verify-changes — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited verify-changes (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Existing code and working code are not the same thing. Reading a function tells you what it looks like; running it tells you what it does. This skill is about closing that gap with evidence you can point to.
Inspecting: "the function is right there, so it should work" -> not verified
Assuming: "the types line up, so it must be correct" -> not verified
Executing: "I ran it; here is the output; it works, because X" -> verifiedOnly the third kind counts. Everything else is a hypothesis.
| Kind of change | How you prove it works |
|---|---|
| Bug fix | Re-run the exact scenario that failed; confirm it no longer does |
| New feature | Drive the feature end to end; confirm the output matches intent |
| Refactor | Run the existing tests; confirm nothing regressed |
| API change | Call the endpoint; confirm the response shape and status |
| UI change | Render the component; confirm what appears on screen |
| Config change | Load the app with it; confirm the new values take effect |
| Build / infra | Run the build or pipeline; confirm it completes |
# JavaScript / TypeScript project
npm run build # does it compile?
npm test # do the tests pass?
npm run dev # does it boot?
# Smoke-test a single module
node -e "require('./src/parser'); console.log('module loads')"
# Hit an HTTP endpoint
curl -s http://localhost:3000/api/orders | jq .
# Exercise a CLI
python -m mytool --check## Verification
Changed
- src/orders/total.ts — corrected rounding on multi-currency carts
Ran
- npm run build, npm test, manual curl against /api/orders
Result
- Build: compiled clean
- Tests: 58 passed, 0 failed
- Runtime: server boots; /api/orders returns the expected JSON
- Edge case: empty cart returns 0, not NaN
Still open
- Load behavior under concurrency not yet measuredState plainly what you could not verify — unknown-but-named beats silently-skipped.
Web app
API / backend
CLI / script
| Excuse | Why it fails | Do this instead |
|---|---|---|
| "It should work" | No evidence behind it | Run it and show the output |
| "The happy path is fine" | Bugs cluster at the edges | Drive the error paths too |
| "It compiles, so it's done" | Compiling is not correctness | Check runtime behavior |
| "Too trivial to test" | Small changes still break things | Verify it anyway |
| After a change from | Verify by |
|---|---|
| A frontend / UI task | Rendering it and watching the console |
| An API / backend task | Calling the endpoints and inspecting responses |
| A database / schema task | Running the migration and querying the data |
| Adding tests | Running the suite and checking coverage |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.