diff --git a/.github/workflows/_checks.yml b/.github/workflows/_checks.yml
index a3100cf8..18cb1f96 100644
--- a/.github/workflows/_checks.yml
+++ b/.github/workflows/_checks.yml
@@ -65,14 +65,44 @@ jobs:
       - name: Build site
         run: npm run build
 
+      # `skill-validator check` takes exactly one path and exits 3 (usage error)
+      # when handed more, so every path is checked in its own invocation. Exit
+      # codes: 0 clean, 1 errors, 2 warnings, 3 usage error. The aggregate takes
+      # an error over any other code and any other code over a warning, so a
+      # warning on one skill can never hide a skill that was not validated.
+      # Anything other than 0 or 2 fails the job below.
       - name: Run skill-validator checks
         id: skill-validator
         if: steps.changed.outputs.found == 'true'
         run: |
           set +e
-          # TODO: re-enable link checks once https://github.com/agent-ecosystem/skill-validator/issues/45 is resolved
-          report=$(skill-validator check ${{ steps.changed.outputs.paths }} --skip links -o markdown 2>/dev/null)
-          exit_code=$?
+          report=""
+          had_error=0
+          had_warning=0
+          had_other=0
+          for path in ${{ steps.changed.outputs.paths }}; do
+            # TODO: re-enable link checks once https://github.com/agent-ecosystem/skill-validator/issues/45 is resolved
+            out=$(skill-validator check "$path" --skip links -o markdown 2>/dev/null)
+            code=$?
+            report="${report}${out}"$'\n'
+            case "$code" in
+              0) ;;
+              1) had_error=1 ;;
+              2) had_warning=1 ;;
+              *) had_other=$code ;;
+            esac
+            # Re-run with annotations sent to stdout/stderr for GitHub to process
+            skill-validator check "$path" --skip links --emit-annotations > /dev/null
+          done
+          if [ "$had_error" -ne 0 ]; then
+            exit_code=1
+          elif [ "$had_other" -ne 0 ]; then
+            exit_code=$had_other
+          elif [ "$had_warning" -ne 0 ]; then
+            exit_code=2
+          else
+            exit_code=0
+          fi
           echo "$report" >> "$GITHUB_STEP_SUMMARY"
           delimiter=$(openssl rand -hex 8)
           {
@@ -81,8 +111,6 @@ jobs:
             echo "${delimiter}"
           } >> "$GITHUB_OUTPUT"
           echo "exit_code=$exit_code" >> "$GITHUB_OUTPUT"
-          # Re-run with annotations sent to stdout/stderr for GitHub to process
-          skill-validator check ${{ steps.changed.outputs.paths }} --skip links --emit-annotations > /dev/null
           exit 0
 
       - name: Run project-specific checks
@@ -132,8 +160,13 @@ jobs:
 
             No skill files were changed in this PR — validation skipped.
 
+      # Warnings (skill-validator exit 2) are acceptable; everything non-zero
+      # beyond that fails, so a usage error can never read as a pass.
       - name: Fail on validation errors
-        if: steps.changed.outputs.found == 'true' && (steps.skill-validator.outputs.exit_code == '1' || steps.check-project.outputs.exit_code == '1')
+        if: |
+          steps.changed.outputs.found == 'true'
+          && ((steps.skill-validator.outputs.exit_code != '0' && steps.skill-validator.outputs.exit_code != '2')
+          || steps.check-project.outputs.exit_code != '0')
         run: |
           echo "::error::Validation found errors"
           exit 1
diff --git a/skills/internet-identity/SKILL.md b/skills/internet-identity/SKILL.md
index 1f7a3713..9a469a64 100644
--- a/skills/internet-identity/SKILL.md
+++ b/skills/internet-identity/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: internet-identity
-description: "Add Internet Identity sign-in to a frontend or canister: passkey and OpenID (Google, Apple, Microsoft) sign-in with @icp-sdk/auth, sending users to an organization's SSO with ssoDomain, the client lifecycle, and local development. It also covers the primary origin an app's principals are permanently tied to: electing it, setting derivationOrigin, the ii-alternative-origins and ii-derivation-origin documents, and the ii-app-metadata document that names the app on the sign-in screen. Use when adding sign-in, login, auth, passkeys or Internet Identity to an app, when an app gains a custom domain or a sibling app, or when the same user arrives as a different principal on two origins. For a verified email or name in the backend use internet-identity-attributes; for web push use internet-identity-notifications; to set up an organization's own SSO use internet-identity-sso. Do NOT use for wallet integration or ICRC signer flows (use wallet-integration) or for an agent or CLI signing in as a user (use agent-web-identity)."
+description: "Add Internet Identity sign-in to a frontend or canister: passkey and OpenID (Google, Apple, Microsoft) sign-in with @icp-sdk/auth, sending users to an organization's SSO with ssoDomain, the client lifecycle, and local development. Also covers the primary origin an app's principals are permanently tied to: electing it, setting derivationOrigin, the ii-alternative-origins and ii-derivation-origin documents, and the ii-app-metadata document that names the app on the sign-in screen. Use when adding sign-in, login, auth, passkeys or Internet Identity to an app, when an app gains a custom domain or a sibling app, or when the same user arrives as a different principal on two origins. For a verified email or name in the backend use internet-identity-attributes; for web push use internet-identity-notifications; to set up an organization's own SSO use internet-identity-sso. Do NOT use for wallet or ICRC signer flows (use wallet-integration) or for an agent or CLI signing in as a user (use agent-web-identity)."
 license: Apache-2.0
 compatibility: "icp-cli >= 0.2.4, Node.js >= 22"
 metadata: