skillcheck

skillcheck

Can you legally ship this agent skill?

$ npx @vortexeddev/skillcheck check obra/superpowers

✔ SAFE TO SHIP — MIT, spec-valid, maintained.

$ npx @vortexeddev/skillcheck check anthropics/skills

✖ DO NOT SHIP — 175,921 ★ and no LICENSE file.

That second one is real. anthropics/skills is the official Agent Skills repo. With no LICENSE file, copyright law defaults to all rights reserved — you may not copy, modify, redistribute or sell anything in it, even though it is public on GitHub.

It is not alone. This tool checks before you find out.

npx @vortexeddev/skillcheck check owner/repo

The problem

There are 22,678 repositories tagged agent-skills and 8,214 tagged claude-skills. Your coding agent will execute what those files say. Almost nobody has checked the terms.

skillcheck answers three questions in one command:

What we measured

Registry snapshot 2026-09-12, top 166 repos by stars across both topics (reproduce it yourself: npm run registry:build -- --fast):

The popular end is mostly fine. The long tail is not. A sample of the 100 most recently updated agent-skills repos came back only 46% MIT, with 17% carrying no license and 21% unclassified. Those are the ones you install at 2am.

How it works

Seven free API calls, no account, no key. The LICENSE question takes two calls, because GitHub reports license: null for both "no license" and "a license we could not classify" — and those are completely different legal situations. skillcheck always fetches the root file listing to tell them apart.

Install

Nothing to install. Requires Node 18+.

npx @vortexeddev/skillcheck check owner/repo

Or globally: npm i -g @vortexeddev/skillcheck

Commands

npx @vortexeddev/skillcheck check owner/repo        # GitHub repo (shorthand, URL or SSH remote)
npx @vortexeddev/skillcheck check ./my-skill        # local checkout, fully offline
npx @vortexeddev/skillcheck top [query]             # browse safe-to-ship skills, offline
npx @vortexeddev/skillcheck license "MIT OR AGPL-3.0-only"   # explain an expression
npx @vortexeddev/skillcheck badge owner/repo        # README badge for your own skill

Verdicts

Exit codes are deliberate, so CI can gate on them.

License buckets

How expressions resolve

$ npx @vortexeddev/skillcheck license "MIT OR AGPL-3.0-only"     # OR  → you may choose; we still show both
$ npx @vortexeddev/skillcheck license "MIT AND WeirdCorp-1.0"    # AND → worst branch wins

False alarms cost a minute. A missed AGPL costs a product, so the tool is conservative by design: unrecognised is unknown, never permissive.

CI

# .github/workflows/skillcheck.yml
name: skillcheck
on: [push, pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npx --yes @vortexeddev/skillcheck check . --json   # warn on review, fail on missing license

Badge

npx @vortexeddev/skillcheck badge owner/repo

[![skillcheck: SAFE TO SHIP](https://img.shields.io/badge/skillcheck-SAFE%20TO%20SHIP-brightgreen)](https://github.com/Vortexeddev/skillcheck#verdicts)

The registry is generated, not curated

Most skill lists are hand-maintained markdown: a thousand entries, zero verification, and the maintainer's free time as the update schedule.

skillcheck flips that. data/registry.ts is built from the GitHub API by scripts/build-registry.ts and refreshed weekly by .github/workflows/registry.yml. List repos (awesome-*, curated collections) are filtered out automatically — they are indexes, not things you install.

Why zero dependencies

npx @vortexeddev/skillcheck should cost you almost nothing to try. No node_modules, no lockfile drift, no transitive supply chain — a slightly load-bearing claim for a tool whose job is deciding whether you can trust a file an AI agent will execute.

The SPDX parser (src/spdx.ts) is ~200 lines and handles AND, OR, parentheses and WITH. The frontmatter parser (src/frontmatter.ts) implements the YAML subset the spec permits. 78 tests cover them, including the dangerous guesses:

npm test          # 78/78
npm run typecheck
npm run build     # one 160 KB file, zero runtime deps

Where it fits

skillcheck is the step before the installer. It deliberately does not install and does not security-scan.

Contributing

Missing a license in the table? A spec rule we do not enforce? Those are the highest-value PRs.

git clone https://github.com/Vortexeddev/skillcheck
cd skillcheck && npm install && npm test

Please add a test with any rule change — the suite is what stops this tool from quietly becoming wrong. See CONTRIBUTING.md.

Not legal advice

A static checker written by developers, not lawyers. For anything you are actually selling, have a lawyer read the file.

License

MIT © skillcheck contributors. Use it, fork it, ship it, sell what you build with it.