Skill Validator

Skill Validator is a skill for Codex from daffy0208/ai-dev-standards. It costs 33 tokens per session (2,969 once invoked), scanned A, original, MIT.

A checker that compares a skill or MCP implementation with its manifest—the file that describes what it claims to do and how its interface works.

In plain words
What is it for?
Use it after changing a skill or MCP implementation, during quality audits, or before publishing a new version.
Why use it?
It finds missing behavior, inaccurate claims, and drift between documentation and the actual code before a release.

Skill for Codex

Written for Codex: runs codex exec. Also seen: positional $N argument; mentions Codex.

Good fit Use it after changing a skill or MCP implementation, during quality audits, or before publishing a new version.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/daffy0208/ai-dev-standards/skill-validator
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add daffy0208/ai-dev-standards --skill skill-validator
Clone the repo
git clone --depth 1 https://github.com/daffy0208/ai-dev-standards

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for Skill Validator

README.md
[![agentmods](https://agentmods.dev/badge/skills/daffy0208/ai-dev-standards/skill-validator/github.svg)](https://agentmods.dev/skills/daffy0208/ai-dev-standards/skill-validator)
Your own site
<a href="https://agentmods.dev/skills/daffy0208/ai-dev-standards/skill-validator"><img src="https://agentmods.dev/badge/skills/daffy0208/ai-dev-standards/skill-validator/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for Skill Validator

Your own site · 80×15
<a href="https://agentmods.dev/skills/daffy0208/ai-dev-standards/skill-validator"><img src="https://agentmods.dev/badge/skills/daffy0208/ai-dev-standards/skill-validator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,969 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00033 $0.02969
Opus 5 $0.00016 $0.01484
Sonnet 5 $0.00007 $0.00594
Haiku 4.5 $0.00003 $0.00297

Measured 8d ago against content hash 7447009f55fa, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

Skill Validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (validate.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/skill-validator/SKILL.md · 468 lines

How it starts

The opening of the file, as written. The whole thing — 468 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skill Validator

Validate implementations match manifests using Codex for semantic comparison

Purpose

Ensures that skill/MCP implementations actually deliver what their manifests promise. Uses Codex to perform semantic analysis comparing descriptions, preconditions, and effects against actual code. Detects drift, missing functionality, and over-promised capabilities.

When to Use

  • After updating skill implementations
  • During quality audits to verify accuracy
  • When manifests feel outdated or incorrect
  • To detect description-implementation drift
  • Before releasing new versions of resources

Key Capabilities

  • Semantic Comparison: Uses Codex to understand if code matches description
  • Precondition Validation: Verifies claimed preconditions are actually checked
  • Effect Verification: Confirms code produces claimed effects
  • API Surface Analysis: Validates exposed functions match manifest
  • Drift Detection: Identifies when implementation diverges from manifest
  • Coverage Scoring: Measures how much of manifest is implemented

Inputs

inputs:
  resource_path: string # Path to skill/MCP directory
  manifest_path: string # Path to manifest.yaml (default: resource_path/manifest.yaml)
  implementation_path: string # Path to code (default: resource_path/index.js)
  strict_mode: boolean # Fail on warnings (default: false)

Process

Step 1: Load Manifest and Implementation

#!/bin/bash
# Load manifest and implementation

RESOURCE_PATH="$1"
MANIFEST_PATH="${2:-$RESOURCE_PATH/manifest.yaml}"
IMPL_PATH="${3:-$RESOURCE_PATH/index.js}"

if [ ! -f "$MANIFEST_PATH" ]; then
  echo "❌ Manifest not found: $MANIFEST_PATH"
  exit 1
fi

if [ ! -f "$IMPL_PATH" ]; then
  # Try alternative extensions
  if [ -f "$RESOURCE_PATH/index.ts" ]; then
    IMPL_PATH="$RESOURCE_PATH/index.ts"
  elif [ -f "$RESOURCE_PATH/SKILL.md" ]; then
    # Skill might be declarative only
    IMPL_PATH=""
  else
    echo "⚠️  No implementation file found, validating description only"
    IMPL_PATH=""
  fi
fi

# Read manifest
MANIFEST=$(cat "$MANIFEST_PATH")

# Read implementation (if exists)
if [ -n "$IMPL_PATH" ]; then
  IMPLEMENTATION=$(cat "$IMPL_PATH")
else
  IMPLEMENTATION=""
fi

Read the full file on GitHub · 468 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 468 lines · 33 tokens per session scan A 7447009f55fa

Subscribe to this mod's changes

Skill Validator is a skill published in the GitHub repository daffy0208/ai-dev-standards (36 stars, last pushed 8mo ago), licensed MIT. It adds 33 tokens to every session and 2,969 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

plugin-review

Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.

athola/claude-night-market · 23 tokens

doc-claim-validator

Validate that claims in documentation match codebase reality. Extracts verifiable assertions (file paths, commands, function references, behavioral claims, dependencies) from markdown docs and checks them against the actual project. Use after code changes, before releases, or when docs feel untrustworthy.

NickCrew/Claude-Cortex · 61 tokens

Validation Engine

Checks outputs from other skills for consistency, correctness, and adherence to AGENTS.md rules.

Razaib-khan/ForgeWeave · 20 tokens

sage-review

Deep, platform-neutral code review for PRs and CRs in ONE thorough single pass — design reasoning (Problem Worth Solving & Solution Fit) as one dimension alongside the 9 code-level dimensions, with chain-of-consequences, self-critique, and draft-only comments. The single app-owned source of truth.

kirodotdev/KiroCrew · 68 tokens

audit

Use when the user wants a code review on recent changes — quality, spec, security, or performance feedback. Triggers a multi-level (L1-L5) review with a standalone Reviewer; on NEEDSFIX, offers to apply findings via /hyperflow:plan. Trigger with /hyperflow:audit, "review this change", "review my PR", "audit the diff"…

jeremylongshore/tons-of-skills-marketplace · 84 tokens

stage-coach

Consume CocoSentinel per-stage external coach requests and produce stage quality scores.

Snowflake-Labs/cocoplus · 19 tokens