done-prover — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited done-prover (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
"Tests pass because they test structure and mock implementations rather than actual functionality." — common pattern in #5052
Claude Code can declare "all 47 tests pass" when 2 actually failed, 1 was skipped, and the integration suite never ran. This skill catches that.
A Stop hook (hooks/verify-claims.sh) fires at the end of every assistant turn. It:
"everything green", "X tests passing", etc.)
tool_result entries for theactual test output Claude already ran
and surfaces a verdict to the conversation
If no claim is found, or no test output is in scope, the hook exits silently. It never re-runs tests on its own — it only verifies the output Claude already saw.
The Stop hook handles auto-invocation. You should manually invoke this skill if the user:
.papercuts/proofs/ (most recent file). Each verdict theStop hook generated is saved here. If empty, tell the user no recent claim has been verified yet.
The hook (and any manual invocation) emits this exact format:
─── done-prover: verdict ───
Claim: "<verbatim phrase from assistant>"
Evidence: <path to tool_result that was checked>
Reported by Claude:
<Claude's count, e.g. "all 47 tests pass">
Actual test output:
✓ <passed>
✗ <failed>
◌ <skipped>
Discrepancy:
<one-sentence summary>
─────────────────────────────already saw, which is faster and matches what the user observed.
refactor"). It only blocks claims about TEST RESULTS.
perfectly. It looks for common failure signals (FAIL, ERROR, failed:, \d+ failed). False negatives are possible; false positives are designed to be rare.
Optional .papercuts/config.json:
{
"done_prover": {
"claim_phrases": ["all tests pass", "all green", "..."],
"failure_patterns": ["FAIL", "ERROR", "\\d+ failed"],
"verdict_dir": ".papercuts/proofs"
}
}Defaults are sensible. Most users never need to touch this.
This skill is the "verify" half of the project's voice. Every claim the assistant makes that something is done gets a receipt.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.