skill-creator: quick_validate accepts empty or whitespace-only name and description

The skill-creator validator accepts required discovery metadata after it becomes empty when stripped.

Affected file: skills/.system/skill-creator/scripts/quick_validate.py.

Verified against the installed helper and the current upstream source (Git blob 0547b4041a5f58fa19892079a114a1df98286406).

Minimal SKILL.md:

---

name: ""

description: ""

---

# Example

Follow the requested workflow.

Executed command:

python -X utf8 -B skills/.system/skill-creator/scripts/quick_validate.py <fixture-directory>

Actual result: exit code 0, Skill is valid!.

Replacing both empty strings with " " produces the same result. Explicit UTF-8 mode isolates this finding from issue #519.

Expected result: validation fails with a specific error for an empty or whitespace-only required name or description. The metadata cannot identify or route a skill in this state.

Cause: after .strip(), the validator runs its checks only inside if name: and if description: blocks, so an empty value bypasses validation and reaches the success return.

Suggested correction: reject an empty stripped value before format and length checks. Add separate cases for an empty name, whitespace-only name, empty description, whitespace-only description, and a valid nonempty control. The initial scan confirmed the defect with synthetic fixtures and did not modify installed skills; subsequent repair attempts are described below.

Locally executed repair (2026-09-05)

Reject name.strip() and description.strip() when empty, before their existing content checks. The local validator also uses skill_md.read_text(encoding="utf-8"), covering the Windows input issue tracked in #519.

Executed CLI cases now reject empty and whitespace-only names/descriptions (four negative cases), accept valid and Unicode metadata (two positive cases), and validate all 21 installed skill packages. The upstream issue remains open pending an upstream fix; local installation changes are not evidence of upstream adoption.

A post-install adversarial check found the managed system copy restored to its original bytes. The tested fix is therefore retained as a durable project-local validator; its six adversarial/valid cases and all 21 package checks pass. The actor replacing the managed file is unverified. This does not claim the installed managed copy remains repaired.

Tested patch for maintainer review

This minimal diff is against the inspected source recorded above. The UTF-8 line also addresses #519.

--- a/skills/.system/skill-creator/scripts/quick_validate.py
+++ b/skills/.system/skill-creator/scripts/quick_validate.py
@@ -20,7 +20,7 @@
     if not skill_md.exists():
         return False, "SKILL.md not found"
 
-    content = skill_md.read_text()
+    content = skill_md.read_text(encoding="utf-8")
     if not content.startswith("---"):
         return False, "No YAML frontmatter found"
 
@@ -57,6 +57,8 @@
     if not isinstance(name, str):
         return False, f"Name must be a string, got {type(name).__name__}"
     name = name.strip()
+    if not name:
+        return False, "Name must not be empty or whitespace-only"
     if name:
         if not re.match(r"^[a-z0-9-]+$", name):
             return (
@@ -79,6 +81,8 @@
     if not isinstance(description, str):
         return False, f"Description must be a string, got {type(description).__name__}"
     description = description.strip()
+    if not description:
+        return False, "Description must not be empty or whitespace-only"
     if description.startswith("[TODO:"):
         return False, "Description contains an unfinished TODO placeholder"
     if description:

Validation of the durable patched copy: four blank-metadata cases rejected, valid and Unicode controls accepted (6/6 expected outcomes), and 21/21 installed package checks passed. The Unicode regression was exercised with python -X utf8=0 to ensure the file reader does not depend on interpreter UTF-8 mode. Upstream incorporation is still needed; a local patch is not a durable fix for a managed installation that can replace its files.