skill-lint-gate

Skill Lint Gate

Pure-infrastructure hook-carrier skill. It contributes one git pre-commit hook that runs two checks over the SKILL.md files a commit touches and blocks on either. There is no agent-side decision logic here — the value is delivered entirely through composition.

What it gates

Over STAGED {ai_hats_library,library}/**/SKILL.md (changed-files scope, so the gate never retro-blocks the pre-existing backlog), the hook runs, in order. A consumer's libraries/ is out of scope: this skill ships in the ai-hats-dev layer, which is addressed to the ai-hats repository, not to a consuming project.

1. License/provenance regression-guard (pure bash, always-on, NOT fail-open). Blocks when a skill has no non-empty license: frontmatter, or is declared-derived (sibling metadata.yaml has an upstream: block) but is missing its co-located LICENSE file. Its scope deliberately includes the golang-* pack — that pack is exactly the third-party derived content this guard protects. It exists to keep the licensing backfill from silently regressing.
2. agnix spec-lint (agnix against the repo-root .agnix.toml; target claude-code; rules XML-001 / XP-SK-001 / VER-001 disabled as convention false positives). Excludes the golang-* pack (drift handled separately). Fail-open if agnix/node is absent. agnix non-zero exit blocks the commit.

Who gets it

Whatever composes this skill, and nothing else: the hook is written into .githooks/pre-commit.d/ at composition time, so a role that does not carry it never sees the gate. The server-side counterpart is the CI lint-skills job.

How to bypass

Fix the flagged issue, or — after confirming the skill is intentionally non-conforming — ask the supervisor to skip the gate for a single commit: AI_HATS_SKILL_LINT_ACK=1, exported in the shell that runs the commit. Writing it onto your own command line is refused — see safety-guard.

If agnix / node is not installed, only the agnix check is a loud no-op (fail-open): it prints a SKIPPED notice and allows the commit, so a missing optional dev tool never wedges work. The license/provenance guard is pure bash and always runs. Inside an ai-hats agent node is present, so both checks are live.

Overrides

• AI_HATS_SKILL_LINT_ACK=1 — allow the current commit despite findings.
• AI_HATS_SKILL_LINT_CMD — override the agnix invocation (default npx --yes agnix@0.29.0); used by the test suite to inject a stub.