Use this skill when the user asks to "validate template", "check template structure", "is my template correct", "verify template conventions", "validate project template", "check template files", or needs to verify that a project template follows the Level 0/1/1.5/2 conventions and has all required files.
Use this skill when the user asks to "validate template", "check template structure", "is my template correct", "verify template conventions", "validate project template", "check template files", or needs to verify that a project template follows the Level 0/1/1.5/2 conventions and has all required files.
disable-model-invocation
true
Validate Project Template
Comprehensive validation checklist for project templates. Run each check against the template directory and report pass/fail.
Step 1: Determine Template Level
Read stack.json from the template root and classify:
At least one stack-specific skill beyond the core set (e.g., new-page, new-component)
.env.example has stack-specific variables uncommented
CLAUDE.md has filled Tech Stack section (no [e.g., placeholders)
CLAUDE.md has filled Installed Plugins section
Level 1.5 Additional Checks
Has application source code (src/ or equivalent)
Has sample data or seed scripts
Has deployment config (Dockerfile, docker-compose.yml, or equivalent)
Level 2 Additional Checks
project-config/SKILL.md has actual resource IDs (no empty tables)
.env or .env.local exists locally (warn if missing, but don't fail — it's gitignored)
.mcp.json exists locally (warn if missing — it's gitignored)
Step 5: Check CLAUDE.md Quality
Total line count under 100
Has ## Tech Stack section
Has ## Architecture section (with @docs/architecture.md reference)
Has ## Installed Plugins section
Has ## Quick Commands section
Has ## Critical Rules section
No placeholder text remaining: grep for \[e\.g\.,, \[Project Name\], TODO, TBD, fill in, <!-- .*--> with empty content around it
At L1+: Tech Stack lists actual technologies (not [e.g., NocoDB, Supabase, Directus])
At L1+: Installed Plugins lists actual plugins with descriptions
Step 6: Check Consistency
Technologies in stack.jsonlayers match CLAUDE.md Tech Stack section
Plugins in stack.jsonplugins match CLAUDE.md Installed Plugins section
Environment variables in .env.example cover what .mcp.json.example references
Commands listed in CLAUDE.md Quick Commands exist as .claude/commands/*.md files
Skills referenced in CLAUDE.md exist as .claude/skills/*/SKILL.md directories
AGENTS.md exists and is in sync with CLAUDE.md (or has sync reminder)
Step 7: Check Security
No .env file committed (check git status and .gitignore)
No .mcp.json file committed (check .gitignore)
No hardcoded API keys or tokens in any tracked file: grep for patterns like sk-, Bearer , token: ", key: " with actual-looking values
No real service URLs in .env.example or .mcp.json.example (only placeholders)
.claude/settings.local.json is gitignored
No .env.local committed
Git-Tracked Secrets (Critical)
The .gitignore check above only verifies RULES — it does not catch files that were committed BEFORE the gitignore rule was added. Run git ls-files to find actually tracked sensitive files:
# Check for tracked secrets that should be gitignored
git ls-files | grep -E '\.env\.local$|\.env$|settings\.local\.json$|\.mcp\.json$'
git ls-files returns NO matches for .env, .env.local, .mcp.json, or settings.local.json
If matches found: flag as CRITICAL — these files contain real credentials and are being tracked by git. Fix: git rm --cached <file> and rotate all exposed tokens
Check .claude/settings.local.json.example for real URLs or tokens (should contain only placeholders like https://your-instance.example.com)
