share-skill

The validator scans skill files to detect API keys, tokens, credentials, private keys, and high-entropy strings before registry submission. It performs deterministic local filesystem scanning using configurable pattern lists to prevent unsafe skill sharing.

Skill validation enforces SKILL.md YAML frontmatter requirements and checks that the skill name format matches the folder name. Verifying these required fields ensures your skill is registry-ready and compliant for inclusion in the Zo Skills Registry.

Dangerous-pattern review flags potentially risky execution patterns like eval/exec usage and process/spawn-related patterns for manual inspection. This code safety mechanism ensures risky execution logic is identified before sharing skills to the registry.

Yes, you can use this validator for both internal community skills and externally sourced skills. It applies to preparing any skill for inclusion in the Zo Skills Registry by validating structure and scanning for secrets and dangerous patterns.

Local filesystem scanning limitations include relying on deterministic pattern matching rather than contextual analysis. Dangerous patterns are flagged for manual inspection, meaning the validator cannot autonomously determine the actual safety of complex eval or spawn usage.