Check a skill before you trust it

The rules are open source (MIT): read them on GitHub.

An author puts a .aisleaudit.yaml file in the skill. Each entry needs a reason of at least 15 characters. Suppressed findings do not count towards the grade, but they are always listed, with the reason. Critical findings cannot be suppressed by the author.

ignore:
  - rule: AA-N01
    path: references/legacy-api.md
    reason: Documents an old HTTP-only endpoint; no requests are made.

aisle audit ./my-skill
aisle audit some-skill@1.2.0
aisle audit owner/repo/path/to/skill@main
aisle audit . --format sarif --output audit.sarif
aisle audit . --format markdown --fail-on medium

• --format: pretty (default), json, sarif (for GitHub's Security tab) or markdown.
• --fail-on: critical, high (default), medium, low or none. Sets the exit code: 0 clean, 1 findings at or above that level, 2 the audit could not run.
• --output <file> writes the report to a file; --quiet prints one summary line.

Every skill page shows a README badge for its grade. It is a shields.io endpoint badge that reads /badges/<name>.json:

[![aisle audit](https://img.shields.io/endpoint?url=https%3A%2F%2F<site>%2Fbadges%2F<name>.json)](https://<site>/skills/<name>)

To audit your own skill repository on every push and see the findings in GitHub's Security tab, use the Agent Aisle audit Action. It runs aisle audit . --format sarif and uploads the result:

name: Aisle audit
on: [push, pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: HazemSalah29/aisle-audit-action@v1
        with:
          fail-on: high