dvy1987/validate-skills
.agents/skills/validate-skills/SKILL.md
Run a fast, read-only health check across all skills in the library and produce a structured quality report — without modifying anything. Load when the user asks to validate skills, check skill health, audit the library, run a skill quality check, or when improve-skills needs a pre-flight before starting its cycle. Also triggers on "what's wrong with my skills", "check all skills", "skill health report", "are my skills ok", or "pre-flight check". Called automatically by improve-skills before any improvement work begins, and by universal-skill-creator after every new skill is created. Never modifies any file — only reads and reports.
$ install --global
skillsauthnpx skillsauth add dvy1987/agent-loom validate-skillsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 10:32 PM33.9s2 files scanned
SKILL.md
- name:
- validate-skills
- description:
- >
- license:
- MIT
- author:
- dvy1987
- version:
- 1.0
- category:
- meta
Validate Skills
You are a skill library quality inspector. You read every skill in the repo, score it, flag issues, and produce a structured report — without changing a single file. Your report tells the user or calling skill exactly what needs attention and in what priority order.
Hard Rules
Read-only. Never write, edit, move, or delete any file. If called by improve-skills, hand the report back — do not start fixing things yourself.
Be specific. Every flagged issue must name the exact skill, the exact line or section, and the exact problem. "Description is weak" is not acceptable. "brainstorming: description missing trigger phrase for 'explore options'" is.
Workflow
Step 1 — Discover All Skills
ls .agents/skills/
wc -l .agents/skills/*/SKILL.md
Build the full skill list with line counts.
Step 2 — Run agentskills validate on Every Skill
for d in .agents/skills/*/; do agentskills validate "$d"; done
Any skill that fails validation is a P0 — it must be fixed before anything else.
Step 3 — Score Each Skill (7 criteria, 0–2 each)
For each skill, score against the rubric (full details in references/validation-rubric.md):
| Criterion | Check | |-----------|-------| | Routing | Description has rich trigger phrases, action verbs, synonyms | | Role definition | Specific expert title + narrow domain in first paragraph | | Workflow | Numbered steps, imperative one-liners, one action each | | Gotchas | Non-obvious domain facts the agent needs — not generic advice | | Output format | Schema or template, not prose description | | Examples | Realistic input, complete non-truncated output, ≥1 present | | Token efficiency | Body ≤200 lines, no visible background/rationale bloat |
Step 4 — Flag Structural Issues
These flags feed directly into improve-skills Step 2b — every flag is a concrete fix, not just an observation.
Check every skill for:
- Over limit: SKILL.md > 200 lines → flag with exact count (fix: split-skill or compress-skill)
- Missing category:
metadata.categorynot set tometa,project-specific, ordomain(fix: add field, seedocs/SKILL-INDEX.md) - Missing Impact Report: no
## Impact Reportsection at end of SKILL.md (fix: add section specific to what the skill produces) - Missing file-output logging: skill generates project files but no
docs/skill-outputs/SKILL-OUTPUTS.mdappend instruction (fix: add logging + terminal notification) - Stale version:
metadata.versionunchanged after known edits (fix: bump version) - Missing Prune Log: skill has no prune record (fix: invoke prune-skill)
- Broken caller reference: skill references a skill that doesn't exist in
.agents/skills/(fix: remove or update reference) - Orphaned reference file: file in
references/not mentioned in SKILL.md (fix: add specific load trigger or delete file) - Missing load trigger:
references/file mentioned without a specific condition (fix: add explicit trigger) - Duplicate triggers: two skills with significantly overlapping descriptions (fix: link check in improve-skills Step 2d)
- Unscanned external content: skill references external repos or URLs but does not route through
secure-skill(fix: add security gate) - Missing security contract: pipeline skill (split/prune/publish/deprecate/compress) lacks active
secure-*invocation (fix: add mandatory gate) - Security skill compression: any
secure-*skill routed through compressor instead of split-skill (fix: always split at 180, never compress)
Step 4b — Run Security Sweep
Invoke ALL secure-* skills (discover via ls .agents/skills/secure-*) in Mode C (full library sweep). Every skill's SKILL.md + references/ + scripts/ is scanned. Report security findings alongside quality findings. This step is mandatory — validation without security is incomplete.
Step 5 — Check Call Graph Integrity
Verify every skill referenced in AGENTS.md Skill Relationships actually exists:
ls .agents/skills/
Flag any skill named in the call graph that has no directory.
Step 6 — Produce the Report
Skill Library Health Report
============================
Generated: YYYY-MM-DD
Skills checked: N
VALIDATION STATUS
─────────────────
✓ [skill]: passes agentskills validate
✗ [skill]: FAILS — [specific error]
SIZE CHECK
──────────
✓ [skill]: 147 lines
⚠ [skill]: 203 lines — 3 over limit
QUALITY SCORES
──────────────
[skill]: 13/14 — [one-line summary of weak criterion]
[skill]: 9/14 — [one-line summary: top 2 issues]
[skill]: 5/14 — CRITICAL: consider deprecate-skill or full rewrite
STRUCTURAL ISSUES
─────────────────
[skill]: references/examples.md has no load trigger in SKILL.md
[skill]: calls research-skill but research-skill not found in .agents/skills/
DUPLICATE TRIGGER RISK
──────────────────────
[skill-A] + [skill-B]: overlapping description phrases — [specific phrases]
RECOMMENDED ACTIONS (priority order)
──────────────────────────────────────
P0 [skill]: fails agentskills validate — fix before anything else
P1 [skill]: 203 lines — invoke split-skill or compress-skill
P2 [skill]: score 9/14 — invoke improve-skills
P3 [skill]: no prune log — invoke prune-skill
Gotchas
- Run
agentskills validateon the directory, not the file —agentskills validate .agents/skills/brainstorming/not.agents/skills/brainstorming/SKILL.md - Duplicate trigger detection requires reading descriptions carefully — it is a judgment call, not a string match. Two skills with "write" in the description are not necessarily duplicates.
- A score of 5/14 or below warrants a note suggesting
deprecate-skillas an option, not a requirement — the user decides.
Example
<examples> <example> <input>validate all skills</input> <output> Skill Library Health Report ============================ Generated: 2026-04-05 Skills checked: 8VALIDATION STATUS ✓ brainstorming, improve-skills, prd-writing, prune-skill ✓ research-skill, compress-skill, split-skill, universal-skill-creator
SIZE CHECK ✓ All skills under 200 lines
QUALITY SCORES brainstorming: 13/14 — examples: output slightly truncated prd-writing: 12/14 — gotchas: only 1, domain has 3+ known failure modes universal-skill-creator: 12/14 — routing: missing "skill engineer" trigger phrase improve-skills: 14/14 ✓ prune-skill: 14/14 ✓
STRUCTURAL ISSUES None found.
RECOMMENDED ACTIONS P2 brainstorming: complete the truncated example output P2 prd-writing: add 2 gotchas (discovery skipped for "simple" requests; vague metrics) P3 universal-skill-creator: add "skill engineer" to description trigger phrases </output> </example> </examples>
Reference Files
references/validation-rubric.md: Full 0/1/2 scoring guide for all 7 criteria with examples. Read when a score is ambiguous.
Impact Report
After completing, always deliver the full health report (Step 6 format) and then summarise:
Validation complete: YYYY-MM-DD
Skills checked: N
P0 failures: N (agentskills validate failed)
Over 200 lines: N
Average quality score: X/14
Recommended actions: N (P0: N, P1: N, P2: N, P3: N)
No files were modified.
Related Skills
dvy1987/universal-skill-creator
tools
VerifiedTrustedCommunity
Design, build, validate, and ship production-grade agent skills that work across OpenAI Codex, Ampcode, Factory.ai Droids, Google Gemini, Warp, Bolt.new, Replit, GitHub Copilot, Claude Code, VS Code, Cursor, and any agentskills.io compliant platform. Load when the user asks to create a skill, build a custom skill, write a SKILL.md, package instructions as a reusable agent capability, convert a workflow into a skill, improve or audit an existing SKILL.md, generate a meta-skill, make a cross-platform skill, turn a repeated task into automation, or design agent skills that target multiple AI coding tools simultaneously. Also load for skill stacking, skill scoping, skill discovery, parameterized skills, skill publishing to GitHub or skills.sh, or when the user says skill creator, skill architect, or skill engineer.
2SKILL.mdUpdated Apr 16, 2026
dvy1987/tool-finder
tools
VerifiedTrustedCommunity
Identify the right tool for a process step. Load when a user or skill needs to check tool availability, confirm CLI compatibility, or determine if an MCP server is needed. Triggers on "what tool", "do I need an MCP", "is [tool] available", "which tool handles", "tool lookup", "check tool availability", "find a tool for". Called by process-decomposer and agent-builder when assigning tools to steps.
2SKILL.mdUpdated Apr 16, 2026
dvy1987/test-driven-development
development
VerifiedTrustedCommunity
Apply the Red-Green-Refactor cycle to software development. Load when the user asks to write code using TDD, create unit tests, implement a feature with test coverage, refactor code, or ensure software quality through automated testing. Also triggers on "test-driven development", "write tests first", "TDD this feature", "Red-Green-Refactor", "ensure 100% test coverage", or any request to build software with a test-first approach. Supports unit, integration, and end-to-end testing strategies.
2SKILL.mdUpdated Apr 16, 2026
dvy1987/technical-debt-audit
development
VerifiedTrustedCommunity
Audit the project's technical health and identify "high-interest" debt. Load when the user asks to check code quality, find TODOs, assess project health, or prepare for a refactoring sprint. Also triggers on "technical debt audit", "where is the code messy", "assess project health", "find my hacks", or "identify tech debt". Essential for maintaining velocity in growing projects.
2SKILL.mdUpdated Apr 16, 2026