pdugan20/validate-skills
skills/validate-skills/SKILL.md
Validates Claude Code skills for schema, naming, documentation, and security. Use when user asks to "check my skill", "validate skill syntax", "why isn't my skill loading", "skill errors", or "dangerous command detected". Validates SKILL.md frontmatter, allowed-tools, file references, directory organization, and shell script security.
$ install --global
skillsauthnpx skillsauth add pdugan20/claudelint validate-skillsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 28, 2026, 11:22 AM117.7s5 files scanned
SKILL.md
- name:
- validate-skills
- description:
- Validates Claude Code skills for schema, naming, documentation, and security. Use when user asks to "check my skill", "validate skill syntax", "why isn't my skill loading", "skill errors", or "dangerous command detected". Validates SKILL.md frontmatter, allowed-tools, file references, directory organization, and shell script security.
- version:
- 1.0.0
- argument-hint:
- [flags]
- - Bash(claudelint:
- *)
Validate Claude Code Skills
Runs claudelint validate-skills to validate Claude Code skill directories.
Usage
claudelint validate-skills $ARGUMENTS
Options
--path <path>- Custom path to skills directory--skill <name>- Validate specific skill--verbose- Show detailed output--warnings-as-errors- Treat warnings as errors
Examples
Example 1: Skill appears in slash menu but won't execute
User says: "I see my skill /deploy-app in the menu but when I run it, Claude says it can't find it" What happens:
- Checks directory name is
deploy-app/but SKILL.md hasname: deployApp - Shows mismatch: directory uses kebab-case, frontmatter uses camelCase
- Explains skill names must match directory name exactly
- Shows fix: change frontmatter to
name: deploy-app
Result: Skill executes correctly after fixing name mismatch
Example 2: Claude won't use Bash tool even though it's needed
User says: "My skill script.sh needs to run bash commands but Claude says 'Tool Bash not allowed'" What happens:
- Checks SKILL.md frontmatter has
allowed-tools: ["bash", "read"] - Shows tool names are case-sensitive - found lowercase "bash" instead of "Bash"
- Lists all valid tool names with correct capitalization
- Shows fix:
allowed-tools: ["Bash", "Read"]
Result: Claude can now execute bash commands in the skill
Example 3: Skill validation blocks git commit with "dangerous command"
User says: "Pre-commit hook is failing on my cleanup skill with 'dangerous command detected: rm -rf'" What happens:
- Scans cleanup.sh script, finds
rm -rf $TEMP_DIR - Flags it because
$TEMP_DIRcould be empty or/(dangerous) - Suggests safer alternative: validate directory first, use explicit path
- Shows fixed version:
[[ -n "$TEMP_DIR" && "$TEMP_DIR" != "/" ]] && rm -rf "$TEMP_DIR"
Result: Skill now validates paths before deletion, commit succeeds
Command Examples
Validate all skills:
claudelint validate-skills
Validate specific skill:
claudelint validate-skills --skill my-skill
What Gets Validated
Required Fields
namefield must match directory namedescriptionmust be present- Name must be kebab-case (lowercase with hyphens)
- Name must not exceed 64 characters
allowed-tools Validation
- Must be an array
- Warns for unknown tools
- Accepts: Bash, Read, Write, Edit, Grep, Glob, LSP, WebFetch, WebSearch, etc.
Model Validation
- Validates model field if present
- Accepted values: sonnet, opus, haiku
File References
- Checks that referenced files in SKILL.md exist
- Validates relative paths
Directory Organization
- Warns if skill has >10 loose files (suggest subdirectories)
- Warns if directory nesting >3 levels deep
Documentation
- Warns if CHANGELOG.md is missing
- Warns if SKILL.md lacks usage examples (no code blocks)
- Warns if multi-file skill (>3 scripts) lacks README.md
- Warns if skill lacks version field
Best Practices
- Warns if shell scripts lack shebang (#!/bin/bash)
- Warns if scripts have no explanatory comments
- Detects inconsistent naming conventions
Security
- Errors for dangerous commands (rm -rf /, dd, mkfs)
- Warns for eval/exec usage
- Warns for path traversal patterns
Exit Codes
0- No errors or warnings1- Warnings found2- Errors found
For troubleshooting, see common issues. For customization, see configuration.
See Also
- validate-all - Run all validators
- optimize-cc-md - Optimize CLAUDE.md files
Related Skills
pdugan20/test-skill
testing
VerifiedTrustedCommunity
A valid test skill for testing purposes. Use this when you want to test skill validation.
5SKILL.mdUpdated Apr 28, 2026
pdugan20/no-version-skill
testing
VerifiedTrustedCommunity
This skill is missing the version field for testing purposes.
5SKILL.mdUpdated Apr 28, 2026
pdugan20/dangerous-skill
testing
VerifiedTrustedCommunity
This skill contains dangerous commands for testing security validation.
5SKILL.mdUpdated Apr 28, 2026
pdugan20/validate-settings
development
VerifiedTrustedCommunity
Validates Claude Code settings.json files for schema, permissions, and security. Use when user asks to "check my settings", "validate settings.json", "permission errors", "environment variable issues", or "settings syntax errors". Validates model names, permission rules, hooks configuration, and environment variables.
5SKILL.mdUpdated Apr 28, 2026