Correct agentskills.io validator/schema to match the standard

The standard requires only name+description; additional top-level keys are
permitted metadata. Fixes:
- validator no longer counts extra top-level keys as violations (reports them
  as informational only).
- angle-bracket check now ignores YAML block-scalar indicators (`>`, `>-`,
  `|`), which were false-positiving on multi-line descriptions; no skill has
  genuine angle-bracket content.
- schema additionalProperties false -> true to match.

Audit result: 817/817 compliant.
This commit is contained in:
Mahipal
2026-08-02 09:53:50 -07:00
parent fbe6b12f21
commit 88f408ada3
2 changed files with 9 additions and 5 deletions
+2 -2
View File
@@ -2,9 +2,9 @@
"$schema": "https://json-schema.org/draft/2020-12/schema", "$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://agentskills.io/schema/skill-frontmatter.json", "$id": "https://agentskills.io/schema/skill-frontmatter.json",
"title": "agentskills.io SKILL.md frontmatter", "title": "agentskills.io SKILL.md frontmatter",
"description": "Strict JSON Schema for the YAML frontmatter of a SKILL.md file per the agentskills.io open standard (Anthropic, 2025-12-18). Only `name` and `description` are required; a small optional set is permitted; every other top-level key is a non-standard 'unexpected field'. Constraints that cannot be expressed in JSON Schema (name must equal the parent directory; frontmatter must contain no angle brackets) are enforced by tools/validate-agentskills.py.", "description": "JSON Schema for the YAML frontmatter of a SKILL.md file per the agentskills.io open standard (Anthropic, 2025-12-18). Only `name` and `description` are required; `license`, `compatibility`, `metadata`, and `allowed-tools` are recognized optional fields. Additional top-level keys are PERMITTED as extra metadata (this repo uses domain/subdomain/tags/version/author and framework-mapping keys), so `additionalProperties` is true. Constraints JSON Schema cannot express (name must equal the parent directory; no angle-bracket content in frontmatter) are enforced by tools/validate-agentskills.py.",
"type": "object", "type": "object",
"additionalProperties": false, "additionalProperties": true,
"required": ["name", "description"], "required": ["name", "description"],
"properties": { "properties": {
"name": { "name": {
+7 -3
View File
@@ -84,12 +84,16 @@ def validate(path):
elif "description" in keys: elif "description" in keys:
problems.append("description empty") problems.append("description empty")
if "<" in fm or ">" in fm: # Ignore YAML block-scalar indicators (`key: >`, `key: >-`, `key: |`, ...);
# only genuine `<...>`/`>` content in values is an injection concern.
fm_no_ind = re.sub(r":[ \t]*[|>][+-]?[ \t]*(?=\n|$)", ":", fm)
if "<" in fm_no_ind or ">" in fm_no_ind:
problems.append("frontmatter contains angle brackets (injection risk / not allowed)") problems.append("frontmatter contains angle brackets (injection risk / not allowed)")
# Additional top-level keys are PERMITTED by the standard (name+description
# are the only required fields). They are reported for information, not
# counted as compliance failures.
nonstd = [k for k in keys if k not in ALLOWED] nonstd = [k for k in keys if k not in ALLOWED]
for k in nonstd:
problems.append(f"non-standard top-level key: {k}")
return slug, problems, nonstd return slug, problems, nonstd
def main(): def main():