Install
$ agentstack add skill-ironlint-ironlint-ironlint-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
IronLint Review
Audit the check set against telemetry. Surface candidates for removal, scope adjustment, or a source fix.
Source of truth
.ironlint/log.jsonl — one record per check invocation, with a per-check breakdown. Each line:
{
"type": "check",
"ts": "2026-06-15T00:00:00Z",
"file": "src/foo.rs",
"status": "block",
"elapsed_ms": 42,
"checks": [
{"check": "no-debug", "status": "block", "elapsed_ms": 30},
{"check": "no-todo", "status": "pass", "elapsed_ms": 12}
]
}
- The top-level
statusis the most severe of the checks that ran (block>
internal_error > pass). There is no warn tier.
checks[]attributes the outcome to each check by id, so you can recommend on
specific checks, not just files. checks is empty when no check matched the file.
- A check with
status: "internal_error"carries areason(timeout, not_found,
…) — it couldn't run, which is a broken check, not a finding.
Process
- Read
.ironlint/log.jsonl. - Aggregate over the last N entries (default last 1000, or all if fewer),
grouping by checks[].check (and cross-referencing file).
- Surface concerning patterns per check:
- High block rate (>50% of the files a check ran on): the check may be too
strict, or the code it covers genuinely needs fixing at the source.
- Zero blocks across many runs: the check may be dead — its
filesscope
never matches anything dirty, or it never fires. Confirm it still earns its keep.
- Recurring
internal_error: the check is broken (read itsreason) — fix
or remove it; a check that can't run protects nothing.
- Slow checks (high
elapsed_ms): flag for optimization or a narrower scope.
Recommendations
For each concerning check, propose ONE of:
- Investigate source: a high block rate may be a real codebase problem to fix
in code, not in the check.
- Tighten the
filesscope: narrow the glob so a noisy check fires only where
it should.
- Remove the check: a check that never blocks (and isn't meant as a tripwire)
is noise in the config.
- Fix a broken check: for recurring
internal_error, repair theruncommand
or the tool it shells out to.
Never apply recommendations silently. Present each one and ask the user. To re-confirm what a check does on a file, run ironlint check --file --check --format json and read the verdict.
Output format
Reviewed N entries from .ironlint/log.jsonl (date range A → B).
Per-check health:
| Check | Runs | pass | block | error | Note / recommendation |
|-----------------|------|------|-------|-------|--------------------------------------------------------|
| no-debug | 31 | 24 | 7 | 0 | High block rate (23%) — investigate src/api or tighten |
| no-todo | 84 | 84 | 0 | 0 | No blocks — confirm it still earns its keep |
| eslint-check | 12 | 9 | 0 | 3 | Broken (reason: not_found) — eslint missing on PATH |
To re-confirm a check on a file:
ironlint check --file --check --format json
Notes
- Records are per check invocation with a per-check breakdown; group by
checks[].check to attribute outcomes to a specific check.
- Statuses are
pass,block, andinternal_error— there is nowarn.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ironlint
- Source: ironlint/ironlint
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.