Validate Skills
When working on .md command or skill files that contain fenced bash/shell code blocks, suggest running /validate-skills to catch issues before they ship.
What It Catches
- Syntax errors: Unclosed quotes, mismatched if/fi, invalid redirections (
bash -n) - Shell pitfalls: Unquoted variables, deprecated syntax, SC2015
A && B || C(shellcheck) - Portability issues: macOS vs Linux differences (
mktemptemplates,sed -i,grep -P,readlink -f,dateflags) - Unsafe commands: RED-tier commands (
rm,sudo,eval, pipe-to-shell) flagged as warnings - Template variable handling: Blocks with unresolvable plugin variables (
$CLAUDE_PLUGIN_ROOT,$ARGUMENTS,$MODEL) are skipped for execution but still syntax-checked - Execution failures: GREEN-tier read-only commands that fail at runtime (broken
jqfilters, invalidgreppatterns,mktemptemplate errors)
Common Pitfalls in Plugin Markdown
macOS vs Linux
mktemp /tmp/foo.XXXXXX.md— template characters must be at end on macOS, usemktemp /tmp/foo-XXXXXX+ renamesed -i '' 's/old/new/' file(macOS) vssed -i 's/old/new/' file(Linux) — usesed -i.bakfor portabilitygrep -Pnot available on macOS — usegrep -Einsteadreadlink -fnot available on macOS — userealpathorcd ... && pwddate -d(Linux) vsdate -j -f(macOS)
Shell Safety
A && B || Cis NOT if/else — if B fails, C still runs (ShellCheck SC2015)- Unquoted
$VARsplits on whitespace and expands globs — always quote:"$VAR" [ -z $VAR ]fails if VAR is empty — use[ -z "$VAR" ]
External Tool Output
- Never assume tool output is pure JSON — check for banners, headers, progress bars
curlmay return HTML error pages on failure — check HTTP status codesghCLI output format changes between versions — prefer--json+--jq
Usage
/validate-skills # Validate all plugin .md files
/validate-skills plugins/go-dev/commands/ # Validate a directory
/validate-skills path/to/command.md # Validate a specific file
/validate-skills --json # Output structured JSON