mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-28 20:29:40 +03:00
Mahipal
6243c20d6d
Several open PRs could not be decided because CONTRIBUTING.md had nothing to
point at: no scope, no self-promotion or affiliation rules, no PR-size
guidance. Declining on an unwritten rule is unfair to contributors, so the
rules go in first.
SCOPE.md (new)
What a skill is, and what this repository is not: runtimes, engines,
products and applications belong in their own repositories. Offensive and
dual-use content is explicitly in scope - the line is defensive framing and
authorization, not subject matter.
CONTRIBUTING.md
- one skill per pull request, and why batching stalls good work
- overlap: while the description backlog is worked down, a new skill that
overlaps an existing one will usually be asked to extend it instead
- self-promotion and vendor links: commercial tools are fine, including
ones with no free tier, but cost must be stated in Prerequisites and
links must go to documentation rather than signup funnels
- affiliation disclosure, with the consequence stated: the PR goes on hold
until it is disclosed, and nothing is closed over it
- AI-assisted contributions are allowed and must be disclosed; a human must
have run the commands and takes responsibility
- review and response, including a 14-day stale window that closes nothing
permanently
- subdomain list corrected from 24 entries to the 34 canonical values the
validator actually accepts, with the 12 accepted aliases named
README.md
Removed the claim that every PR is reviewed within 48 hours. The oldest
open PR has been waiting since April. Replaced the stale "most in need"
counts, which named domains with 2 and 5 skills that actually have 6 and 10.
tools/README.md
Corrected to match the code: eight required frontmatter fields, not five,
and PyYAML is now a dependency.
33 lines
1.1 KiB
Markdown
33 lines
1.1 KiB
Markdown
# Skill Validation Tools
|
||
|
||
## validate-skill.py
|
||
|
||
Validate SKILL.md metadata before submitting a PR.
|
||
|
||
### Usage
|
||
|
||
```bash
|
||
# Validate a single skill
|
||
python tools/validate-skill.py skills/my-new-skill/
|
||
|
||
# Validate all skills
|
||
python tools/validate-skill.py --all
|
||
```
|
||
|
||
### What it checks
|
||
|
||
- SKILL.md exists in the skill directory
|
||
- Valid YAML frontmatter (between `---` markers)
|
||
- Required fields present: `name`, `description`, `domain`, `subdomain`, `tags`, `version`, `author`, `license`
|
||
- Name is kebab-case, 1–64 characters
|
||
- Description is at least 50 characters (agentskills.io caps it at 1024; `tools/validate-agentskills.py` enforces that)
|
||
- Domain is `cybersecurity`
|
||
- Subdomain is from the allowed list
|
||
- Tags is a list with at least 2 items
|
||
|
||
### Requirements
|
||
|
||
Python 3.8+ and PyYAML (`pip install pyyaml`).
|
||
|
||
All frontmatter is parsed by `skill_frontmatter.py`, the single PyYAML-backed loader. It replaced three hand-rolled regex parsers that silently truncated multi-line descriptions to their first line — that bug shipped 604 of 817 descriptions broken in `index.json`. Do not reintroduce regex frontmatter parsing; CI fails the build if it detects any.
|