validate-components

Enumerate all skills via skills/*/SKILL.md, parse the YAML frontmatter, and check that name and description are non-empty strings and allowed-tools is a YAML array of recognized tool names. Report missing fields as CRITICAL findings with the exact file path.

Command files require a non-empty description string and user-invocable set to the boolean true. Alias commands must also include alias-of pointing to the canonical command, and a self-referencing alias is a critical error.

Agents cannot define hooks, mcpServers, or permissionMode because subagents inherit the host permission model and cannot declare their own hooks or MCP connections. These fields cause runtime errors or silent overrides and are flagged as CRITICAL.

The check fails when allowed-tools is written as a comma-separated string instead of a YAML array. Frontmatter must use list syntax with dash-prefixed items, and only recognized tool names like Read, Write, Bash, Glob, and Grep are accepted.

It only checks presence, type, and format of fields, not semantic quality such as whether a description is useful. It is read-only, cannot judge whether an allowed-tools list fits the skill's procedure, and treats only the literal boolean true as valid for user-invocable.