verification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited verification (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Note: The bash examples below are reference snippets. If you enable disableSkillShellExecution in Claude Code settings (v2.1.101+), any inline shell execution from skills is blocked. These fenced examples are safe to read; copy-paste them into your terminal to run.Unit tests verify code logic. Verification confirms the feature actually works in its real environment. Both are necessary. Neither alone is sufficient.
The /verify command runs automated checks, but domain-specific verification often requires manual steps or specialized tooling.
Every change needs a feedback loop: make a change, verify it worked, then move on. The loop must be closed BEFORE committing.
Bad workflow: change code -> commit -> move to next task -> discover it's broken Good workflow: change code -> verify -> commit -> move to next task
After changing UI or API behavior:
For API changes:
# Test the endpoint directly
curl -X POST http://localhost:3000/api/resource \
-H "Content-Type: application/json" \
-d '{"field": "value"}'
# Check response status and bodyTest beyond the happy path:
Use curl, httpie, or the project's API test suite. Automate what you can, but do at least one manual check of the actual running server.
After changing CLI behavior:
# Test normal usage
my-cli init --name "test project"
# Test error handling
my-cli init # missing required flag
# Test edge cases
my-cli init --name "" # empty stringAfter changing data transformations:
The full verification suite (triggered by /verify):
npm test / pytest / cargo test — unit and integration testsnpm run build / equivalent — compilation and bundlingnpm run lint / equivalent — style and static analysistsc --noEmit, mypy, etc.)All five must pass. If any fails, stop and fix before continuing.
If verification fails:
Different situations call for different gate behaviors:
Use pre-flight for anything that can be checked cheaply up front. Use revision for quality gates that may need iteration. Escalate when you've exhausted your ability to resolve. Abort only when continuing would make things worse.
and still miss real-world failures. Always do at least one real verification.
production outages too.
the server, runs checks, and reports results saves cumulative hours.
trains people to ignore failures.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.