Biome Config Validator

AdvisoryAudited by Static analysis on May 1, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The tool will read the file path supplied to it for validation.

Why it was flagged

The skill exposes a local CLI command that takes a file path. This is purpose-aligned for validating a Biome config, but users should run it only on intended configuration files.

Skill content
python3 scripts/biome_config_validator.py lint biome.json
Recommendation

Invoke it on the intended biome.json or related config files only.

What this means

Users have less external provenance information for independently verifying the skill origin.

Why it was flagged

The package does not provide an upstream source or homepage, which is a provenance gap. The artifacts do not show remote installs, external dependencies, or hidden helpers.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the included script before use if provenance matters for your environment.

What this means

Using the skill executes local Python code to inspect the selected config file.

Why it was flagged

The skill runs an included Python script. Local script execution is central to the stated validator purpose, and the provided artifacts do not show eval, subprocess execution, downloads, or generated-code execution.

Skill content
#!/usr/bin/env python3
Recommendation

Use it in a normal project workspace and review the script if your policy requires approving local code execution.