菜单
Run validation checks to ensure code quality, security, and correctness. Supports quick (scoped), full (CI pipeline), fix (auto-correct), and CI mirror modes.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/hypeJunction/ai-assistant-starter --skill validate命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
End-of-session routine. Ensures test coverage, performs self-review, runs validation, and commits cleanly. Use when finishing a unit of work.
Full feature implementation workflow with explore, plan, code, test, validate, and commit phases. Use for new features, enhancements, or significant code changes.
Iterate on an open PR until CI passes and all review feedback is addressed. Fetches status, categorizes findings by severity, applies fixes, and loops until clean.
| name | validate |
| description | Run validation checks to ensure code quality, security, and correctness. Supports quick (scoped), full (CI pipeline), fix (auto-correct), and CI mirror modes. |
| category | process |
| triggers | ["run checks","verify quality","typecheck","lint","does it pass"] |
Purpose: Run validation checks for code quality, security, and correctness Modes: Quick (default) | Full (--full) | Fix (--fix) | CI Mirror (--ci) Usage:
/validate [scope flags]
/implement or /finish workflows/test-coverage or /tdd/review/debug/security-reviewIf git status shows no changes and no specific mode is requested, report "No changes to validate" and offer to run full validation anyway.
--full)Note: Detect package manager from lockfile (
package-lock.json= npm,pnpm-lock.yaml= pnpm,yarn.lock= yarn,bun.lockb= bun). Use detected manager for all commands. Command examples below usenpmas placeholder — substitute the detected manager.
| Flag | Description |
|---|---|
--files=<paths> | Validate specific files/directories |
--uncommitted | Validate uncommitted changes (default) |
--staged | Validate staged changes only |
--full | Run complete CI pipeline |
--ci | Mirror exact CI configuration |
--fix | Auto-fix correctable issues |
--security | Include security checks |
--coverage | Include test coverage report |
Examples:
/validate # Quick validation of uncommitted changes
/validate --files=src/components/ # Specific directory
/validate --full # Complete CI pipeline
/validate --fix # Auto-fix lint/format issues
/validate --ci # Mirror exact CI checks
/validate --full --coverage # Full validation with coverage
Fast feedback during development — validate only what changed.
git diff --name-only HEAD
git diff --name-only --staged # if --staged flag
Execution order within this level: Run checks in dependency order: (a) Typecheck first (catches type errors that cause other failures), (b) Lint second (may depend on types), (c) Tests third (need types and imports correct), (d) Build last (depends on all above). This prevents cascading failures from obscuring root causes.
Format Check:
npm run format:check 2>/dev/null || npx prettier --check [changed-files]
Type Check:
npm run typecheck
Lint:
npm run lint -- [changed-files]
Security Scan (always runs):
See
references/security-scan-patterns.mdfor concrete grep patterns for secrets, dangerous functions, and security anti-patterns. Run these scans as part of full validation.
# Secrets detection
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" --include="*.json" \
-E "(api[_-]?key|secret|password|token|credential|private[_-]?key)\s*[:=]" [changed-files]
# Insecure pattern detection
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" \
-E "(eval\(|new Function\(|innerHTML\s*=|dangerouslySetInnerHTML|document\.write\()" [changed-files]
# Raw SQL interpolation (injection risk)
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" \
-E "(\\\$queryRaw\`|\\\$executeRaw\`|\.query\(.*\\\$\{|SELECT.*\\\$\{|INSERT.*\\\$\{|UPDATE.*\\\$\{|DELETE.*\\\$\{)" [changed-files]
# Command injection patterns
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" \
-E "(child_process|exec\(|execSync\(|spawn\(|execFile\()" [changed-files]
# Disabled security controls
grep -rn --include="*.ts" --include="*.tsx" --include="*.js" \
-E "(rejectUnauthorized:\s*false|NODE_TLS_REJECT_UNAUTHORIZED|--no-verify)" [changed-files]
Interpreting results:
eval/innerHTML/dangerouslySetInnerHTML: Requires justification — flag for reviewPrisma.sql\...``)child_process/exec: Flag for review — verify no user input reaches the commandReport:
### Level 1: Syntax & Style
| Check | Status | Details |
|-------|--------|---------|
| Format | ✓ Pass / ✗ Fail | [N files need formatting] |
| Types | ✓ Pass / ✗ Fail | [N errors] |
| Lint | ✓ Pass / ✗ Fail | [N errors, M warnings] |
| Secrets | ✓ Pass / ⚠️ Review | [N potential secrets found] |
| Security patterns | ✓ Pass / ⚠️ Review | [N insecure patterns found] |
If failures, stop and report before Level 2.
Run tests only for changed components/files:
npm run test -- ComponentName
npm run test -- "src/components/"
For UI changes, suggest manual verification:
npm run dev
Complete CI pipeline verification before push/merge.
| Step | Check | Command |
|---|---|---|
| 1 | Format | npm run format:check |
| 2 | Types | npm run typecheck |
| 3 | Lint | npm run lint |
| 4 | Security scan | Secrets + insecure pattern detection (see Quick Validation) |
| 5 | Dependency audit | npm audit --audit-level=high |
| 6 | Accessibility | npm run a11y 2>/dev/null || true |
| 7 | Performance | npm run perf 2>/dev/null || true |
| 8 | Tests | npm run test |
| 9 | Coverage | npm run test -- --coverage (if --coverage) |
| 10 | Build | npm run build |
| 11 | Bundle Size | npm run size 2>/dev/null || true |
Report:
## Full Validation Results
| Step | Check | Status | Time |
|------|-------|--------|------|
| 1 | Format | ✓ Pass | 2s |
| 2 | Types | ✓ Pass | 8s |
| ... | ... | ... | ... |
✅ **All CI checks passed** — Ready to push
Auto-correct formatting and lint issues.
npm run format 2>/dev/null || npx prettier --write [changed-files]npm run lint -- --fix [changed-files]npm run test -- [affected-tests]Report:
## Fix Mode Results
### Auto-fixed
| Type | Files Fixed | Issues Resolved |
|------|-------------|-----------------|
| Format | 5 | 23 |
| Lint | 3 | 8 |
### Remaining Issues (manual fix required)
| File | Line | Issue |
|------|------|-------|
| `src/utils.ts` | 45 | Type error: cannot assign... |
Run exact same checks as CI pipeline.
.github/workflows/*.yml, .gitlab-ci.yml, JenkinsfileIn CI mode (--mode=ci):
When validating a bug fix with a regression test, verify the test actually catches the bug:
1. Write the regression test
2. Run it → MUST PASS (with the fix in place)
3. Revert the fix
4. Run it → MUST FAIL (proves the test catches the bug)
5. Restore the fix
6. Run it → MUST PASS (confirms fix works)
A regression test that passes both with and without the fix proves nothing. Skip the red-green cycle only for tests that verify new behavior (not bug fixes).
When a subagent reports task completion, verify independently:
references/validation-troubleshooting.md for expanded patterns including build failures and CI discrepancies)| Error Pattern | Likely Cause | Solution |
|---|---|---|
Cannot find module | Missing import | Check path, add dependency |
Type X not assignable to Y | Type mismatch | Fix types or add assertion |
Property does not exist | Missing property | Add to interface |
Implicit any | Missing annotation | Add explicit type |
| Symptom | Likely Cause | Solution |
|---|---|---|
| Timeout | Async not awaited | Add await or increase timeout |
| Mock not called | Wrong mock setup | Check mock implementation |
| Snapshot mismatch | Intentional change | Update snapshot with -u |
| Level | Checks | When to Use |
|---|---|---|
| Quick | Format, Types, Lint, Scoped Tests | During development |
| Full | All checks + Full test suite + Build | Before push/PR |
| CI | Mirror exact CI pipeline | Before important merges |
| Fix | Auto-correct + Verify | When you have many small issues |
| ID | Type | Prompt / Condition | Expected |
|---|---|---|---|
| VAL-T1 | Positive | "Run the checks" | Skill triggers |
| VAL-T2 | Positive | "Does it pass typecheck?" | Skill triggers |
| VAL-T3 | Positive | "Lint my code" | Skill triggers |
| VAL-T4 | Negative | "Write tests for this" | Does NOT trigger (→ /test-coverage) |
| VAL-T5 | Negative | "Review the code quality" | Does NOT trigger (→ /review) |
| VAL-T6 | Negative | "Fix the type error" | Does NOT trigger (→ /debug) |
| VAL-T7 | Boundary | "Check if CI will pass" | Triggers with --ci flag |