808skill Code Quality Gate and Release Check

Problem

A locally working skill can still fail for another user: VERSION.txt, SKILL.md, and CHANGELOG.md may disagree; Python syntax errors may not be caught; secrets may be hardcoded; Chinese paths or filenames may misbehave on Windows; incremental zip packaging may leave stale files. 808skill turns these issues into a pre-release gate and outputs a self-check report.

How It Works

The core is a configurable 17-step static check pipeline:
- py_compile validates Python syntax;
- scans bare except, eval, dangerous commands, and likely secret patterns;
- checks cross-platform paths, encoding, Unix commands, macOS APIs, and Python 3.8+ compatibility;
- compares version files;
- verifies minimal dependencies, smoke tests, and fresh zip structure;
- simulates external import to inspect purity, secrets, and intent boundaries;
- scores TRACE dimensions and search discoverability.

It reads .release-config.json for script paths, test commands, security rules, and evaluation weights. The core engine uses only the Python standard library and runs locally.

Boundaries

It is useful for pre-commit Python skill checks, CI/CD pre-release gates, and publishing self-checks, but it does not replace full runtime tests, real security audits, or business acceptance. Configuration must point to real files; the update check only reports newer versions and does not block the main flow.