What is azure-pipelines-validator?

A checker for Azure DevOps Pipeline YAML files, which define automated software build and deployment jobs.

Use it to check YAML syntax and pipeline structure, review task versions and build settings, and scan scripts or configuration for secrets and unsafe patterns.

It finds formatting and configuration errors, weak pipeline practices, and exposed credentials before the pipeline is used.

azure-pipelines-validator — Skill for Claude Code and Codex by pantheon-org: A checker for Azure DevOps Pipeline YAML files, which…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/pantheon-org/tekhne/validator

Any agent

npx skills add pantheon-org/tekhne --skill validator

Clone the repo

git clone --depth 1 https://github.com/pantheon-org/tekhne

Made for: Claude Code, Codex.

Per session 135 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,066 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00135	$0.02066
Opus 5	$0.00068	$0.01033
Sonnet 5	$0.00027	$0.00413
Haiku 4.5	$0.00014	$0.00207

Measured 3d ago against content hash f9d3c7b7bd34, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

azure-pipelines-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 6 executable files (scripts/check_best_practices.py, scripts/check_security.py, scripts/python_wrapper.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ci-cd/azure-pipelines/validator/SKILL.md · 205 lines

How it starts

The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Azure Pipelines Validator

Validates, lints, and security-scans Azure DevOps Pipeline configurations (azure-pipelines.yml, azure-pipelines.yaml). Runs four validation layers via a single orchestrator script.

Basic Usage

# Full validation (all layers)
bash .claude/skills/azure-pipelines-validator/scripts/validate_azure_pipelines.sh azure-pipelines.yml

Layers executed in order: 0. YAML lint (yamllint) — formatting, indentation, trailing spaces

Syntax validation — schema, required fields, stages/jobs/steps hierarchy, task format, dependencies
Best practices — display names, task version pinning, pool image specificity, caching, timeouts
Security scan — hardcoded secrets/API keys/AWS/Azure credentials, dangerous script patterns, SSL bypasses, container :latest tags

Common Options

# Targeted runs
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --syntax-only
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --best-practices
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --security-only

# Skip layers
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --skip-yaml-lint
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --no-best-practices
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --no-security

# Strict mode (fail on warnings)
bash scripts/validate_azure_pipelines.sh azure-pipelines.yml --strict

Individual Scripts

python3 scripts/validate_syntax.py azure-pipelines.yml
python3 scripts/check_best_practices.py azure-pipelines.yml
python3 scripts/check_security.py azure-pipelines.yml

Output and Error Recovery

════════════════════════════════════════════════════════════════════════════════
  Azure Pipelines Validator
════════════════════════════════════════════════════════════════════════════════

[1/3] Running syntax validation...
✓ Syntax validation passed

[2/3] Running best practices check...
SUGGESTIONS (2):
  INFO: Line 15: Job 'BuildJob' should have displayName [missing-displayname]
  💡 Add 'displayName: "Your Job Description"' to job 'BuildJob'

  WARNING: Line 25: Task 'Npm@1' could benefit from caching [missing-cache]
  💡 Add Cache@2 task to cache dependencies and speed up builds

[3/3] Running security scan...
MEDIUM SEVERITY (1):
  MEDIUM: Line 8: Container 'linux' uses ':latest' tag [container-latest-tag]
  🔒 Pin container images to specific versions or SHA digests

Read the full file on GitHub · 205 lines

Files

What ships with it

34 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 205 lines · 135 tokens per session scan A f9d3c7b7bd34

Subscribe to this mod's changes

azure-pipelines-validator is a skill published in the GitHub repository pantheon-org/tekhne (10 stars, last pushed 8d ago), licensed MIT. It adds 135 tokens to every session and 2,066 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

CI and CD DevOps and cloud agent-skills skills tessl

comet-github-ci-triage

使用 PR 当前准确 head、失败 job 日志、本地复现边界和可合并状态，诊断 Comet PR 的 GitHub Actions 与覆盖率检查。PR 出现 CI 报错、Codecov 问题、过期检查或无法解释的红色 job 时使用。.

rpamis/comet · 72 tokens

review-tooling

Detect what dev tooling infrastructure a project has and flag gaps across linters, formatters, pre-commit hooks, test runners, and CI/CD pipelines. Returns structured findings without applying changes. Use when the user asks to "review tooling", "check project tooling", "what tooling is missing", "review dev…

tobihagemann/turbo · 74 tokens

aws-cloudformation-task-ecs-deploy-gh

Provides patterns to deploy ECS tasks and services with GitHub Actions CI/CD. Use when building Docker images, pushing to ECR, updating ECS task definitions, deploying ECS services, integrating with CloudFormation stacks, configuring AWS OIDC authentication for GitHub Actions, and implementing production-ready…

giuseppe-trisciuoglio/developer-kit · 106 tokens

devops-pipeline

Configure pre-commit hooks and lean GitHub Actions for shift-left quality assurance. Use when adding or auditing CI/CD to maximize local test coverage and minimize CI cost. Skip for Terraform/K8s, deployment pipelines, or non-GitHub CI providers.

luongnv89/skills · 56 tokens

pentest-supply-chain

Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification.

jd-opensource/JoySafeter · 28 tokens

offensive-supply-chain

Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private…

SnailSploit/Claude-Red · 246 tokens