validate-plugin
Runs this repository's full validation suite for the kernel-development-skills plugin (Claude and Codex validators, script compile and help checks, version consistency, description limits, and genericity and style greps). Use before calling any packaging, manifest, SKILL.md, reference, or script ...
Install this skill
or
82/100
Security score
The validate-plugin skill was audited on Oct 11, 2026 and we found 4 security issues across 2 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
high line 17
Destructive rm -rf command
SourceSKILL.md
| 15 | [ -f $V/skill-creator/scripts/quick_validate.py ] && { python3 $V/skill-creator/scripts/quick_validate.py $S; echo "exit=$?"; } |
| 16 | [ -f $V/plugin-creator/scripts/validate_plugin.py ] && { python3 $V/plugin-creator/scripts/validate_plugin.py $P; echo "exit=$?"; } |
| 17 | python3 -m py_compile $S/scripts/*.py; echo "py_compile exit=$?"; rm -rf $S/scripts/__pycache__ |
| 18 | for s in $S/scripts/*.py; do python3 $s --help >/dev/null; echo "$(basename $s) --help exit=$?"; done |
| 19 | command -v ruff >/dev/null && { ruff check --no-cache $S/scripts; echo "ruff exit=$?"; } |
low line 18
Command substitution pattern
SourceSKILL.md
| 16 | [ -f $V/plugin-creator/scripts/validate_plugin.py ] && { python3 $V/plugin-creator/scripts/validate_plugin.py $P; echo "exit=$?"; } |
| 17 | python3 -m py_compile $S/scripts/*.py; echo "py_compile exit=$?"; rm -rf $S/scripts/__pycache__ |
| 18 | for s in $S/scripts/*.py; do python3 $s --help >/dev/null; echo "$(basename $s) --help exit=$?"; done |
| 19 | command -v ruff >/dev/null && { ruff check --no-cache $S/scripts; echo "ruff exit=$?"; } |
| 20 | for f in $(git ls-files -co --exclude-standard '*.json'); do jq empty "$f" || echo "INVALID JSON: $f"; done |
low line 20
Command substitution pattern
SourceSKILL.md
| 18 | for s in $S/scripts/*.py; do python3 $s --help >/dev/null; echo "$(basename $s) --help exit=$?"; done |
| 19 | command -v ruff >/dev/null && { ruff check --no-cache $S/scripts; echo "ruff exit=$?"; } |
| 20 | for f in $(git ls-files -co --exclude-standard '*.json'); do jq empty "$f" || echo "INVALID JSON: $f"; done |
| 21 | gh skill publish --dry-run; echo "gh skill exit=$?" |
| 22 | ``` |
low line 14
Access to home directory dotfiles
SourceSKILL.md
| 12 | claude plugin validate $P; echo "exit=$?" |
| 13 | claude plugin validate .; echo "exit=$?" |
| 14 | V=~/.codex/skills/.system |
| 15 | [ -f $V/skill-creator/scripts/quick_validate.py ] && { python3 $V/skill-creator/scripts/quick_validate.py $S; echo "exit=$?"; } |
| 16 | [ -f $V/plugin-creator/scripts/validate_plugin.py ] && { python3 $V/plugin-creator/scripts/validate_plugin.py $P; echo "exit=$?"; } |
Scanned on Oct 11, 2026
View Security Dashboard