Developer tooling · static analysis

Skillcheck

Static skill review, entirely in the browser

Make an agent skill easier to review before it becomes part of a workflow.

  • Public source
  • Live

Pending release

The review workflow shown above

Folder intake, the editable comparison, finding decisions, and the exports were merged into the public source on September 13, 2026. The live app may still show the earlier release until it is redeployed.

My role: Product design, analyzer architecture, implementation, and delivery.

  • React 19
  • TypeScript (strict)
  • Vite
  • Deterministic checks
  • Zero backend

At a glance

Problem
Teams need to review agent instructions before installation without sending private skill files to a server.
My contribution
I designed and shipped a local TypeScript analyzer shared by the browser and CLI, with reviewed instructions kept inert.
Outcome
A live, open-source review tool with inspectable findings and exports; its scores do not establish safety or model performance.

An optional working example

What does a good score actually prove?

Review two well-structured instructions. Find the red flag a perfect structure score can hide.

A score is useful when you can see both its reasons and its limits.

Skillcheck upgrade preview: a populated comparison with heuristic score changes from 89 to 94, an injection warning, and report exports
Product interface. Features on a live deployment can differ from the latest source revision.
Skillcheck's shared analysis layerA browser interface and a command-line script both call analyzeReview in src/domain, a pure TypeScript layer covering diff, quality, injection, and review checks. It produces findings and decisions that export as JSON or Markdown, and calibration fixtures exercise it in tests.BrowserReact UIsrc/componentsCLIscripts/skillcheck.mjsanalyzeReviewsrc/domainPure logic, no Reactdiff · qualityinjection · reviewtestsCalibration fixtures21 labeled syntheticcases (synthetic-1.0)Findings + decisionsJSON / Markdown export

The browser interface and the CLI are two entry points over one pure analysis layer, which produces the findings a review exports.

In words

  1. The browser interface (src/components) is one entry point; the CLI (scripts/skillcheck.mjs) is the other.
  2. Both call the same analyzeReview entry point in src/domain.
  3. That layer is pure logic with no React: diff, quality, injection, and review checks.
  4. Its findings and decisions export as versioned JSON or Markdown.
  5. Calibration fixtures, 21 labeled synthetic cases, exercise the domain layer in tests.

Derived from the public repository layout (src/domain, src/components, scripts/skillcheck.mjs).

Engineering decisions

  1. 01decision

    Keep the analysis local

    Skill files can contain internal instructions. Analysis runs in the browser, with a pure TypeScript domain layer separated from the interface. Reviewing a file does not execute its instructions.

    TradeoffWith no backend there is no server-side record of a review; the exported JSON or Markdown file is the record.

  2. 02decision

    Expose the reasons behind a score

    Deterministic checks flag structure, clarity, actionability, completeness, and efficiency. An editable comparison, line differences, and finding decisions connect a changed instruction to a reviewable result. Versioned JSON and Markdown exports preserve the review.

    TradeoffDeterministic rules are legible and reproducible, and they miss anything a rule does not describe.

  3. 03decision

    Treat detection as a review aid

    Injection analysis uses patterns, normalization, and context-aware damping. A reassuring score cannot establish that a skill is safe or that a model will follow it.

What you can verify

Source and release links checked .

Scope and limits

This is static, heuristic analysis. Scores are not measured task success, a security certification, or a substitute for reviewing the instructions and testing them with the intended model.

A short walkthrough

  1. 01

    Load the built-in review example or select a skill folder with local text references.

  2. 02

    Edit the candidate and inspect the quality findings, injection warnings, and differences.

  3. 03

    Record your finding decisions and export the review for a pull request.

Curious how this is built? Look under the desk.

pocket terminal · ~/desk

A small terminal for this site. It prints only what is on the site; type help for commands.

The prompt needs JavaScript. Every destination is also in the navigation above.

ls work

7 products · * featured

Your turn: try open skillcheck, coffee, or help.

Loading terminal commands…

Type a command and press Enter. Try help, ls, open followed by a project name, why followed by a project name, inspect, trail, cat about, notes, contact, resume, coffee, whoami, or clear. Tab completes; the up and down arrows recall earlier commands. Escape closes the terminal.