apw-verify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited apw-verify (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when asked to verify that an implementation is actually done — that it meets a description, spec, plan, or set of requirements. It exists to fight one specific failure: a model tends to declare success on unverified work, reasoning that code looks correct instead of checking that it is. This skill replaces "it should work" with evidence: derive concrete requirements, check each against reality, grade it honestly, and record the result in a durable artifact. It sits downstream of implementation — it is how you prove the work before claiming it. Follow the steps below strictly and in order.
Before checking anything, pin down exactly what you are verifying against:
Do not skip this step. You cannot verify against a requirement you have not turned into something checkable.
If a requirement is too ambiguous to check — if "done" for some item is genuinely undefined — ask up to 5 targeted questions that would change what counts as a pass. Skip this step entirely if the acceptance criteria are already clear. Do not ask for the sake of asking.
State, concisely:
Then ask: "Ready to proceed?"
Wait for the user to confirm or correct the plan before spending time. This gate exists so you verify the right requirements, not a misremembered version of them. For a small, obvious verification, keep the plan to a few lines — but still confirm.
Work the checklist one item at a time. For every requirement, capture three things:
pass, fail, partial, or unable-to-verify.partial, why something is unable-to-verify, or how a fail manifests.Discipline: prefer observing reality over assuming it. Run it, test it, or read the actual implementation rather than reasoning that it ought to work. A requirement marked pass with no evidence is not verified — it is guessed.
If verification reveals something that breaks the assignment, stop and tell the user rather than papering over it:
Do not silently mark such things as pass, and do not silently fix them — verifying and fixing are different jobs. Report, and let the user decide.
Write the outcome to your work item's `verification-result.md` artifact — see apw-work-with-work-item-artifacts for where work-item artifacts live — using .claude/skills/apw-verify/VERIFICATION_TEMPLATE.md as the structure. The artifact must contain:
This file is the record of what was and was not proven. Write it even when everything passes.
When done, report in chat — briefly, since the detail is in the artifact:
Be honest. Do not report a pass if anything material is unproven or broken. Stating that something was not verified is a valid and necessary result — a clean picture that isn't true is the exact failure this skill exists to prevent.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.