dancing-bear: Skill for Claude Code

.claude/skills/validate-workflow/SKILL.md

validate-workflow is a skill for Claude Code from dancing-bear-show/dancing-bear. It costs 58 tokens per session (1,962 once invoked), scanned A, original, MIT.

A checker for workflow YAML files and the skill documents that describe them. YAML is a text format often used for configuration, and workflows define ordered automation steps.

In plain words
What is it for?
Use it before committing workflow changes, after changing stages or command parameters, or during review of workflow files.
Why use it?
It catches invalid workflow structure, incorrect command examples, and references to stage names that no longer exist.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; positional $N argument.

This is dancing-bear-show/dancing-bear's own configuration. It tells Claude Code how to work on dancing-bear itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything dancing-bear configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is ./bin/workflow lint workflows/code/code-review.yaml.

Reuse

Borrowing it

Nothing to install: this file belongs to dancing-bear-show/dancing-bear. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/dancing-bear-show/dancing-bear/main/.claude/skills/validate-workflow/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/dancing-bear-show/dancing-bear

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for validate-workflow

README.md
[![agentmods](https://agentmods.dev/badge/skills/dancing-bear-show/dancing-bear/validate-workflow/github.svg)](https://agentmods.dev/skills/dancing-bear-show/dancing-bear/validate-workflow)
Your own site
<a href="https://agentmods.dev/skills/dancing-bear-show/dancing-bear/validate-workflow"><img src="https://agentmods.dev/badge/skills/dancing-bear-show/dancing-bear/validate-workflow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for validate-workflow

Your own site · 80×15
<a href="https://agentmods.dev/skills/dancing-bear-show/dancing-bear/validate-workflow"><img src="https://agentmods.dev/badge/skills/dancing-bear-show/dancing-bear/validate-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,962 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00058 $0.01962
Opus 5.5 $0.00023 $0.00785
Sonnet 5.5 $0.00012 $0.00392
Haiku 4.5 $0.00006 $0.00196

Measured yesterday against content hash 525ce6a2c8b4, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

validate-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/validate-workflow/SKILL.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Validate Workflow

Validates workflow YAML files and the skill SKILL.md docs that reference them. Catches stale CLI commands, wrong --params syntax, and stage name drift before they reach CI or confuse agents at runtime.

When to Use

  • Before committing new or modified workflow YAML files
  • After renaming or adding stages (stage references in skills go stale)
  • After adding --params to skill docs (easy to mis-spell trigger param names)
  • User says "validate workflow", "check workflow commands", "lint workflows"
  • As part of a PR review when workflows/ or .claude/skills/ changed

Two Layers of Validation

Layer 1 — Workflow YAML structural + command lint

# Lint one file (structure only, fast)
./bin/workflow lint workflows/code/code-review.yaml

# Lint with CLI command probing (validates ./bin/<cli> <sub> references in stage descriptions)
./bin/workflow lint workflows/code/code-review.yaml --check-commands

# Strict mode — warnings become errors
./bin/workflow lint workflows/code/code-review.yaml --check-commands --strict

# YAML output for programmatic use (this is the default format)
./bin/workflow lint workflows/code/code-review.yaml --check-commands --format yaml

Shared fragments are not runnable standalone — they carry a top-level fragment: true key and must be validated with the dedicated subcommand:

./bin/workflow validate-fragment workflows/shared/expand-coverage.yaml

Layer 2 — Skill doc correctness checks (manual)

Skill docs reference workflow files in two ways the linter cannot check:

  1. ./bin/workflow run <path> --params key=value — param names must match trigger.params in the YAML
  2. Stage name tables — must match stage names in the compiled DAG (including fragment prefixes)

Run these checks manually:

# Extract trigger.params from a workflow
python3 -I -c "
import yaml
d = yaml.safe_load(open('workflows/code/code-review.yaml'))
print('\n'.join((d.get('trigger') or {}).get('params', {})))
"

# List all stage names after fragment expansion (compiled DAG).
# Stage names live under groups[].stages as comma-joined strings — a bare
# `grep name:` would match the workflow name and warning keys instead.
./bin/workflow compile workflows/code/code-review.yaml --format yaml 2>/dev/null | python3 -I -c "
import sys, yaml
d = yaml.safe_load(sys.stdin)
for g in d.get('groups', []):
    for s in str(g.get('stages', '')).split(','):
        if s.strip(): print(s.strip())
"

# Extract --params keys from a skill doc (BSD grep on macOS has no -P; use -oE)
grep -oE '\-\-params [a-z_]+' .claude/skills/code-review/SKILL.md | awk '{print $2}' | sort -u

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 190 lines · 58 tokens per session scan A 525ce6a2c8b4

Subscribe to this mod's changes

validate-workflow is a skill published in the GitHub repository dancing-bear-show/dancing-bear (7 stars, last pushed yesterday), licensed MIT. It adds 58 tokens to every session and 1,962 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-07.

Related

validate-workflow compared with skills from other repositories

validate-workflow next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
validate-workflowdancing-bear-show/dancing-bearSkill7yesterdayMITA58Claude Code
gogolafkfreund/nixos_configSkill32yesterdayGPL-3.0A125Claude Code, Codex
google-workspace-authbobmatnyc/claude-mpmSkill1582mo agononeA22Claude Code
critiquegoogle-gemini/gemini-cliSkill109ktodayApache-2.0A23Gemini CLI
rea-ci-tests-auditmorluto/reaSkill443ktodayMITA47Claude Code, Codex
atmos-hookscloudposse/atmosSkill1.4ktodayApache-2.0A46Claude Code
atmos-modernizationcloudposse/atmosSkill1.4ktodayApache-2.0A36Claude Code