Webpack Config Validator

Validate JSON-exported webpack configuration files for structural issues, deprecated loaders/plugins, optimization gaps, and best practices. Use when auditin...

Security Scan

The skill is internally coherent: it provides a Python-only validator that inspects a user-supplied JSON-exported webpack config file, requires no credentials or installs, and its instructions match the included script.

Purpose & Capability

The name/description (webpack config validation) matches the included Python script and SKILL.md. The script operates on a JSON-exported webpack config and the SKILL.md tells the user how to export that JSON via node — all requested resources (a JSON file) are consistent with the stated purpose.

Instruction Scope

Runtime instructions are narrowly scoped: export the webpack config to JSON and run the local Python validator against that file. The instructions do not ask the agent to read unrelated files, environment variables, or to transmit data to external endpoints. Note: the user-run node require(...) step will execute the project's webpack.config.js (see user guidance).

Install Mechanism

No install spec is provided (instruction-only skill with a bundled script). The Python script claims to be pure-stdlib and no external downloads or package installs are requested.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. This is proportionate for a local static/structural validator.

Persistence & Privilege

always is false and the skill does not request persistent/privileged presence or modify other skills. Autonomous invocation is allowed by platform default but the skill itself does not request elevated privileges.

Assessment

This skill appears to do what it claims: inspect a local JSON-exported webpack config and report issues. Before running it: (1) review the included Python script if you want to be extra cautious (it appears to use only stdlib JSON/file inspection and not network I/O); (2) be aware the SKILL.md instructs you to run node -e "require('./webpack.config.js')" to export JSON — requiring a project's webpack.config.js will execute that file’s JS code, which can run arbitrary code, so only run the export step on code you trust or inside an isolated environment/CI runner; (3) run the validator on a copy of the exported JSON (the script reads only the provided file path); (4) if you plan to add this skill to automation/CI, confirm the script's behavior in your environment and ensure CI runners have minimal access to secrets and production systems.

Validate webpack configuration files exported as JSON for structural correctness, entry/output issues, deprecated loaders and plugins, optimization configuration, and best practices. Pure Python 3 stdlib — no external dependencies.

Note: webpack configs are JS/TS, not directly parseable. This validator works with JSON-exported configs. Export via:

node -e "console.log(JSON.stringify(require('./webpack.config.js')))" > config.json
python3 scripts/webpack_config_validator.py validate config.json

Commands

validate — Full validation with all rules

python3 scripts/webpack_config_validator.py validate config.json
python3 scripts/webpack_config_validator.py validate config.json --strict
python3 scripts/webpack_config_validator.py validate config.json --format json --mode production

check — Quick check (errors and warnings only)

python3 scripts/webpack_config_validator.py check config.json
python3 scripts/webpack_config_validator.py check config.json --format summary

explain — Show all rules with descriptions

python3 scripts/webpack_config_validator.py explain config.json
python3 scripts/webpack_config_validator.py explain config.json --format json

suggest — Run validation and propose fixes

python3 scripts/webpack_config_validator.py suggest config.json
python3 scripts/webpack_config_validator.py suggest config.json --format json

Flags

Flag	Description
--strict	Treat warnings as errors — exit code 1 (CI-friendly)
--format text	Human-readable output (default)
--format json	Machine-readable JSON
--format summary	Compact summary with counts
--mode production	Override mode context for mode-specific rules (E3, O3)
--mode development	Override mode context for mode-specific rules

Validation Rules (24)

Structure (5)

Rule	Severity	Description
S1	error	File not found or unreadable
S2	error	Empty config file
S3	error	Invalid JSON syntax
S4	error	Missing required fields (entry, output)
S5	warning/info	Unknown or deprecated top-level keys

Entry/Output (4)

Rule	Severity	Description
E1	error	Empty entry point (empty string, object, or array)
E2	error	Output section missing 'path' property
E3	warning	Output filename without content hash in production mode
E4	warning	publicPath not set

Module/Rules (4)

Rule	Severity	Description
M1	warning	Module rule without 'test' pattern
M2	warning	Duplicate loader for same test pattern
M3	warning	Deprecated loaders (raw-loader, url-loader, file-loader, json-loader)
M4	info	No babel-loader/ts-loader/esbuild-loader/swc-loader for JS/TS

Plugins (4)

Rule	Severity	Description
P1	error	Deprecated plugins (UglifyJsPlugin, ExtractTextPlugin, CommonsChunkPlugin)
P2	warning	Duplicate plugin instances
P3	info	HtmlWebpackPlugin without explicit template
P4	warning	MiniCssExtractPlugin without corresponding loader in rules

Optimization (3)

Rule	Severity	Description
O1	info	Missing splitChunks configuration
O2	info	Missing custom minimizer configuration
O3	warning/info	devtool set to eval or source-map in production mode

Best Practices (4)

Rule	Severity	Description
B1	info	Missing resolve.extensions
B2	warning	Hardcoded absolute filesystem paths in config
B3	warning	No mode set (development/production/none)
B4	info	Missing devServer configuration

Exit Codes

Code	Meaning
0	No errors (warnings allowed unless --strict)
1	Errors found (or warnings in --strict mode)
2	File not found / parse error

CI Integration

# GitHub Actions example
- name: Validate webpack config
  run: |
    node -e "console.log(JSON.stringify(require('./webpack.config.js')))" > /tmp/wp-config.json
    python3 scripts/webpack_config_validator.py validate /tmp/wp-config.json --strict --mode production --format json

Example Output

webpack.config validate — config.json
======================================
[ERROR  ] S4: Missing required top-level field(s): output
         Every webpack config needs at least 'entry' and 'output'.
[WARNING] E4: output.publicPath not set
         Set publicPath to ensure assets are loaded from the correct URL. Common values: '/', '/assets/', 'auto'.
[WARNING] M3: Deprecated loader 'file-loader' in rule 2
         Replace with asset/resource (webpack 5 built-in).
[ERROR  ] P1: Deprecated plugin 'UglifyJsPlugin' at index 0
         Replace with TerserPlugin (terser-webpack-plugin).
[INFO   ] O1: No optimization.splitChunks configuration
         splitChunks enables automatic code splitting for shared dependencies. Add optimization: { splitChunks: { chunks: 'all' } } for better caching.
[WARNING] B3: No 'mode' set (development/production/none)
         Set mode to enable webpack's built-in optimizations. Without mode, webpack defaults to 'production' with a warning.

Result: INVALID
Summary: 2 error(s), 3 warning(s), 1 info