Security audit
Security checks for vulnerabilities and agentic risk
This skill is a verification checklist and helper script that can run user-configured local checks before claiming work is done.
Install only if you want an agent to be stricter about proving work is complete. Before running the helper script, review any verify.json because its commands execute locally and its evidence file may contain command output that should not include secrets.
print(f"== {name} == $ {cmd['run']}")
import shlex
argv = shlex.split(cmd["run"])
proc = subprocess.run(argv, capture_output=True, text=True)
ok = proc.returncode == 0
overall = overall and ok
if proc.stdout.strip():- Using "should", "probably", "seems to"
- Expressing satisfaction before verification ("Great!", "Perfect!", "Done!", etc.)
- About to commit/push/PR without verification
- Trusting agent success reports
- Relying on partial verification
- Thinking "just this once"print(f"== {name} == $ {cmd['run']}")
import shlex
argv = shlex.split(cmd["run"])
proc = subprocess.run(argv, capture_output=True, text=True)
ok = proc.returncode == 0
overall = overall and ok
if proc.stdout.strip():No suspicious patterns detected.