genesis-agent-skills-qa

Genesis Agent Skills QA & Packager

Deterministic quality assurance, security auditing, and packaging harness for Agent Skills (SKILL.md) in modern coding-agent ecosystems (Codex CLI, Claude Code, Cursor, Gemini).

---

1. What Problem Does This Solve?

Teams building custom Agent Skills encounter silent failures in production:

• Malformed YAML frontmatter that agents cannot parse.
• Broken local path references to missing helper scripts.
• Bloated context payloads (>50KB) that blow out token windows.
• Accidental embedding of developer API keys, private keys, or credentials.
• Destructive commands (rm -rf, sudo, curl | sh) embedded in agent prompts.

genesis-skills-qa deterministically catches these issues in CI or pre-commit before deployment and bundles passing skills into tamper-evident .skill.tar.gz packages with SHA-256 integrity manifests.

2. Who Buys It?

• AI Engineers and Prompt Engineers maintaining Agent Skill libraries.
• Engineering teams deploying autonomous coding agents (Codex / Claude Code / Cursor).
• Enterprise platform teams enforcing security boundaries on agent capabilities.

3. What Does It Output?

• Human-readable terminal diagnostic table with exact line citations.
• Machine-readable JSON output (--json) for CI/CD gates.
• Signed SHA-256 distribution bundle (.skill.tar.gz) with .skill-manifest.json.

4. How Fast Can You Test It?

Under 5 seconds. Run:

./bin/genesis-skills-qa.js ./tests/fixtures/valid_skill

5. Why Is This Different From Generic Markdown Linters?

Generic markdown linters only check syntax. genesis-skills-qa is purpose-built for the 2026 Agent Skill standard: it audits token context budgets, verifies executable script references, scans for API key entropy, and prevents dangerous escalation commands from entering agent memory.

---

Installation & Quickstart

# Verify a skill directory
npx genesis-skills-qa ./my-skill

# Run in CI with JSON output and exit code
npx genesis-skills-qa ./my-skill --json

# Package verified skill for distribution
npx genesis-skills-qa ./my-skill --package --out ./dist/my-skill.skill.tar.gz

Diagnostic Rules Evaluated

Rule ID	Severity	Description
SKILL_MD_EXISTS	FAIL	Checks for presence of SKILL.md at root
FRONTMATTER_SCHEMA	FAIL	Validates YAML delimiters and key-value structure
FRONTMATTER_NAME	FAIL	Enforces non-empty name identifier
FRONTMATTER_DESC	FAIL	Enforces actionable description for agent tool routing
PAYLOAD_BUDGET	WARN / FAIL	Flags context bloat (>15KB warning, >50KB failure)
SECURITY_SECRET_LEAK	FAIL	Scans for OpenAI, GitHub, Slack tokens, private keys
SECURITY_DANGEROUS_CMD	WARN / FAIL	Detects destructive commands (rm -rf, sudo, curl|sh)
BROKEN_LOCAL_LINK	WARN	Verifies existence of local files referenced in markdown

License

Commercial — Genesis Code (genesiscode2026). See LICENSE.