Install
$ agentstack add skill-pdugan20-claudelint-validate-skills Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Destructive filesystem operation.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Validate Claude Code Skills
Runs claudelint validate-skills to validate Claude Code skill directories.
Usage
claudelint validate-skills $ARGUMENTS
Options
--path- Custom path to skills directory--skill- Validate specific skill--verbose- Show detailed output--warnings-as-errors- Treat warnings as errors
Examples
Example 1: Skill appears in slash menu but won't execute
User says: "I see my skill /deploy-app in the menu but when I run it, Claude says it can't find it" What happens:
- Checks directory name is
deploy-app/but SKILL.md hasname: deployApp - Shows mismatch: directory uses kebab-case, frontmatter uses camelCase
- Explains skill names must match directory name exactly
- Shows fix: change frontmatter to
name: deploy-app
Result: Skill executes correctly after fixing name mismatch
Example 2: Claude won't use Bash tool even though it's needed
User says: "My skill script.sh needs to run bash commands but Claude says 'Tool Bash not allowed'" What happens:
- Checks SKILL.md frontmatter has
allowed-tools: ["bash", "read"] - Shows tool names are case-sensitive - found lowercase "bash" instead of "Bash"
- Lists all valid tool names with correct capitalization
- Shows fix:
allowed-tools: ["Bash", "Read"]
Result: Claude can now execute bash commands in the skill
Example 3: Skill validation blocks git commit with "dangerous command"
User says: "Pre-commit hook is failing on my cleanup skill with 'dangerous command detected: rm -rf'" What happens:
- Scans cleanup.sh script, finds
rm -rf $TEMP_DIR - Flags it because
$TEMP_DIRcould be empty or/(dangerous) - Suggests safer alternative: validate directory first, use explicit path
- Shows fixed version:
[[ -n "$TEMP_DIR" && "$TEMP_DIR" != "/" ]] && rm -rf "$TEMP_DIR"
Result: Skill now validates paths before deletion, commit succeeds
Command Examples
Validate all skills:
claudelint validate-skills
Validate specific skill:
claudelint validate-skills --skill my-skill
What Gets Validated
Required Fields
namefield must match directory namedescriptionmust be present- Name must be kebab-case (lowercase with hyphens)
- Name must not exceed 64 characters
allowed-tools Validation
- Must be an array
- Warns for unknown tools
- Accepts: Bash, Read, Write, Edit, Grep, Glob, LSP, WebFetch, WebSearch, etc.
Model Validation
- Validates model field if present
- Accepted values: sonnet, opus, haiku
File References
- Checks that referenced files in SKILL.md exist
- Validates relative paths
Directory Organization
- Warns if skill has >10 loose files (suggest subdirectories)
- Warns if directory nesting >3 levels deep
Documentation
- Warns if CHANGELOG.md is missing
- Warns if SKILL.md lacks usage examples (no code blocks)
- Warns if multi-file skill (>3 scripts) lacks README.md
- Warns if skill lacks version field
Best Practices
- Warns if shell scripts lack shebang (#!/bin/bash)
- Warns if scripts have no explanatory comments
- Detects inconsistent naming conventions
Security
- Errors for dangerous commands (rm -rf /, dd, mkfs)
- Warns for eval/exec usage
- Warns for path traversal patterns
Exit Codes
0- No errors or warnings1- Warnings found2- Errors found
For troubleshooting, see [common issues](./references/common-issues.md). For customization, see [configuration](./references/configuration.md).
See Also
- [validate-all](../validate-all/SKILL.md) - Run all validators
- [optimize-cc-md](../optimize-cc-md/SKILL.md) - Optimize CLAUDE.md files
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: pdugan20
- Source: pdugan20/claudelint
- License: MIT
- Homepage: https://www.claudelint.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.