SW-SKL-015: Frontmatter missing or invalid (name, description)
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Low |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI04 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SR-3 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
This rule reads the package's metadata, not its text. It looks for a file named SKILL.md at the root of the skill and reads its frontmatter, the block between two lines of three dashes at the start of the file. It reports one finding when any of these holds: SKILL.md is missing; the frontmatter is missing, not closed, not valid YAML, or not a mapping of keys; the name is absent or does not match lowercase letters, digits and hyphens, starting with a letter or digit and at most 64 characters long; or the description is missing, blank or over 1024 characters.
A name or description may sit at the top level or under a nested metadata mapping. The finding is at the first line of SKILL.md when the file exists and has no line when it does not, and its evidence lists every problem found, separated by semicolons. The related rule on license and version stays quiet when this one reports a missing or unparsable frontmatter, so one fault is not reported twice.
Why it matters
The name and description are what an agent reads to decide whether to load a skill at all, and what a reviewer reads first. A skill without them cannot be listed or searched by name, and an agent may pick it up for the wrong reasons or not at all. The scanner maps this rule to OWASP ASI04, Agentic Supply Chain Vulnerabilities, and to NIST SP 800-53 control SR-3, Supply Chain Controls and Processes, because a package that cannot say what it is cannot be tracked.
This is a low finding: nothing is unsafe in the file itself, but the skill cannot be treated as a well-formed package until it is fixed.
Example
This SKILL.md has a title and an instruction but no frontmatter block at all:
.claude/skills/note-taker/SKILL.md
# Note taker
Write a short note for each meeting.The finding is on the first line, and its evidence says the frontmatter is missing.
How to fix
Add a frontmatter block at the very top of SKILL.md with a name in lowercase letters, digits and hyphens, and a one-sentence description of what the skill does and when to use it. Keep the description under the length limit.
If it is a false positive
A folder of notes that is not a skill, but sits where the scanner finds one, can match. Move it out of the skill folders, or accept the finding with a note that says the folder is not a skill.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.