Huo15 Openclaw Verify Mode

验证模式 — 检查工作成果、运行测试、验证假设。借鉴 Claude Code 的 Verification Agent。

Security Scan

This is an instruction-only "verify mode" skill that describes how to review code changes, run tests and produce a verification report; it requests no credentials, no installs, and its instructions align with its stated purpose.

Purpose & Capability

Name and description match the content of SKILL.md: the skill is a verification agent that reads changes, runs static checks, executes tests/builds/linters, and outputs a report. It does not request unrelated binaries, credentials, or config paths.

Instruction Scope

Instructions focus on static analysis and running tests/builds/linters which are appropriate for verification. They are intentionally high-level (e.g., "run the test suite", "construct test scenarios"), which gives the agent discretion to run repository commands and access repo files — expected for this purpose but worth noting because it may cause the agent to execute arbitrary project scripts in the user's environment.

Install Mechanism

No install spec and no code files — lowest-risk instruction-only skill. Nothing is written to disk by the skill itself.

Credentials

No required environment variables, no credentials, and no config paths declared. The runtime instructions do not ask for external service tokens or unrelated environment access.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed by platform default but not a special privilege of this skill.

Assessment

This skill is coherent and limited to code verification tasks, but it expects to read repository files and run tests/build commands in your environment. Before enabling or invoking it: (1) ensure you run it in a safe/isolated workspace or CI runner (not on production hosts), (2) review any project scripts (test/build hooks) to avoid destructive actions, and (3) limit agent autonomy if you do not want it to execute commands without oversight. If you have secrets in the repo or tests that call external services, run verification in an environment with those secrets removed or mocked.

验证模式 (Verify Mode)

系统性地验证工作成果或假设。

使用时机

✅ 使用此技能当：

• 完成一段代码修改后需要验证
• "帮我检查一下这个改动有没有问题"
• 需要运行测试并分析结果
• 验证一个假设或排查一个 bug

❌ 不要使用当：

• 只是普通的代码 review（直接 review 即可）
• 改动很小且显而易见正确

验证流程

1. 确定验证目标

• 要验证什么？（功能正确性 / 性能 / 安全 / 兼容性）
• 成功标准是什么？
• 已知的风险点？

2. 静态检查

• 读改动的代码，检查逻辑正确性
• 检查边界条件和错误处理
• 检查是否引入了安全漏洞（注入、XSS 等）
• 检查是否破坏了已有接口或行为

3. 动态验证

• 运行已有的测试套件
• 如果没有测试，手动构造测试场景
• 检查构建是否通过
• 如果有 linter/formatter，运行一下

4. 输出验证报告

## 验证报告

### 验证对象
[简要描述被验证的改动/假设]

### 检查清单
- [x] 逻辑正确性: 通过/发现问题
- [x] 边界条件: ...
- [x] 测试结果: X pass / Y fail
- [x] 构建状态: 通过/失败
- [ ] 安全检查: ...

### 发现的问题
1. [问题描述 + 严重程度 + 建议修复方式]

### 结论
✅ 验证通过 / ⚠️ 有待修复的问题 / ❌ 验证失败

核心原则

• 全面但聚焦 — 覆盖主要风险点，但不要检查无关的东西
• 给出证据 — "测试 X 通过了"、"第 42 行可能有空指针"，不要泛泛地说"看起来没问题"
• 区分严重程度 — 阻塞性问题 vs 建议性改进
• 可操作 — 发现问题就给出具体修复建议