com.moltlinestudio/skillmd-lint

Est-ce que com.moltlinestudio/skillmd-lint est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.moltlinestudio/skillmd-lint » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• cron_explain≈ 338 tokens

  Explain a 5-field cron expression in plain English and flag mistakes. FREE. Typical input {"expression": "0 9 * * 1-5"} returns {"expression": "0 9 * * 1-5", "meaning": "at minute 0; at hour 9; every day of month; every month; day of week 1-5", "issues": ["none"]}; out-of-range fields are listed in "issues". Use to read a schedule back in plain English before trusting it. Assumes 5-field cron; not for 6-field or seconds-precision variants. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "expected 5 fields, got <value>"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • expression · string · requis
    A standard 5-field cron string (minute hour day-of-month month day-of-week), e.g. "0 9 * * 1-5"; must be non-empty.

  Exemple d'appel

  {"name": "cron_explain", "arguments": {"expression": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• diff_texts≈ 372 tokens

  Produce a unified diff between two texts. FREE. Useful for comparing two SKILL.md versions. Typical input {"a": "<old text>", "b": "<new text>"} returns {"changed_lines": N, "diff": "--- \n+++ \n@@ ... @@\n-old line\n+new line"}; identical inputs return {"changed_lines": 0, "diff": "(identical)"}. The diff is capped at 400 lines. Use to show exactly what changed between two versions of a text. Not for judging the risk of a code change - the codereview server's review_diff does that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "each text must be at most 500000 characters"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (2)

  Paramètres

  • a · string · requis
    The original text (left side of the diff); at most 500000 characters.
  • b · string · requis
    The revised text (right side of the diff); at most 500000 characters.

  Exemple d'appel

  {"name": "diff_texts", "arguments": {"a": "texte", "b": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• json_validate≈ 322 tokens

  Validate JSON text and summarize its structure. FREE. Typical input {"text": "{\"a\": [1, 2]}"} returns {"valid": true, "structure": {"a": ["array[2]", "int"]}}; invalid JSON returns {"valid": false, "error": "<parser message>", "line": N, "column": N} instead. Use when JSON may be malformed or its shape is unknown. Reports structure, not conformance to a schema. Not for testing a pattern (regex_test). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "text is empty — pass the JSON document as a raw string"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • text · string · requis
    The JSON document to validate, as a raw string; must be non-empty.

  Exemple d'appel

  {"name": "json_validate", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lint_skill≈ 373 tokens

  Lint one SKILL.md file the way marketplaces and agents parse it. FREE. Checks YAML frontmatter presence and required fields (name, description), description quality, body structure (procedure steps, rules, degradation), secret/credential leakage, injection-style phrasing, and size budget. Typical input {"content": "<full SKILL.md text>"} returns {"verdict": "pass" | "pass-with-warnings" | "fail", "errors": ["..."], "warnings": ["..."], "stats": {"body_words": N, "has_frontmatter": bool}}. Use on the full text of one SKILL.md. Not for the surrounding archive layout (packaging_check). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "content is empty — pass the full SKILL.md text including frontmatter"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (1)

  Paramètres

  • content · string · requis
    The complete SKILL.md file text, frontmatter included; must be non-empty.

  Exemple d'appel

  {"name": "lint_skill", "arguments": {"content": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• packaging_check≈ 404 tokens

  Validate a zip layout plan for a skill marketplace before packaging. FREE. Checks SKILL.md placement rules and flags junk files. Typical input {"file_paths": ["my-skill/SKILL.md", "my-skill/examples.md"], "marketplace": "agensi"} returns {"verdict": "pass" | "fail", "issues": ["..."], "skill_files_found": ["my-skill/SKILL.md"]}. Use on a planned file layout, before zipping. Not for the content of a skill file (lint_skill). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "file_paths is empty — list every file that will be inside the zip"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (2)

  Paramètres

  • file_paths · array · requis
    Every file path that will be inside the zip, relative to the zip root, e.g. ["my-skill/SKILL.md"]; at least 1 entry.
  • marketplace · string · optionnel
    Rule set to apply: "agensi" (SKILL.md at root or one folder deep) or "generic" (junk-file checks only). Default "agensi".

  Exemple d'appel

  {"name": "packaging_check", "arguments": {"file_paths": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• regex_test≈ 412 tokens

  Test a regular expression against sample strings. FREE. Typical input {"pattern": "v(\\d+)", "samples": ["v12", "beta"]} returns {"pattern": ..., "results": [{"sample": "v12", "match": true, "matched_text": "v12", "groups": ["12"]}, {"sample": "beta", "match": false, ...}], "match_count": 1}. Use to confirm a pattern matches what you expect before shipping it. Not for validating JSON (json_validate). The pattern is compiled and run in a short-lived, CPU-capped child process, so a pattern that backtracks catastrophically is stopped instead of stalling the server. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"} (for example {"error": "a sample is too long (max 10000 characters); shorten it and retry"}). Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Paramètres, retour & exemple (2)

  Paramètres

  • pattern · string · requis
    A Python-flavor regular expression as a string, e.g. "v(\\d+)".
  • samples · array · requis
    Strings to test the pattern against; only the first 50 are evaluated.

  Exemple d'appel

  {"name": "regex_test", "arguments": {"pattern": "texte", "samples": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.moltlinestudio.com/skillmd-lint