Server data from the Official MCP Registry
Vet an agent skill before you install it: structure, triggers, secrets.
About
Vet an agent skill before you install it: structure, triggers, secrets.
Remote endpoints: streamable-http: https://rta.lat/skilllint/mcp
Security Report
Valid MCP server (1 strong, 2 medium validity signals). 1 known CVE in dependencies Imported from the Official MCP Registry. Trust signals: trusted author (5/5 approved).
3 tools verified · Open access · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Found in Source Code
Found by scanning the linked source code. This listing connects to a hosted endpoint, so none of this runs on your machine: it describes what the server software does where it is hosted.
How to Connect
Remote Plugin
No local installation needed. Your AI client connects to the remote endpoint directly.
Add this to your MCP configuration to connect:
{
"mcpServers": {
"lat-rta-skilllint": {
"url": "https://rta.lat/skilllint/mcp"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
skilllint
Private lint of agent skills (SKILL.md). Nothing leaves the machine.
Existing scanners (for example NVIDIA SkillSpector - 71 patterns, AST, YARA, CVE lookup) answer "is this artifact dangerous", and they ship the inspected content to their provider. We do something narrower and complementary:
- privacy - the check runs locally; only a verdict, a score and a hash go out;
- reproducibility - the verdict is bound to a sha256 of the file, so it can be signed and verified later;
- comparison - rank several candidates from different registries instead of scanning one artifact at a time.
Rules
| id | severity | check |
|---|---|---|
| R-001 | critical | frontmatter missing |
| R-002 | high | name missing or invalid |
| R-003 | high | description missing or too long |
| R-004 | medium | no trigger ("when to use") in description |
| R-005 | medium | dead instructions (TODO / deprecated / placeholder) |
| R-006 | critical | secret-shaped literals |
| R-007 | critical | prompt-injection / exfiltration markers |
| R-008 | medium | references to files that do not exist |
| R-009 | low | file larger than 60 KB |
| R-010 | high | world-writable scripts |
| R-011 | medium | unbounded autonomy instructions |
Verdict: PASS (>=80, no critical) | WARN | FAIL (any critical).
Use it
python3 mcp_server.py # stdio
python3 mcp_server.py --http 8191 # streamable http
npx -y mcp-remote https://rta.lat/skilllint/mcp # hosted
Tools: lint_skill(path) | compare_skills(paths) | lint_rules()
Signed verdicts
lint_skill returns {verdict, score, sha256, findings[]}. That hash is what attest signs and drift enforces as an allowlist - see Verified Tool Registry.
Locales: en, hi. India (Bharata) is supported from day one; legal claims require official sources, otherwise report pending.
License: MIT
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Rea
Freeby Morluto · Developer Tools
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
Paperclip
Freeby Paperclipai · Developer Tools
Trending hip-hop artist momentum scores across four cultural dimensions.
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.