Nodemon Config Validator

Validate nodemon config files (nodemon.json, .nodemonrc, package.json#nodemonConfig) for watch settings, ignore patterns, exec conflicts, and best practices....

Security Scan

The skill's requirements, instructions, and included Python script align with its stated purpose of linting/validating nodemon config files; it only reads local config files and reports findings, with no network, credential, or install demands.

Purpose & Capability

Name/description match the included script and runtime instructions. The validator only needs to read nodemon.json/.nodemonrc/package.json and analyze their contents — no unrelated credentials, binaries, or services are requested.

Instruction Scope

SKILL.md explicitly instructs running the bundled Python script against specific config files. The script reads those files (and sibling package.json) and performs static checks; it does not instruct reading arbitrary system files, environment variables, or sending data externally.

Install Mechanism

No install spec is provided and the skill is instruction-only with a bundled pure-stdlib Python script. Nothing is downloaded or written to disk by an installer step.

Credentials

The skill declares no environment variables, credentials, or config paths. The script accesses project-local files (config files and package.json) which is appropriate for the stated purpose.

Persistence & Privilege

The skill is not forced-always, does not request persistent presence, and does not modify other skills or global agent settings. Autonomous invocation is allowed by default but is normal for skills and not combined with other red flags here.

Assessment

This skill appears coherent and safe for verifying nodemon configs: it only reads project-local config files and reports lint-like findings. Before installing or running it in an automated agent, confirm you trust the project directory you point it at (it will read package.json and sibling config files). If you need absolute assurance, inspect the full script yourself — it uses only Python stdlib and does not perform network calls or execute shell commands based on config values (it flags potentially risky exec strings but does not run them).

Validate nodemon.json, .nodemonrc, .nodemonrc.json, and package.json#nodemonConfig for watch performance issues, ignore patterns, exec conflicts, delay settings, and best practices. Supports text, JSON, and summary output formats with CI-friendly exit codes.

Commands

# Full validation (all 22+ rules)
python3 scripts/nodemon_config_validator.py validate nodemon.json

# Quick syntax-only check (structure rules only)
python3 scripts/nodemon_config_validator.py check .nodemonrc

# Explain config in human-readable form
python3 scripts/nodemon_config_validator.py explain nodemon.json

# Suggest improvements
python3 scripts/nodemon_config_validator.py suggest package.json

# JSON output (CI-friendly)
python3 scripts/nodemon_config_validator.py validate nodemon.json --format json

# Summary only (pass/fail + counts)
python3 scripts/nodemon_config_validator.py validate nodemon.json --format summary

# Strict mode (warnings become errors)
python3 scripts/nodemon_config_validator.py validate nodemon.json --strict

Rules (22+)

#	Category	Severity	Rule
S1	Structure	Error	File not found or unreadable
S2	Structure	Error	Empty config
S3	Structure	Error	Invalid JSON syntax
S4	Structure	Warning	Unknown top-level keys
S5	Structure	Warning	Both nodemon.json and .nodemonrc present (conflict)
W1	Watch	Warning	Empty watch array
W2	Watch	Info	Watch path uses absolute path (portability)
W3	Watch	Error	Watching node_modules (severe performance issue)
W4	Watch	Info	No watch or ext specified (relying on defaults)
E1	Extensions	Warning	Empty ext string
E2	Extensions	Warning	Watching too many extensions (>10, performance)
E3	Extensions	Info	Missing common extensions for detected project type
I1	Ignore	Warning	Empty ignore array
I2	Ignore	Info	node_modules not explicitly ignored
I3	Ignore	Warning	Overly broad ignore patterns (e.g. "*")
X1	Exec	Warning	exec command with shell injection risk
X2	Exec	Warning	Both exec and script specified (conflict)
X3	Exec	Info	execMap with unusual/unknown extension
D1	Delay	Warning	Delay too low (<100ms, rapid restarts)
D2	Delay	Warning	Delay too high (>10000ms, slow feedback)
B1	Best Practices	Info	verbose not set (useful for debugging)
B2	Best Practices	Warning	No ignore patterns at all

Output Formats

• text (default): Human-readable with severity icons
• json: Machine-parseable JSON array of findings
• summary: Pass/fail with error/warning/info counts

Exit Codes

• 0: No errors (warnings/infos only or clean)
• 1: One or more errors found
• 2: File not found or invalid input

Requirements

• Python 3.8+
• No external dependencies (pure stdlib)