SkillCI for VS Code

Live linting for SKILL.md files, powered by skillci check --format json. Runs on open, on save, and (debounced) as you type — the same OWASP-mapped security scan and skill-bloat checks the CLI runs, surfaced inline instead of only in a terminal or CI log.

Requirements

The skillci binary must be installed and on your PATH (brew install --cask skillci, a prebuilt release binary, or go install github.com/kabirnarang39/skillci/cmd/skillci@latest). If it's somewhere else, set skillci.path in your settings.

No ANTHROPIC_API_KEY needed — check is local-only, same as running it from a terminal.

Settings

Setting	Default	What it does
`skillci.path`	`"skillci"`	Path to the binary, if not on your PATH
`skillci.lintOnType`	`true`	Re-lint on every edit (debounced), not just on save
`skillci.lintOnTypeDelayMs`	`500`	Debounce delay for lint-on-type

What you'll see

Security findings (ast01-* through ast10-*) as Errors
Everything else (missing frontmatter fields, skill-bloat warnings, path issues) as Warnings
Issues found in a file the skill references (not just SKILL.md itself) appear on that file too

How lint-on-type actually works

skillci check is a separate process that always reads SKILL.md from disk — it has no notion of an unsaved editor buffer. To make skillci.lintOnType genuinely reflect what you've typed (not just re-check the same unchanged on-disk file on a timer), each debounced edit writes your current buffer to a scratch temp directory — with the skill's other files (scripts/, references/, assets/) symlinked in alongside it so referenced-file checks still resolve correctly — and lints that instead. Diagnostics are remapped back onto your real files before being shown, so clicking one still takes you to the file you actually have open. The temp directory is cleaned up when you close the SKILL.md tab.

Development

npm install
npm run compile           # or: npm run watch
npm test                  # pure-logic unit tests (node:test, no extension host needed)
npm run test:integration  # real end-to-end test: builds skillci fresh, launches a
                           # real VS Code Extension Development Host, opens a real
                           # broken SKILL.md fixture, and asserts on the real
                           # diagnostics the extension publishes
npm run package            # builds a real .vsix via @vscode/vsce

test:integration downloads an isolated VS Code test build on first run (cached under .vscode-test/, gitignored) — it never touches your own VS Code profile, settings, or installed extensions. It configures skillci.path at runtime to point at the binary it just built, rather than relying on PATH: VS Code resolves its own PATH from your login shell on macOS, which can silently pick up a different, older skillci install ahead of the one this test just built.

Press F5 in VS Code (with this folder open) to launch an Extension Development Host for manual testing.

SkillCI