Skip to content
skillsafebeta
← Report library
Purpose / Other

Verification Before Completion Skill Security Audit

What the author says it does (original text)

Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Unconditional execution of an unspecified “full command”

Source references: 3
What we found

The Skill tells the agent to choose and fully execute whatever command proves a claim, but does not require that command to be local, read-only, or side-effect-free, nor does it require approval for expensive, networked, or externally impactful checks.

Why this matters

If a project's “full” test or build script starts services, calls paid APIs, changes a database, publishes artifacts, or runs untrusted repository scripts, invoking this Skill could trigger those actions.

What this evidence establishes

The Skill does require choosing and running a “FULL command” before completion claims, and applies this broadly to commits, PRs, and task completion. However, it names no dangerous, networked, or externally mutating command. Tests and builds are ordinarily consistent with its verification purpose, so side effects are not established from these lines alone. A user can ask the author to default to local, low-cost checks and require approval for networked, paid, or externally mutating verification.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:27In the instructionsOpen original file
1. IDENTIFY: What command proves this claim?2. RUN: Execute the FULL command (fresh, complete)3. READ: Full output, check exit code, count failures4. VERIFY: Does output confirm the claim?
Show 2 other places
SKILL.md:108In the instructionsOpen original file
**ALWAYS before:**- ANY variation of success/completion claims- ANY expression of satisfaction- ANY positive statement about work state- Committing, PR creation, task completion- Moving to next task- Delegating to agents
SKILL.md:25In the instructionsOpen original file
```BEFORE claiming any status or expressing satisfaction:1. IDENTIFY: What command proves this claim?2. RUN: Execute the FULL command (fresh, complete)3. READ: Full output, check exit code, count failures4. VERIFY: Does output confirm the claim?   - If NO: State actual status with evidence   - If YES: State claim WITH evidence5. ONLY THEN: Make the claim
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Reading complete output can expose secrets from logs to the agent context

Source references: 2
What we found

The Skill explicitly requires reading the full command output and provides no exception for redacting, filtering, or truncating sensitive logs. Test and build output can contain tokens, connection strings, personal data, or environment configuration.

Why this matters

If verification logs contain sensitive values, the agent may ingest them into the conversation or run record; later citing the “evidence” could disclose them again.

This is a plausible privacy risk: the instruction requires the agent to read the “Full output” with no exception for sensitive logs or secrets. If a test or build prints tokens, connection strings, or personal data, those values would enter the agent-visible context; the source does not show that they would be sent onward to a third party. A user can restrict verification to exit codes and summaries first, with suspected sensitive output redacted or inspected locally only.

SKILL.md:28In the instructionsOpen original file
1. IDENTIFY: What command proves this claim?2. RUN: Execute the FULL command (fresh, complete)3. READ: Full output, check exit code, count failures4. VERIFY: Does output confirm the claim?   - If NO: State actual status with evidence   - If YES: State claim WITH evidence5. ONLY THEN: Make the claim
Show 1 other places
SKILL.md:27In the instructionsOpen original file
1. IDENTIFY: What command proves this claim?2. RUN: Execute the FULL command (fresh, complete)3. READ: Full output, check exit code, count failures4. VERIFY: Does output confirm the claim?   - If NO: State actual status with evidence
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Regression verification asks for a temporary fix reversal that can disturb workspace files

Source references: 1
What we found

The red-green example calls for passing once, reverting the fix, confirming failure, and then restoring it. The Skill does not say how to isolate those changes, preserve existing uncommitted work, or recover if the sequence is interrupted.

Why this matters

If the reversal overlaps the user's uncommitted changes, or the agent stops before restoration, files may remain in the old state; an unsafe reversal method could also overwrite unrelated edits.

Although presented as a regression-test example, the check mark and “MUST FAIL” clearly recommend actually reverting and restoring the fix. If performed directly in a workspace containing the user’s uncommitted edits, this could overwrite or mix with existing changes, and an interruption could leave the fix reverted. No isolation or clean-diff check is specified. A user can require red-green verification in a temporary copy or separate worktree and forbid destructive Git operations on the existing workspace.

SKILL.md:82In the instructionsOpen original file
**Regression tests (TDD Red-Green):**```✅ Write → Run (pass) → Revert fix → Run (MUST FAIL) → Restore → Run (pass)❌ "I've written a regression test" (without red-green verification)```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a verification gate for completion claims: the agent identifies a command that would prove the claim, runs it in full, checks its output, exit code, and failure count, and only then may report success or completion.

View source
SKILL.md:25In the instructionsOpen original file
```BEFORE claiming any status or expressing satisfaction:1. IDENTIFY: What command proves this claim?2. RUN: Execute the FULL command (fresh, complete)3. READ: Full output, check exit code, count failures4. VERIFY: Does output confirm the claim?   - If NO: State actual status with evidence   - If YES: State claim WITH evidence5. ONLY THEN: Make the claim

It distinguishes tests, linting, builds, reproduction of the original defect, and requirements review, and does not allow one type of check to substitute for another.

View source
SKILL.md:40In the instructionsOpen original file
| Claim | Requires | Not Sufficient ||-------|----------|----------------|| Tests pass | Test command output: 0 failures | Previous run, "should pass" || Linter clean | Linter output: 0 errors | Partial check, extrapolation || Build succeeds | Build command: exit 0 | Linter passing, logs look good || Bug fixed | Test original symptom: passes | Code changed, assumed fixed || Regression test works | Red-green cycle verified | Test passes once || Agent completed | VCS diff shows changes | Agent reports "success" || Requirements met | Line-by-line checklist | Tests passing |

The rule has broad scope: it covers not only final completion claims but any positive statement about work state, moving to another task, and delegating to agents.

View source
SKILL.md:108In the instructionsOpen original file
**ALWAYS before:**- ANY variation of success/completion claims- ANY expression of satisfaction- ANY positive statement about work state- Committing, PR creation, task completion- Moving to next task- Delegating to agents
Start here · InstructionsSKILL.md
verification-before-completion
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
121
File checksum (to compare versions)
0c7154cf220986386348e881434d24c00d8a7fe43421e2e4ebca51121445b484