PO9 Validator

Every .po9-skin passes the Validator before it runs — at package time, and again on import. It is why a PO9 skin is safe to share and safe to trust. The same engine runs in the Creator Kit CLI and inside the app.

What it checks

Security

No executable code, no network access, no unsafe assets. A skin is data — nothing more.

Compatibility

The skin’s declared spec version is supported by the target. No silent breakage.

Structure

Required files exist and are well-formed, and every path stays inside the skin root.

Version

The manifest and spec versions are present, valid, and consistent.

Run it anywhere

po9 validate ./my-skin      # exits 0 on pass, non-zero on failure — drops into CI

Failures print the rule, the file, and a fix hint. The app re-validates on import, so a tampered file is rejected before it can apply.

For the full rule set and severities, see Documentation → Validation.