mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-03 09:20:18 +03:00
Correct agentskills.io validator/schema to match the standard
The standard requires only name+description; additional top-level keys are permitted metadata. Fixes: - validator no longer counts extra top-level keys as violations (reports them as informational only). - angle-bracket check now ignores YAML block-scalar indicators (`>`, `>-`, `|`), which were false-positiving on multi-line descriptions; no skill has genuine angle-bracket content. - schema additionalProperties false -> true to match. Audit result: 817/817 compliant.
This commit is contained in:
@@ -2,9 +2,9 @@
|
|||||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||||
"$id": "https://agentskills.io/schema/skill-frontmatter.json",
|
"$id": "https://agentskills.io/schema/skill-frontmatter.json",
|
||||||
"title": "agentskills.io SKILL.md frontmatter",
|
"title": "agentskills.io SKILL.md frontmatter",
|
||||||
"description": "Strict JSON Schema for the YAML frontmatter of a SKILL.md file per the agentskills.io open standard (Anthropic, 2025-12-18). Only `name` and `description` are required; a small optional set is permitted; every other top-level key is a non-standard 'unexpected field'. Constraints that cannot be expressed in JSON Schema (name must equal the parent directory; frontmatter must contain no angle brackets) are enforced by tools/validate-agentskills.py.",
|
"description": "JSON Schema for the YAML frontmatter of a SKILL.md file per the agentskills.io open standard (Anthropic, 2025-12-18). Only `name` and `description` are required; `license`, `compatibility`, `metadata`, and `allowed-tools` are recognized optional fields. Additional top-level keys are PERMITTED as extra metadata (this repo uses domain/subdomain/tags/version/author and framework-mapping keys), so `additionalProperties` is true. Constraints JSON Schema cannot express (name must equal the parent directory; no angle-bracket content in frontmatter) are enforced by tools/validate-agentskills.py.",
|
||||||
"type": "object",
|
"type": "object",
|
||||||
"additionalProperties": false,
|
"additionalProperties": true,
|
||||||
"required": ["name", "description"],
|
"required": ["name", "description"],
|
||||||
"properties": {
|
"properties": {
|
||||||
"name": {
|
"name": {
|
||||||
|
|||||||
@@ -84,12 +84,16 @@ def validate(path):
|
|||||||
elif "description" in keys:
|
elif "description" in keys:
|
||||||
problems.append("description empty")
|
problems.append("description empty")
|
||||||
|
|
||||||
if "<" in fm or ">" in fm:
|
# Ignore YAML block-scalar indicators (`key: >`, `key: >-`, `key: |`, ...);
|
||||||
|
# only genuine `<...>`/`>` content in values is an injection concern.
|
||||||
|
fm_no_ind = re.sub(r":[ \t]*[|>][+-]?[ \t]*(?=\n|$)", ":", fm)
|
||||||
|
if "<" in fm_no_ind or ">" in fm_no_ind:
|
||||||
problems.append("frontmatter contains angle brackets (injection risk / not allowed)")
|
problems.append("frontmatter contains angle brackets (injection risk / not allowed)")
|
||||||
|
|
||||||
|
# Additional top-level keys are PERMITTED by the standard (name+description
|
||||||
|
# are the only required fields). They are reported for information, not
|
||||||
|
# counted as compliance failures.
|
||||||
nonstd = [k for k in keys if k not in ALLOWED]
|
nonstd = [k for k in keys if k not in ALLOWED]
|
||||||
for k in nonstd:
|
|
||||||
problems.append(f"non-standard top-level key: {k}")
|
|
||||||
return slug, problems, nonstd
|
return slug, problems, nonstd
|
||||||
|
|
||||||
def main():
|
def main():
|
||||||
|
|||||||
Reference in New Issue
Block a user