Protobuf Linter

Lint Protocol Buffer (.proto) files for style, naming conventions, breaking changes, and best practices. Supports proto2 and proto3 syntax with 24 rules acro...

Security Scan

The skill is internally consistent: it contains a local Python linter for .proto files, requires no credentials or external installs, and the runtime instructions match the code's purpose.

Purpose & Capability

Name, description, SKILL.md commands, and the included Python linter script align: all are about linting .proto files. No unrelated binaries, env vars, or services are requested.

Instruction Scope

SKILL.md instructs the agent to run the included python script against specified files or directories and to produce text/json/summary output. That stays within the linter's purpose. Note: the script opens and reads whatever file paths are passed to it (expected for a linter) — a user/agent should only point it at .proto files they intend to lint.

Install Mechanism

No install spec and no external downloads; the linter is shipped as a local Python script. This minimizes supply-chain risk. It requires a Python 3 interpreter on PATH (SKILL.md uses 'python3'), which is expected.

Credentials

The skill declares no required environment variables, credentials, or config paths and the visible code does not reference secrets or external services. This is proportionate for a file linter.

Persistence & Privilege

always is false and the skill does not request system-level persistence or special privileges. Autonomous invocation is allowed (platform default) but that is expected for skills and not by itself a security issue here.

Assessment

This skill appears to be a straightforward, locally-run Python linter for .proto files. Before installing or running it: (1) confirm you trust the skill owner or inspect the full scripts/protobuf_linter.py file yourself (it will read any file path you pass to it); (2) run it in a restricted environment if you are concerned about unintended file reads; (3) ensure you have python3 available; and (4) if you plan to allow autonomous agent use, limit the file paths the agent may pass to the linter to avoid scanning sensitive directories. If you want greater assurance, paste the full script into a sandbox or static analyzer to review any parts not shown here.

Lint .proto files for style violations, naming issues, breaking changes, and best practices.

Commands

# Lint a proto file (all rules)
python3 scripts/protobuf_linter.py lint path/to/file.proto

# Check naming conventions only
python3 scripts/protobuf_linter.py naming path/to/file.proto

# Check for breaking changes between two versions
python3 scripts/protobuf_linter.py breaking path/to/old.proto path/to/new.proto

# Validate syntax and structure
python3 scripts/protobuf_linter.py validate path/to/file.proto

# Lint a directory recursively
python3 scripts/protobuf_linter.py lint path/to/protos/ --recursive

# JSON output
python3 scripts/protobuf_linter.py lint path/to/file.proto --format json

# Summary only
python3 scripts/protobuf_linter.py lint path/to/file.proto --format summary

Rules (24)

Structure (6)

• Missing syntax declaration
• Missing package declaration
• Empty message/enum/service definitions
• Duplicate field numbers
• Reserved field number conflicts
• Import not found (relative path check)

Naming (8)

• Message names must be CamelCase
• Enum names must be CamelCase
• Enum values must be UPPER_SNAKE_CASE
• Enum values must be prefixed with enum name
• Field names must be lower_snake_case
• Service names must be CamelCase
• RPC method names must be CamelCase
• Package names must be lower_snake_case with dots

Compatibility (5)

• Changed field type (breaking)
• Removed field without reserving number (breaking)
• Changed field number (breaking)
• Renamed enum value (breaking)
• Changed RPC request/response type (breaking)

Best Practices (5)

• Use proto3 syntax (proto2 warning)
• Avoid required fields (proto2)
• Use wrapper types for optional semantics
• Comment coverage (messages/services)
• File should match package name

Output Formats

• text (default): Human-readable with colors and severity icons
• json: Machine-readable with file, line, rule, severity, message
• summary: Counts by severity only

Exit Codes

• 0: No issues (or warnings only)
• 1: Errors found
• 2: Invalid input