How do I install the Validate skill?

Run npx skillmds@latest add snapsynapse/validate in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Validate safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Validate?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Validate free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Validate?

snapsynapse (@snapsynapse) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Validate by snapsynapse — Agent Skill

Name: Validate
Rating: 4.2 (5 reviews)
Author: snapsynapse

Validate

Run a focused validation check for a skill bundle. Use when the user asks to validate, verify hashes, check MANIFEST.yaml, confirm files are present, or distinguish a canonical bundle from a derived install or registry copy without opening or closing a full editing session.

snapsynapse 584d934 2.4 KB Updated Sep 10, 2026

File contents

Skill Provenance: Validate

Run the hash and inventory check only. This is a narrow verification command, not the full open-session or close-session protocol.

When to use

Run /skill-provenance:validate when the user wants to know whether the current bundle matches its MANIFEST.yaml, whether files are missing, or whether a copy appears to be canonical or derived.

Protocol

Locate the bundle root. Use the directory containing MANIFEST.yaml. If no manifest exists, report that the bundle is unversioned and suggest /skill-provenance:bootstrap.
Run validate.sh when available. Prefer:
```
./validate.sh
```
If the script is not present, compute SHA-256 hashes for files listed in MANIFEST.yaml and compare them manually.
Report validation results only. Include:
- File count checked
- Missing files
- Hash mismatches
- Explicit hash: null opt-outs
- Structural, unsafe-path, duplicate-path, and symlink errors
- Matching, stale, or malformed validated_against records when present
- Exit code or equivalent pass/fail result
Identify copy type. Use MANIFEST.yaml and local contents to say whether the copy appears to be:
- a canonical source bundle
- a strict-platform install copy
- a registry or .skill package
- incomplete or ambiguous A derived copy is valid if its own manifest describes exactly the files present. Do not treat missing development-only files as corruption unless the copy's manifest lists them.
Do not mutate files. Do not update hashes, bump versions, edit the changelog, create a handoff note, or run the close protocol. If the user asks to fix mismatches, recommend /skill-provenance:close or an explicit validate.sh --update workflow.

Output

Keep the response concise:

Bundle: my-skill 1.2.0
Copy type: canonical source bundle
Files: 7 checked, 0 missing, 0 mismatched, 0 explicit opt-outs
Result: pass

If validation fails, name the specific files and explain that a mismatch means the file no longer matches the recorded manifest state. This is an integrity check, not a trust anchor.

---name: validatedescription: Run a focused validation check for a skill bundle. Use when the user asks to validate, verify hashes, check MANIFEST.yaml, confirm files are present, or distinguish a canonical bundle from a derived install or registry copy without opening or closing a full editing session.license: MIT---# Skill Provenance: ValidateRun the hash and inventory check only. This is a narrow verification command,not the full open-session or close-session protocol.## When to useRun `/skill-provenance:validate` when the user wants to know whether thecurrent bundle matches its `MANIFEST.yaml`, whether files are missing, orwhether a copy appears to be canonical or derived.## Protocol1. **Locate the bundle root.** Use the directory containing `MANIFEST.yaml`. If no manifest exists, report that the bundle is unversioned and suggest `/skill-provenance:bootstrap`.2. **Run `validate.sh` when available.** Prefer: ```bash ./validate.sh ``` If the script is not present, compute SHA-256 hashes for files listed in `MANIFEST.yaml` and compare them manually.3. **Report validation results only.** Include: - File count checked - Missing files - Hash mismatches - Explicit `hash: null` opt-outs - Structural, unsafe-path, duplicate-path, and symlink errors - Matching, stale, or malformed `validated_against` records when present - Exit code or equivalent pass/fail result4. **Identify copy type.** Use `MANIFEST.yaml` and local contents to say whether the copy appears to be: - a canonical source bundle - a strict-platform install copy - a registry or `.skill` package - incomplete or ambiguous A derived copy is valid if its own manifest describes exactly the files present. Do not treat missing development-only files as corruption unless the copy's manifest lists them.5. **Do not mutate files.** Do not update hashes, bump versions, edit the changelog, create a handoff note, or run the close protocol. If the user asks to fix mismatches, recommend `/skill-provenance:close` or an explicit `validate.sh --update` workflow.## OutputKeep the response concise:```textBundle: my-skill 1.2.0Copy type: canonical source bundleFiles: 7 checked, 0 missing, 0 mismatched, 0 explicit opt-outsResult: pass```If validation fails, name the specific files and explain that a mismatchmeans the file no longer matches the recorded manifest state. This is anintegrity check, not a trust anchor.

Frequently asked questions