# Policy As Code Linter

> Vendor-neutral skill for linting simple policy-as-code rules (YAML) for style, safety, and completeness.

- Skill: `sisodiabhumca/policy-as-code-linter` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add sisodiabhumca/policy-as-code-linter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sisodiabhumca/policy-as-code-linter/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: sisodiabhumca (https://skillmd.com/u/sisodiabhumca)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sisodiabhumca/policy-as-code-linter

---


## When to invoke
- Your org stores lightweight access/control policies as code (e.g., allow/deny rules).
- You want a quick lint pass to catch missing fields, invalid enums, overly-broad principals, or risky wildcards.
- You need vendor-neutral checks before deploying to any policy engine.

## Inputs needed
- Path to a YAML policy file containing a list of rules.
- (Optional) Output path for a JSON report.

## Workflow
1. Load YAML and validate top-level shape (list of rules).
2. For each rule, validate required fields:
   - `id`, `effect` (allow|deny), `actions` (list), `resources` (list)
3. Run safety checks:
   - flag wildcard principals (`*`, `all`, `everyone`)
   - flag wildcard actions/resources (`*`) especially in allow rules
   - detect duplicate rule IDs
4. Run style checks:
   - enforce kebab-case IDs
   - recommend `description` field
5. Emit findings with severity levels.

## Output format
- JSON report:
  - `errors`: blocking issues
  - `warnings`: risky patterns
  - `info`: non-blocking recommendations
  - `summary`: counts
- Human-readable table to stdout.

## Guardrails
- Do not claim policy correctness for any specific cloud/IAM provider.
- Treat output as guidance; human review required for security-sensitive decisions.

## Reference code
- `policy_as_code_linter.py`