Broken release shape
Missing metadata, folder-name mismatches, unresolved placeholders, and absent license files make a package incomplete or hard to evaluate.
Agent Skill Preflight Kit · v0.2.0
Inspect the skill. Then ship it.
A dependency-free local scanner, CI workflow example, safe and unsafe fixtures, and a repeatable review path for teams publishing SKILL.md-based agent capabilities.
- Download proof before purchase
- Python 3.9+
- No third-party packages
Local-first: no hosted scannerDeterministic: repeatable heuristic checksCI-ready: nonzero blocking exitsInspectable: human + JSON output
Why preflight exists
A valid folder can still be a bad release.
Agent skills combine instructions, scripts, references, permissions, and packaging boundaries. A quick manual pass can miss the small defects that create large trust problems after distribution.
References escape the skill
Missing local files, package-escaping references, and unsafe symlinks can make a skill unreliable or pull review outside the intended boundary.
Risk hides in plain text
Secret-like values, instruction overrides, and broad command patterns deserve a blocking review before a capability reaches users.
Everything in the ZIP
A release system—not another prompt bundle.
You get the scanner, known-good and known-bad examples, and the release artifacts needed to make the same decision locally, in CI, and during human review.
- Dependency-free Python scanner with text and JSON reports
- GitHub Actions example that blocks on errors and uploads the report
- Safe and intentionally unsafe fixtures for acceptance testing
- Machine-readable product manifest with checks, runtime, and exit codes
- Evaluation cases and release checklist for repeatable review
- Commercial license and setup guide for one legal business
From folder to decision
Three steps. One review path.
Scan the package
Run python3 preflight.py /path/to/skill locally with Python 3.9 or newer.
Read the findings
Use the human report for review or --json for CI, archives, and downstream evaluation.
Block or release
Exit 0 means no blocking findings, exit 1 means stop and fix, and exit 2 means the target could not be scanned.
Reproducible product evidence
Download the actual fixture reports before you pay.
These JSON files were produced locally by version 0.2.0 using the exact commands shown below. File paths were shortened from local absolute paths; findings were not edited. The safe fixture exited 0. The unsafe fixture exited 1 with four errors and three warnings.
| Command | Observed result |
|---|---|
python3 preflight.py fixtures/safe-skill --json | Exit 0 · 0 findings |
python3 preflight.py fixtures/unsafe-skill --json | Exit 1 · 4 errors · 3 warnings |
| Scanner source SHA-256 | 8190ac7ec00591bf44d52da13ec57351b6b4b87efeb05c9275ba25af3b863c94 |
{
"findings": [
{"severity": "error", "code": "placeholder"},
{"severity": "error", "code": "instruction-override"},
{"severity": "error", "code": "broad-delete"},
{"severity": "warning", "code": "missing-license"}
]
}Excerpt only. Use the report links for the complete, normalized outputs. Results are deterministic heuristics, not a security certification.
UNSAFE REPORT SHA-256
19ad968c4aa4e0666ed4638c3bda920ea7eb8d68adbc7241e62a83cc224bac66
SAFE REPORT SHA-256
ac7d78435d2a73cabb8c176e0d6659ed2930c9fbd691b336bc40c606258dc3a1
19ad968c4aa4e0666ed4638c3bda920ea7eb8d68adbc7241e62a83cc224bac66
SAFE REPORT SHA-256
ac7d78435d2a73cabb8c176e0d6659ed2930c9fbd691b336bc40c606258dc3a1
Know whether it fits
Built for people accountable for an agent-skill release.
This is for you if…
- You publish or review SKILL.md-based capabilities.
- You want local, inspectable checks instead of a hosted black box.
- You need the same acceptance path on a laptop and in CI.
- You value fixtures and documented limits over vague “AI safety” claims.
Skip it if…
- You need runtime monitoring, sandboxing, or malware analysis.
- You expect certification, compliance approval, or guaranteed platform acceptance.
- You cannot run Python 3.9 or newer.
- You want to redistribute the scanner as part of your own commercial product.
What happens after purchase
Pay once. Check your inbox. Start preflighting.
After Stripe confirms the $99 payment, Fireproof Studio automatically emails the ZIP to the address used at checkout. Delivery normally arrives within a few minutes. Unzip it, run the safe and unsafe fixtures, then point the same command at your own skill. If the message is missing after 15 minutes, check spam or email hello@fireproof.studio so we can verify delivery.
Questions before checkout
What buyers usually need to know.
What exactly gets delivered?
A ZIP containing the Python scanner, GitHub Actions workflow example, safe and unsafe fixtures, evaluation cases, product manifest, release checklist, README, and commercial license. Fireproof Studio automatically emails it to the Stripe checkout address after payment is confirmed.
Does the scanner upload my skill?
No. The included scanner runs locally and has no third-party Python dependencies. You choose whether to use the CI example in your own repository.
What does it check?
Checks include required SKILL.md and metadata, naming consistency, thin descriptions, unresolved placeholders, secret-like patterns, unsafe instruction and command patterns, missing or escaping Markdown references, package-escaping symlinks, oversized text files, and license presence.
Does a passing scan mean a skill is secure?
No. A pass means the deterministic checks found no blocking issue they recognize. It is not a security certification and cannot prove instruction intent, runtime safety, compliance, or platform acceptance.
Can I use it across my company?
Yes, within one purchasing legal entity for its internal work and authorized skill reviews. The kit itself cannot be resold, sublicensed, published, or shared outside that entity.
What support and refund coverage are included?
File-access and setup support is included for 30 days. Refund requests are reviewed within 14 days when the delivered files are inaccessible, materially incomplete, or technically unusable. Mandatory consumer rights are not excluded.
Before the next release
Give the package a repeatable preflight.
Scan locally, preserve machine-readable findings, and make the release decision from evidence instead of a quick visual pass.
Get Agent Skill Preflight Kit — $99