diff --git a/validate_workflow.sh b/validate_workflow.sh
index a02a2d3b1897c5249877a67b97f3dd00d5e5bb15..1ece8784fbf3cf420a36c84e4bdaa295b0deea1b 100755
--- a/validate_workflow.sh
+++ b/validate_workflow.sh
@@ -80,6 +80,7 @@ declare -A validators
 # workflow has max 11 chars
 # filetype has max 4 chars
 # stage has max 9 chars
+# each validator should return true if file was valid
 validators[__mediathek_mkv__current]="/usr/bin/mediaconch -ft -p /etc/mediaconch/profile,xml FILE"
 validators[__mediathek_mkv_upcoming]="/usr/bin/mediaconch -ft -p /etc/mediaconch/profile,xml FILE"
 validators[_____kitodo_tif__current]="/usr/bin/checkit_tiff_current /etc/checkit_tiff/retromono_current FILE"
@@ -203,11 +204,11 @@ get_cli_args() {
             exit 1
         fi
     else
-        if [ "$WITH_DAEMON" -eq 1 -a "$FILES_MODE" = "sort" ]; then
+        if [ "$WITH_DAEMON" -eq 1 ] &&  [ "$FILES_MODE" = "sort" ]; then
             error "param --daemon does only work with param --mode='delete' or --mode='nothing'!"
             exit 1
         fi
-        if [ "$STAGE" != "current" -a "$STAGE" != "upcoming" -a "$STAGE" != "any" ]; then
+        if [ "$STAGE" != "current" ] && [ "$STAGE" != "upcoming" ] && [ "$STAGE" != "any" ]; then
             error "--param stage must be 'any', 'current' or 'upcoming'!"
             exit 1
         fi
@@ -236,7 +237,7 @@ prepare_cmd() {
     mode=$1
     ftype=$2
     stage=$3
-    key=$(printf "%11s%4s%9s" $MODE $ftype $stage|sed -e "y/ /_/")
+    key=$(printf "%11s%4s%9s" "$mode" "$ftype" "$stage"|sed -e "y/ /_/")
     debug "prepare_cmd, key=$key"
     cmd=${validators[$key]};
     debug "prepare_cmd, cmd=$cmd"
@@ -293,13 +294,15 @@ scan_file() {
     if [ "$STAGE" = "any" ]; then
         for stage in current upcoming; do
             debug "scan_file, using stage: $stage (STAGE mode '$STAGE')"
-            cmd=$(prepare_cmd "$MODE" "$ftype" "$stage")
-            echo "cmd=$cmd"
+            cmd=$(prepare_cmd "$MODE" "$ftype" "$stage" | sed -e "s#FILE#'$filename'#")
+            debug "scan_file, calling cmd='$cmd'"
+            "$cmd" || ( error "failed call of '$cmd', $?"; exit 1)
         done
     else
         debug "scan_file, using stage: $STAGE"
-        cmd=$(prepare_cmd "$MODE" "$ftype" "$STAGE")
-        echo "cmd=$cmd"
+        cmd=$(prepare_cmd "$MODE" "$ftype" "$STAGE" | sed -e "s#FILE#'$filename'#")
+        debug "scan_file, calling cmd='$cmd'"
+        "$cmd" || ( error "failed call of '$cmd', $?"; exit 1)
     fi
 
 }
@@ -316,10 +319,10 @@ get_cli_args "$@"
 if [ "$WITH_PIPE" -eq 1 ]; then
     #cli mode, use stdin
     debug "checking stream"
-    filename=$(mktemp validate_wrg.XXXX)
-    cat - > $filename
+    filename=$(mktemp --tmpdir validate_wrg.XXXX)
+    cat - > "$filename"
     scan_file "$filename"
-    rm -f $filename
+    rm -f "$filename" || error "could not remove temporary file '$filename'"
 else 
     if [ "$WITH_DAEMON" -eq 1 ]; then
         # echo daemon mode, use inotify to watch changes