pine-validate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pine-validate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Validate Pine Script v6 function references against the v6 allowlist. The authoritative source of truth is the validate_function MCP tool on the pinescript server. Never assert a function is valid from memory — always check via the tool.
"is this valid Pine v6?", "check this for errors", or similar.
ta.adx valid?","does security() exist in v6?", "what replaced study()?".
function references before running on TradingView.
Do not activate for general Pine Script authoring requests — that is the pine skill's job. This skill is read-only validation.
From the user's input, extract every distinct function reference. A function reference is anything that looks like a call site:
<namespace>.<func>( — namespaced calls like ta.rsi(, strategy.entry(,request.security(, math.sum(.
<func>( — top-level calls like plot(, indicator(, input(.Apply these filters when extracting:
//. Skip anything after// on a line.
"..." or '...' is not acall.
myFunc(...) => — those are declarations, not calls against the allowlist.
times in the snippet.
If the user provided only a bare function name (e.g. "is ta.adx valid?"), treat that as a single reference to validate.
validate_functionFor each unique function name extracted, call the MCP tool:
validate_function(fn_name="<name>")The tool returns a ValidationResult object with:
valid — boolean.type — "namespaced", "toplevel", or null.function — the name that was checked.suggestion — replacement hint or guidance, present when valid is false.Call the tool once per unique name. Do not batch, do not skip, do not infer results without calling.
Render the findings as a markdown table in this exact shape:
| Function | Valid | Suggested replacement |
|---|---|---|
ta.rsi | yes | — |
ta.adx | no | ta.adx() does NOT exist. Use ta.dmi(diLen, adxSmoothing) → returns [diPlus, diMinus, adx] as a tuple. |
Rules for the table:
group. Invalid rows are the actionable ones.
— (em dash) in the replacement column when the function is valid.suggestion field verbatim from the tool response for invalidrows. Do not paraphrase.
After the table:
validate against the Pine v6 allowlist and the snippet should compile on TradingView (subject to non-function errors — type mismatches, missing arguments, etc., which this skill does not check).
the listed replacements applied, then revalidate. Where the suggestion names a concrete replacement (e.g. security → request.security), offer to rewrite the snippet inline if the user wants — but only on request, do not rewrite unprompted.
function name, ask for what to validate. Do not call the tool with an empty string.
user pasted variable declarations only), say so and ask whether they meant a different snippet.
and arrays (e.g. myArray.push(x)). Treat <identifier>.<method>( as a call only when <identifier> is a known namespace (ta, math, array, strategy, request, input, str, chart, color, line, label, box, table, polyline, map, matrix, runtime, session, syminfo, ticker, time, timeframe). For ambiguous prefixes, validate and let the tool's response settle it.
input( is flagged by the allowlist aspreferred-typed-variant. Pass that suggestion through verbatim in the table.
references, validate the first 50 alphabetically and tell the user the remainder were truncated; offer to continue on request.
For a static reference table of commonly invalid or renamed Pine functions and their canonical replacements, see references/known-replacements.md. That file mirrors the KNOWN_REPLACEMENTS map maintained inside the MCP server and is useful when the user wants the answer without round-tripping the tool. The MCP validate_function tool remains the source of truth — the reference file is a cache for human reading.
User: "Is this snippet valid Pine v6? `plot(ta.rsi(close, 14)) security(syminfo.tickerid, 'D', close)`"
plot, ta.rsi, security.(syminfo.tickerid lacks a trailing ( and is therefore not a call — the extraction rule already excludes it.)
validate_function for each of: plot, ta.rsi, security.| Function | Valid | Suggested replacement |
|---|---|---|
security | no | security() was renamed in v5. Use request.security() instead. |
plot | yes | — |
ta.rsi | yes | — |
security( withrequest.security( and revalidating.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.