jmagly/contract-validate
plugins/codex-sdlc/skills/contract-validate/SKILL.md
Validate that an AIWG skill chain has all requires inputs satisfied by upstream ensures outputs. Catches missing dependencies at wiring time, not runtime.
$ install --global
skillsauthnpx skillsauth add jmagly/aiwg contract-validateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 8, 2026, 6:09 AM141.2s1 file scanned
SKILL.md
- namespace:
- aiwg
- platforms:
- [all]
- name:
- contract-validate
- description:
- Validate that an AIWG skill chain has all requires inputs satisfied by upstream ensures outputs. Catches missing dependencies at wiring time, not runtime.
- - "skills:
- ordered list of AIWG skill names or file paths forming the workflow to validate
- - "if workflow-file:
- path to a YAML/JSON workflow definition
- - "external-inputs:
- names of inputs the calling workflow will provide (optional; unmatched requires are flagged as unresolved)
- - "validation-report:
- pass/fail report per skill with specific missing dependency details
- - "verdict:
- VALID (all requires: satisfied), INVALID (unresolved requires: found), or VALID WITH WARNINGS (semantic matches only)
- - "if INVALID:
- specific list of which skill requires which input and which upstream skill should provide it
- - "skill-not-found:
- one or more skill names cannot be resolved to a SKILL.md file
- - "no-contracts:
- none of the specified skills have contract fields — cannot validate
- - "a workflow with any unresolved requires:
- always returns INVALID
- argumentHint:
- <skill1> <skill2> ... | --workflow <file.yaml> [--external input1,input2] [--strict]
- allowedTools:
- Read, Glob, Grep
- model:
- sonnet
- category:
- planning
Contract Validate Skill
Validate a skill chain before running it — check that every requires: input is satisfied by an upstream ensures: output or declared as an external input.
Triggers
- "validate the contract chain for [skill1] → [skill2]"
- "check if this workflow is wired correctly"
- "will [skill] have everything it needs?"
- "pre-flight check the skill chain"
- "validate workflow contracts"
Parameters
Skills list (positional)
Ordered list of skill names to validate as a chain:
/contract-validate issue-planner address-issues
/contract-validate prose-detect prose-run
--workflow <file> (optional)
Path to a YAML workflow definition listing the skill chain.
--external input1,input2 (optional)
Comma-separated names of inputs that will be provided by the calling workflow or user. Any requires: that matches an external input is treated as satisfied.
/contract-validate issue-planner address-issues --external objective,tracker
--strict (optional)
Treat semantic matches as failures (require exact name matches). Default: semantic matches pass with warnings.
Behavior
Step 1: Resolve and Extract Contracts
Same as contract-manifest Step 1–2: resolve each skill, extract contract fields.
Step 2: Validate Each Requires:
For each skill's requires: entry:
- Satisfied by external input (
--externallist) → ✓ SATISFIED (external) - Satisfied by exact match (upstream
ensures:same name) → ✓ SATISFIED - Satisfied by semantic match (upstream
ensures:same meaning, different name) → ⚠️ WARN (semantic) - Not satisfied (nothing provides it) → ❌ UNRESOLVED
Step 3: Determine Verdict
| Condition | Verdict |
|-----------|---------|
| All requires: satisfied (exact or external) | VALID |
| All requires: satisfied but some are semantic matches | VALID WITH WARNINGS |
| Any requires: unresolved | INVALID |
| No contract fields found on any skill | NO CONTRACTS (cannot validate) |
Step 4: Output Report
## Contract Validation Report
**Workflow**: issue-planner → address-issues
**Verdict**: VALID WITH WARNINGS
### Skill: issue-planner
| Requires | Source | Status |
|----------|--------|--------|
| objective | external | ✓ satisfied (external) |
| tracker | external | ✓ satisfied (external) |
### Skill: address-issues
| Requires | Source | Status |
|----------|--------|--------|
| issues | issue-planner.issues-filed | ⚠️ semantic match (name differs — verify intent) |
| tracker | issue-planner.tracker | ✓ satisfied (exact match) |
### Warnings (1)
- `address-issues.requires.issues` satisfied by `issue-planner.ensures.issues-filed` via semantic match.
If these are not equivalent, rename one to match or add an explicit mapping.
### Errors (0)
None
### Recommendation
Workflow is likely correct. Confirm that `issue-planner.issues-filed` and `address-issues.issues` refer to the same thing. If so, rename one for an exact match to eliminate the warning.
Using in CI / Pre-Flight
Before running a multi-skill orchestration, validate the chain:
/contract-validate issue-planner address-issues --external objective tracker
# → VALID — safe to proceed
# → INVALID — check report before running
Relationship to contract-manifest
contract-manifest— generates a full manifest for human inspectioncontract-validate— gives a pass/fail verdict for pre-flight checks
Use contract-manifest to understand a workflow; use contract-validate to gate its execution.
Model
Runs on Sonnet — contract matching is structural analysis, not complex reasoning.
References
- @$AIWG_ROOT/agentic/code/frameworks/sdlc-complete/README.md — SDLC framework context and skill catalog
- @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/vague-discretion.md — Measurable validation verdicts and criteria
- @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Research-first for contract dependency resolution
- @$AIWG_ROOT/docs/extensions/overview.md — Extension system and skill architecture
- @$AIWG_ROOT/docs/cli-reference.md — CLI reference
Related Skills
jmagly/radar-status
data-ai
VerifiedTrustedCommunity
Report which research-corpus radar sidecars are overdue for refresh. Computes staleness (days since last refresh vs the cadence window) for every radar, sorted most-overdue-first. Runs via `aiwg corpus radar-status`.
140SKILL.mdUpdated May 28, 2026
jmagly/radar-report
data-ai
VerifiedTrustedCommunity
Aggregate research-corpus radar sidecars into a corpus or per-cluster freshness report — totals, overdue count, per-cluster / per-GRADE / per-trajectory breakdowns, an overdue table, and per-radar rationale snippets. Runs via `aiwg corpus radar-report`.
140SKILL.mdUpdated May 28, 2026
jmagly/radar-init
testing
VerifiedTrustedCommunity
Scaffold radar/freshness sidecars for research-corpus REFs. Pulls title/authors from the citation sidecar and GRADE from the analysis doc, defaults the refresh cadence from GRADE and the cluster from a corpus-local map, and stamps documentation/radar/REF-XXX-radar.md. Runs via `aiwg corpus radar-init`.
140SKILL.mdUpdated May 28, 2026
jmagly/profile-temporal
data-ai
VerifiedTrustedCommunity
Compute an entity's publication trajectory — per-year paper counts, topic drift, hot-streak detection (≥3 consecutive A-grade years), and career phase. Runs via `aiwg corpus profile-temporal`.
140SKILL.mdUpdated May 28, 2026