PO9 Validator

Every .po9-skin passes the Validator before it runs — at package time, and again on import. It is why a PO9 skin is safe to share and safe to trust. The same engine runs in the Creator Kit CLI and inside the app.

What it checks

Security

No executable code, no network access, no unsafe assets. A skin is data — nothing more.

Compatibility

The skin’s declared spec version is supported by the target. No silent breakage.

Structure

The JSON document is well-formed — required fields present, token-only CSS, one embedded image, safe local paths.

Version

The manifest and spec versions are present, valid, and consistent.

Run it anywhere

npx po9-skin validate ./my-skin      # exits 0 on pass, non-zero on failure — drops into CI

Failures print the rule, the file, and a fix hint. The app re-validates on import, so a tampered file is rejected before it can apply.

For the full rule set and severities, see Documentation → Validation.