────────────────┐
│    Output    │               Description               │
├──────────────┼─────────────────────────────────────────┤
│ stale-count  │ Number of stale products                │
├──────────────┼─────────────────────────────────────────┤
│ issue-number │ GitHub issue created/updated            │
├──────────────┼─────────────────────────────────────────┤
│ report       │ Full markdown report                    │
├──────────────┼─────────────────────────────────────────┤
│ results      │ JSON object with per-command exit codes │
└──────────────┴─────────────────────────────────────────┘

Requirements

• Node.js 22+ (configurable via node-version input)

v1.2.0 — Isolation Zones

Isolation Zones

First-of-its-kind sandboxed execution for AI agent skill validation. The audit and test commands now support running inside isolated containers, preventing untrusted skill files from making network requests or accessing the host filesystem directly.

New: --isolation flag

Added to both audit and test commands:

• --isolation auto — auto-detect the best available runtime (default for test)
• --isolation docker|podman|orbstack|rancher|nerdctl|cri-o — use a specific OCI runtime
• --isolation apple-container — use macOS 26+ lightweight containers
• --isolation vercel-sandbox — use Vercel's cloud sandbox
• --no-isolation — run locally without sandboxing

Detection waterfall

When set to auto, the CLI detects available runtimes in order:

1. Apple Containers (containerctl)
2. OCI runtimes (Docker, Podman, OrbStack, Rancher, nerdctl, CRI-O)
3. Vercel Sandbox
4. Local fallback (with warning)

Design

• Skills directories are mounted read-only into containers
• Network access is controlled per-command
• No new dependencies — uses child_process for container CLIs, built-in fetch for Vercel API
• Graceful degradation when no runtime is found

Lint & type fixes

• Resolved all Biome lint errors across CLI and web packages
• Fixed TypeScript strict mode errors in isolation module

v1.1.0 — Security Enhancements & Full Command Suite

What's New in v1.1.0

Security & Audit Enhancements

• Full security audit pipeline — hallucinated package detection across npm/PyPI/crates.io, prompt injection scanning, dangerous command detection, URL liveness checking, and metadata completeness validation
• Advisory checker — cross-references against known hallucinated packages from Aikido Security and Socket.dev research
• skills.sh API integration — validates skills against the skills.sh registry
• Policy enforcement — organizational trust rules via .skill-policy.yml with source allow/deny, banned patterns, required metadata, staleness limits, and audit integration
• SARIF output — security findings export for GitHub Security tab integration

New Commands (shipped all 10)

• audit — Security scan with modular extractor/checker architecture
• lint — Metadata validation with auto-fix from git context
• budget — Token cost analysis, redundancy detection, snapshot comparison
• verify — Semver verification with heuristic + LLM-assisted classification
• test — Eval test runner with agent harness abstraction and 7 built-in graders
• policy — Policy-as-code enforcement via .skill-policy.yml

Infrastructure

• Rebranded from skillsafe to skills-check (skillscheck.ai)
• GitHub Action supporting all 10 commands with per-command thresholds
• 91 test files, 688 tests with full coverage of all commands
• Vercel Web Analytics integration
• Node 22 requirement enforced via .node-version

Bug Fixes

• Fixed action.yml description to meet 125-char marketplace limit
• Fixed favicon branding
• Fixed hero title and tagline

Full Changelog: v1.0.0...v1.1.0

v1.0.0

skill-versions v1.0.0

First stable release of skill-versions — freshness checker for Agent Skills.

Features

• skill-versions check — check skill versions against the npm registry with human-readable, JSON, or CI-mode output
• skill-versions report — generate markdown or JSON staleness reports
• skill-versions init — scan a skills directory and create a skill-versions.json registry with auto-detection of common packages
• skill-versions refresh — AI-assisted skill updates via LLM (Anthropic, OpenAI, Google) with changelog-aware diffs and frontmatter verification
• GitHub Action (voodootikigod/skill-versions@v1) — composite action with issue deduplication, weekly cron workflow, and CI integration
• Registry schema with optional agents field for tracking agent files alongside skills

Install

npx skill-versions check

Links

• Documentation
• npm
• GitHub Action usage

v0.2.3

Add README for npm package page.

v0.2.2

Publish with provenance attestation (repo now public).

v0.2.1

Fix npm publish for private repos (remove --provenance flag).

v0.2.0

Initial public release of skill-versions — freshness checker for Agent Skills.

Features

• skill-versions check — check skill versions against npm registry
• skill-versions report — generate markdown/JSON staleness reports
• skill-versions init — scan skills directory and create registry
• skill-versions refresh — AI-assisted skill updates via LLM
• GitHub Action (voodootikigod/skill-versions@v1) with automated issue creation
• Weekly staleness cron workflow

v0.1.0

Initial release of skill-versions — freshness checker for Agent Skills.

Features

• skill-versions check — check skill versions against npm registry
• skill-versions report — generate markdown/JSON staleness reports
• skill-versions init — scan skills directory and create registry
• skill-versions refresh — AI-assisted skill updates via LLM
• GitHub Action (voodootikigod/skill-versions@v1) with automated issue creation
• Weekly staleness cron workflow
• CI workflow for lint, typecheck, and test