Message Template Validator

Overview

Nothing here is sent, nothing is rendered and nothing is connected to: we read a template, find every placeholder in it, and tell you which ones your allowlist does not cover. The question is permission rather than renderability, and the two are genuinely different — a template reading {{customer.ssn}} renders perfectly well and may still be something no message of yours is allowed to contain, which is why the verdict comes from the list you supply and never from the data you happen to hold. Four placeholder styles are understood: the double curly braces of {{name}}, the single braces of {name}, the dollar form of ${name}, and percent signs around %name%. Anything delimited like a placeholder that is not a plain name — a section such as {{#if premium}}, a filter, a call, an opener with no closer — comes back to you as an unsupported form rather than being quietly ignored, because a template that looks fully satisfied and then renders with control syntax still in it is the worse outcome. You also get the reverse check: name the placeholders a template must carry and we will tell you which of them are absent, which is how an unsubscribe link or an order number stops going missing. The same scanner backs our merge skill and our prompt-variable skill, so all three agree exactly on what a placeholder is.

Template placeholders are where a message stops being written by you and starts being written by your data. A name nobody approved slips in during a hurried edit, renders beautifully, and puts a card number or an internal note in front of a customer. The reverse costs you too: an unsubscribe link that quietly disappears from a marketing template is a compliance problem nobody notices until the complaints arrive. Both are decidable from the template alone, before any data is anywhere near it. The scanner behind this is a plain index walk with no pattern compiled from your template, which matters when templates arrive from customers and reach a million characters, and it is the same scanner our merge skill uses — so a template that validates here renders with exactly the placeholders you were told about.

When to use it

Scope

Non-goals

• Does not send, queue or deliver anything, and opens no connection of any kind
• Does not render the template — communication.template_merge does that
• Does not evaluate a section, a loop, a filter or a conditional; those are reported as unsupported forms rather than interpreted
• Does not check spelling, grammar or tone
• Does not decide whether a name is sensitive; the allowlist you supply is the whole of the policy
• Does not repair a template or hand back a corrected one

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"communication.template_validate","input":{"template":"Hi {{first_name}}, your order {{order_id}} ships on {{ship_date}}.","allowedVariables":["first_name","order_id","ship_date"],"syntax":"MUSTACHE"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("communication.template_validate", {"allowedVariables":["first_name","order_id","ship_date","tracking_url"],"requiredVariables":["order_id"],"template":"Hi {{first_name}}, your order {{order_id}} ships on {{ship_date}}. Thanks again, {{first_name}}.","syntax":"MUSTACHE"});

Errors

Other limits

Limitations

• Does not send, queue or deliver anything, and opens no connection of any kind
• Does not render the template — communication.template_merge does that
• Does not evaluate a section, a loop, a filter or a conditional; those are reported as unsupported forms rather than interpreted
• Does not check spelling, grammar or tone
• Does not decide whether a name is sensitive; the allowlist you supply is the whole of the policy
• Does not repair a template or hand back a corrected one
• Rendering a template, which is a different skill
• Templates whose control syntax you actually need evaluated
• Deciding on your behalf which names are safe to expose

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "communication.template_validate",
  "input": {
    "allowedVariables": [
      "first_name",
      "order_id",
      "ship_date",
      "tracking_url"
    ],
    "requiredVariables": [
      "order_id"
    ],
    "template": "Hi {{first_name}}, your order {{order_id}} ships on {{ship_date}}. Thanks again, {{first_name}}.",
    "syntax": "MUSTACHE"
  }
}

Examples

{
  "allowedVariables": [
    "first_name",
    "order_id",
    "ship_date",
    "tracking_url"
  ],
  "requiredVariables": [
    "order_id"
  ],
  "template": "Hi {{first_name}}, your order {{order_id}} ships on {{ship_date}}. Thanks again, {{first_name}}.",
  "syntax": "MUSTACHE"
}

{
  "unknown": [],
  "missing": [],
  "unsupportedForms": [],
  "valid": true,
  "summary": {
    "placeholderCount": 4,
    "distinctPlaceholderCount": 3,
    "truncated": false,
    "missingCount": 0,
    "syntax": "MUSTACHE",
    "unknownCount": 0
  },
  "placeholders": [
    {
      "name": "first_name",
      "occurrences": 2,
      "allowed": true
    },
    {
      "name": "order_id",
      "occurrences": 1,
      "allowed": true
    },
    {
      "name": "ship_date",
      "occurrences": 1,
      "allowed": true
    }
  ]
}

{
  "wildcards": true,
  "requiredVariables": [
    "unsubscribe_url"
  ],
  "template": "Hi {{first_name}}, {{#if premium}}your priority order{{/if}} {{order_id}} ships to {{customer.address.city}}. Card on file: {{customer.card_number}}.",
  "allowedVariables": [
    "first_name",
    "order_id",
    "customer.*"
  ],
  "syntax": "MUSTACHE"
}

{
  "unknown": [],
  "missing": [
    "unsubscribe_url"
  ],
  "unsupportedForms": [
    {
      "reason": "CONTROL_TAG",
      "form": "{{#if premium}}",
      "span": {
        "start": 19,
        "end": 34
      }
    },
    {
      "reason": "CONTROL_TAG",
      "form": "{{/if}}",
      "span": {
        "start": 53,
        "end": 60
      }
    }
  ],
  "valid": false,
  "summary": {
    "placeholderCount": 4,
    "distinctPlaceholderCount": 4,
    "truncated": false,
    "missingCount": 1,
    "syntax": "MUSTACHE",
    "unknownCount": 0
  },
  "placeholders": [
    {
      "name": "first_name",
      "occurrences": 1,
      "allowed": true
    },
    {
      "name": "order_id",
      "occurrences": 1,
      "allowed": true
    },
    {
      "name": "customer.address.city",
      "occurrences": 1,
      "allowed": true
    },
    {
      "name": "customer.card_number",
      "occurrences": 1,
      "allowed": true
    }
  ]
}

Recommended use cases

• Gate a template in review, so a placeholder nobody approved cannot reach a customer-facing message
• Stop a template from referencing a field your data-protection policy forbids, by keeping that field off the allowlist
• Fail a build when a transactional template loses its unsubscribe link or its order number
• Take an inventory of what a template needs before you go and assemble the data

Avoid for

• Rendering a template, which is a different skill
• Templates whose control syntax you actually need evaluated
• Deciding on your behalf which names are safe to expose

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags