New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Behavior Validator

by openclaw in openclaw/agent-skills

Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.

MITAuto-check passed

Install Behavior Validator

skills CLI
$ npx skills add openclaw/agent-skills --skill behavior-validator -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install openclaw/agent-skills behavior-validator --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/openclaw/agent-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/behavior-validator .claude/skills/behavior-validator && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
behavior-validator
GitHub stars
1.1k
Token cost
~940 tokens
SKILL.md length
461 words
Files
4 (incl. references)
Skills in repo
7
Repo updated
First seen
Licence
MIT

At a glance

Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.

  • Works in 7 steps: Parse the contract into user tasks,… → Prepare runtime access: target URL, CLI… → Exercise each user task as a real user… → …
  • SKILL.md covers Contract, Isolation, Workflow and Finding Rules, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Behavior Validator is an agent skill from openclaw/agent-skills. Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.

Its SKILL.md is about 940 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `agents/openai.yaml`, `references/contract-template.md` and `references/report-schema.md`).

The repository describes itself as: Useful skills for agents and claws. The licence is MIT.

Example prompts

  • “/behavior-validator”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Parse the contract into user tasks, expected behavior, anti-cheat probes, setup, and evidence requirements.
  2. Prepare runtime access: target URL, CLI command, API endpoint, fixture data, credentials, or generated artifact path.
  3. Exercise each user task as a real user or operator would.
  4. Run anti-cheat probes: vary fixture data, refresh/retry, test empty and invalid inputs, verify persistence, inspect generated output, and…
  5. Capture evidence as compact redacted notes, screenshots, terminal excerpts, response summaries, file summaries, or accessibility…
  6. Emit a structured report. Use references/report-schema.md when a machine-readable report is useful.
  7. If the orchestrator fixes a finding, rerun only the affected contract clauses plus any nearby regression probes.

What it can do on your machine

Read from SKILL.md and the folder at commit 7e73306. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Behavior Validator loads about 940 tokens when it runs, and up to ~1.6k if it reads all its reference files. Until then it costs about 33 tokens; SKILL.md has 461 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~33
When it runs · the whole SKILL.md, loaded when a task matches
~940
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from openclaw/agent-skills at commit 7e73306, republished under its MIT licence (© openclaw). 461 words, ~940 tokens.

Download SKILL.mdSave it as .claude/skills/behavior-validator/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
behavior-validator
description
Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.

Behavior Validator

Validate observable behavior without inspecting source. Use this as the black-box companion to code-aware review: autoreview judges the change bundle, while behavior-validator judges the running product, CLI, API, or generated artifact against a behavior contract.

Contract

  • Read the behavior contract first. If none exists, write a short one from the user request before testing. See references/contract-template.md.
  • Stay source-blind. Do not inspect source files, diffs, tests, git history, implementation notes, build internals, or review bundles.
  • Interact only through user-visible or operator-visible surfaces: browser, CLI, API, generated files, public logs, screenshots, accessibility trees, or documented runtime output.
  • Treat implementation-looking evidence as contamination. If source access is required to continue, stop and report blocked_source_required.
  • Report findings against contract clauses and observable steps, not code locations.
  • Do not mark a workflow as passing until each relevant contract clause is pass, fail, blocked, or out of scope.

Isolation

Prefer a source-blind workspace:

sh
validator_dir="$(mktemp -d "${TMPDIR:-/tmp}/behavior-validator-run.XXXXXX")"
chmod 700 "$validator_dir"
cp behavior-contract.md "$validator_dir/"
cd "$validator_dir"

Launch or connect to the target from the contract. Keep only the contract, allowed fixtures, and redacted captured evidence in the private validator workspace. Supply credentials through approved secret tooling or exact environment variables; never copy credential values into the workspace, report, screenshots, or logs. Do not use fixed shared paths for contracts or captured evidence. If the app must be started from the source checkout, start it from a separate terminal and do not read source while validating.

Show full SKILL.md (233 more words)Show less

Workflow

  1. Parse the contract into user tasks, expected behavior, anti-cheat probes, setup, and evidence requirements.
  2. Prepare runtime access: target URL, CLI command, API endpoint, fixture data, credentials, or generated artifact path.
  3. Exercise each user task as a real user or operator would.
  4. Run anti-cheat probes: vary fixture data, refresh/retry, test empty and invalid inputs, verify persistence, inspect generated output, and confirm buttons/commands perform real work rather than only displaying success text.
  5. Capture evidence as compact redacted notes, screenshots, terminal excerpts, response summaries, file summaries, or accessibility observations. Omit credentials, tokens, cookies, private user data, and unrelated log content.
  6. Emit a structured report. Use references/report-schema.md when a machine-readable report is useful.
  7. If the orchestrator fixes a finding, rerun only the affected contract clauses plus any nearby regression probes.

Finding Rules

  • Fail when observable behavior violates the contract, a task cannot be completed, expected state is fake/static, or evidence is insufficient for a claimed pass.
  • Block when required runtime access, credentials, fixtures, network, or tools are missing.
  • Mark out of scope only when the contract explicitly excludes the behavior or the task depends on a user-owned product decision.
  • Reject purely aesthetic, code-quality, or implementation-style concerns; those belong to code-aware review.

Final Report

Include:

  • target exercised
  • contract file or inline contract used
  • pass/fail/blocked/out-of-scope summary
  • accepted behavioral findings with reproduction steps and evidence
  • anti-cheat probes run
  • remaining blockers, if any

© openclaw, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (references) in skills/behavior-validator of openclaw/agent-skills.

  • SKILL.md
  • agents/openai.yaml
  • references/contract-template.md
  • references/report-schema.md

Open the folder on GitHubat commit 7e73306

Compare with similar skills

Behavior Validator next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Behavior Validator compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Behavior Validator this skillopenclaw/agent-skills1.1k—~940Automated safety check: PassMIT
Form Validationthedaviddias/Front-End-Checklist74k—~633Automated safety check: PassMIT
Validateagenticnotetaking/arscontexta3.5k—~3kAutomated safety check: PassMIT
Zod Validation Expertdavila7/claude-code-templates32k3 repos~2.4kAutomated safety check: PassMIT
Agent Production Validatorruvnet/ruflo74k2 repos~3kAutomated safety check: PassMIT
Validate Pluginruvnet/ruflo74k—~511Automated safety check: NotesMIT

Similar skills

  • Form Validation

    thedaviddias/Front-End-Checklist

    A skill your agent uses when reviewing templates, rendered HTML, or shared components related to Validate forms accessibly.

    74k GitHub stars~633 tokensUpdated yesterday
    Frontend & DesignAuto-check passed

  • Validate

    agenticnotetaking/arscontexta

    Schema validation for notes. An agent skill from agenticnotetaking/arscontexta.

    3.5k GitHub stars~3k tokensUpdated 7 mo ago
    Frontend & DesignAuto-check passed

  • Zod Validation Expert

    davila7/claude-code-templates

    Expert in Zod — TypeScript-first schema validation. An agent skill from davila7/claude-code-templates.

    32k GitHub starsUsed in 3 repos~2.4k tokens
    Frontend & DesignAuto-check passed

  • Agent Production Validator

    ruvnet/ruflo

    Agent skill for production-validator - invoke with $agent-production-validator

    74k GitHub starsUsed in 2 repos~3k tokens
    Auto-check passed

  • Validate Plugin

    ruvnet/ruflo

    Validate a Claude Code plugin structure, frontmatter, and MCP tool references

    74k GitHub stars~511 tokensUpdated today
    Agent WorkflowsAuto-check: notes

  • Migrate Validate

    ruvnet/ruflo

    Validate pending migrations for foreign key consistency, rollback safety, and best practices

    74k GitHub stars~660 tokensUpdated today
    DevOps & CloudAuto-check: notes

More from openclaw/agent-skills

  • Beam

    openclaw/agent-skills

    Publish a redacted local coding session to an authenticated read-only Beam catalog.

    1.1k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Session Viewer

    openclaw/agent-skills

    Render Codex, Claude Code, OpenClaw, or Pi session JSONL transcripts as a searchable, shareable single-file HTML viewer.

    1.1k GitHub stars~918 tokensUpdated today
    Auto-check passed

  • Team Handoff

    openclaw/agent-skills

    Hand local work to a shared OpenClaw Gateway: start a worktree session there as yourself in one request, seeded with a handoff, and get the session URL back.

    1.1k GitHub stars~1.3k tokensUpdated today
    Auto-check passed

  • Crabbox Remote Test Runner

    openclaw/agent-skills

    Detects the Crabbox CLI or config in a repository and uses it to run tests and validation on remote runners, with checks before touching secrets or paid infrastructure.

    1.1k GitHub stars~3.6k tokensUpdated today
    Auto-check passed

  • Handoff

    openclaw/agent-skills

    Clipboard-ready handoff prompt for another agent to investigate or continue a task.

    1.1k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Readme Standard

    openclaw/agent-skills

    House README standard: structure, badge row, tone, per-archetype templates, and verification gates for steipete/openclaw repos.

    1.1k GitHub stars~1.4k tokensUpdated today
    Auto-check passed

Questions about Behavior Validator

What does Behavior Validator do?

Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts. Behavior Validator is an agent skill from openclaw/agent-skills. Source-blind user behavior validation against a prewritten contract for apps, CLIs, APIs, and generated artifacts.

How do I install Behavior Validator in Claude Code?

Run `npx skills add openclaw/agent-skills --skill behavior-validator -a claude-code`. Or copy the skill folder (skills/behavior-validator in openclaw/agent-skills) into .claude/skills/behavior-validator in your project. Claude Code loads it when a task matches its description.

How do I install Behavior Validator in Codex?

Run `npx skills add openclaw/agent-skills --skill behavior-validator -a codex`. Or copy the skill folder (skills/behavior-validator in openclaw/agent-skills) into .agents/skills/behavior-validator in your project. Codex loads it when a task matches its description.

Can I use Behavior Validator in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add openclaw/agent-skills --skill behavior-validator -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/behavior-validator, .gemini/skills/behavior-validator, .github/skills/behavior-validator and .opencode/skills/behavior-validator in your project.

What does Behavior Validator need to run?

SKILL.md names no scripts, command-line tools or credentials: Behavior Validator is instructions for the agent only.

Does Behavior Validator access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Behavior Validator safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Behavior Validator use?

Behavior Validator is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Behavior Validator use?

About 940 tokens (SKILL.md is roughly 3.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 701 tokens, read only when the agent opens those files.

What are the alternatives to Behavior Validator?

Skills that share tags, products or a category with Behavior Validator: Form Validation (thedaviddias/Front-End-Checklist, 74k stars), Validate (agenticnotetaking/arscontexta, 3.5k stars), Zod Validation Expert (davila7/claude-code-templates, 32k stars) and Agent Production Validator (ruvnet/ruflo, 74k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Behavior Validator?

openclaw (a GitHub organization) maintains it in openclaw/agent-skills, which has 1,102 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on October 7, 2026.

Source: openclaw/agent-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.