Stylelint Config Validator

Validate Stylelint config files for errors, deprecated rules, config structure, plugins, extends, and overrides, outputting text or JSON results.

Security Scan

The skill appears to do what it says — a standalone Python script that validates Stylelint config files and requires no credentials or installs — with a minor mismatch in claimed vs implemented supported config types and no signs of exfiltration or unexpected privileges.

Purpose & Capability

Name/description align with the included script and SKILL.md: the tool validates Stylelint configs and reports deprecated/unknown rules. Minor inconsistency: SKILL.md and the top-level docstring claim support for stylelint.config.js, but the visible loader only parses JSON/YAML/plain files (no JS parsing shown). This is a documentation/feature mismatch rather than an obvious malicious discrepancy.

Instruction Scope

Runtime instructions only tell the agent to run the included Python script against a Stylelint config path and to produce text/json/summary output. The SKILL.md does not instruct reading unrelated files, contacting external endpoints, or accessing environment variables beyond normal execution.

Install Mechanism

No install spec; the skill bundles a Python script and expects Python 3.8+ on the host. Nothing is downloaded or written by an installer, which keeps installation risk low.

Credentials

The skill requests no environment variables, no credentials, and no config paths. The script reads only the config file(s) you pass to it — appropriate for a lint/validator tool.

Persistence & Privilege

The skill does not request persistent presence (always:false) and does not appear to modify other skills or system-wide settings. Model invocation is allowed (default) but that is normal for skills and not concerning given the limited scope.

Assessment

This bundle appears coherent and low-risk: it contains a Python script that reads and validates Stylelint config files and requires no credentials or network access. Before installing or running it, consider: (1) inspect the full script to confirm there are no subprocess calls, network requests, or environment-variable accesses (the visible portion shows none); (2) note the documented support for stylelint.config.js may be inaccurate — if you need JS-config support, verify the script handles it or avoid relying on that claim; (3) run it locally or in a CI sandbox on non-sensitive sample configs first; and (4) ensure you have Python 3.8+ available. If you want higher assurance, provide the remainder of the script for review so we can confirm there are no hidden behaviors.

Validate Stylelint configuration files for correctness, deprecated rules, and best practices.

What it does

Checks .stylelintrc / .stylelintrc.json / .stylelintrc.yaml for:

• Rules — unknown rules, deprecated rules (70+ deprecated in Stylelint 16), null values, many disabled rules
• Config structure — unknown config keys, extends/plugins arrays, override validation
• Deprecated rules — blacklist→disallowed-list renames, removed formatting rules (use Prettier instead)
• Extends — duplicate entries, prettier config ordering (must be last)
• Plugins — duplicates, plugin-prefixed rules without declared plugins
• Overrides — missing files property, deprecated rules in overrides

Rules (20+)

Category	Rules	Examples
Config structure (4)	Unknown keys, invalid types, no rules or extends, invalid defaultSeverity	customConfig: true → unknown key
Rules validation (5)	Deprecated rules (70+), unknown rules, null values, disabled rule ratio	indentation: 2 → deprecated in v16
Extends (3)	Duplicate entries, non-array type, prettier ordering	prettier before standard → wrong order
Plugins (3)	Duplicate plugins, non-array type, plugin rules without plugins	scss/no-dollar-variables without plugin
Overrides (3)	Non-array type, missing files, deprecated rules in overrides	Override without files property
Ignore files (1)	Catch-all patterns	ignoreFiles: "*" matches everything

Output formats

• text — human-readable with severity icons (❌ ⚠️ ℹ️)
• json — structured with summary counts
• summary — one-line PASS/WARN/FAIL

Exit codes

• 0 — no errors
• 1 — errors found (or --strict with any issue)
• 2 — file not found or parse error

Commands

lint / validate

Full config validation.

python3 scripts/stylelint_validator.py lint .stylelintrc.json
python3 scripts/stylelint_validator.py validate --format json .stylelintrc

rules

Check rules only (deprecated, unknown, conflicts).

python3 scripts/stylelint_validator.py rules .stylelintrc.json

deprecated

List only deprecated rules in the config.

python3 scripts/stylelint_validator.py deprecated .stylelintrc.json

Options

Option	Values	Default	Description
--format	text, json, summary	text	Output format
--min-severity	error, warning, info	info	Filter by minimum severity
--strict	flag	off	Exit 1 on any issue

Requirements

• Python 3.8+
• No external dependencies (pure stdlib)

Examples

# Quick check
python3 scripts/stylelint_validator.py lint .stylelintrc.json

# CI pipeline
python3 scripts/stylelint_validator.py lint --strict --format summary .stylelintrc

# Find deprecated rules to upgrade
python3 scripts/stylelint_validator.py deprecated .stylelintrc.json

# JSON output for tooling
python3 scripts/stylelint_validator.py validate --format json .stylelintrc.yaml