SkillCert

Security scanner for Claude Code Skill files — detects vulnerabilities, validates schema, and enforces best practices.

SkillCert analyzes your Claude Code Skill files (.claude/skills/*/SKILL.md) in real-time, highlighting security risks, schema violations, and best practice issues directly in your editor.

Features

25 Built-in Security Rules

Real-time Diagnostics

Issues are highlighted inline as you type:

• Red underline — Critical security issues (e.g., rm -rf, curl | bash)
• Yellow underline — Risky patterns (e.g., unrestricted Bash access)
• Blue underline — Best practice suggestions

Rich Hover Information

Hover over any flagged issue to see:

• Rule ID and name
• Risk level (High / Medium / Low)
• Detailed explanation
• Suggested fix

Quick Fixes

Click the lightbulb icon to apply automatic fixes:

• Add missing required fields (name, description)
• Convert name to kebab-case
• Add allowed-tools restrictions for Bash
• Quote unsafe $ARGUMENTS variables
• Switch from expensive opus to sonnet model

Security Panel (Sidebar)

A dedicated sidebar panel provides:

• Security Score (0–100) based on findings
• Rule Status — pass/fail overview for all 25 rules
• Tool Permissions — visual overview of declared tools and their restrictions

Status Bar Indicator

The status bar shows the current file's security status at a glance:

• $(shield) SkillCert: OK (green) — no issues
• $(shield) SkillCert: 2E 3W (red/yellow) — errors and warnings found

Click to jump to the Problems panel.

Save Notifications

When you save a Skill file, SkillCert notifies you of any newly introduced security issues.

Installation

From VS Code Marketplace

Search for SkillCert in the Extensions view (Ctrl+Shift+X / Cmd+Shift+X), then click Install.

From VSIX

code --install-extension skillcert-0.1.0.vsix

Usage

1. Open a Skill file — any file matching .claude/skills/*/SKILL.md or .claude/commands/*.md
2. SkillCert activates automatically and scans the file in real-time
3. Review issues in the editor (underlines), Problems panel, or the SkillCert sidebar
4. Apply Quick Fixes via the lightbulb icon or Ctrl+. / Cmd+.

Commands

Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) and type "SkillCert":

Keyboard Shortcuts

Context Menu

Right-click in the editor or file explorer on any .md file to access SkillCert: Scan Current File.

Configuration

Configure SkillCert in VS Code Settings (Ctrl+, / Cmd+,):

Rule Severity Override

Adjust individual rule severity or disable rules entirely:

{
  "skillCert.rules": {
    "SEC009": "off",
    "BP001": "warning",
    "SEC002": "error"
  }
}

Available severity values: error, warning, info, hint, off

Rules Reference

Schema Rules

Security Rules

Best Practice Rules

Requirements

• VS Code 1.90.0 or later

License

MIT License — see LICENSE for details.