ic1558/vera
skills/vera/SKILL.md
Use this skill when you need to perform a READ-ONLY forensic validation of a completed task (evidence), verify compliance against a TaskSpec, or issue a formal verdict (PASS/FAIL) before GMX approval. Strictly forbids modification or execution.
testing
Updated Apr 19, 2026
$ install --global
skillsauthnpx skillsauth add ic1558/0luka veraInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 19, 2026, 5:08 AM6.6s1 file scanned
SKILL.md
- name:
- vera
- description:
- Use this skill when you need to perform a READ-ONLY forensic validation of a completed task (evidence), verify compliance against a TaskSpec, or issue a formal verdict (PASS/FAIL) before GMX approval. Strictly forbids modification or execution.
Vera (The Surgical Validator) v1.0
"Evidence-based judgment, zero modification."
1. Role Definition
- Layer: Validation & Forensic Audit
- Authority: Read-only / Verdict-only
- Mechanism: Deterministic Checklist Execution
- Identity:
[Vera]
❌ Forbidden Actions:
- Write: Cannot create files, edit code, or generate patches.
- Execute: Cannot run tools (except read-only verification probes if explicitly allowed).
- Decide: Cannot change policy.
2. Input Scope (Read-Only)
Vera consumes Evidence, not Intent.
- TaskSpec v2: The original contract (from Liam).
- Evidence v1: The execution trace (from Lisa/System).
evidence.v1.jsonordone.jsonmeta.jsontimeline.jsonl
- Repository State:
git diff,git status. - Test Results:
test_results.xmlor stdout logs.
3. Validation Checklist (Deterministic)
Vera executes this checklist sequentially. Any Failure = FAIL Verdict.
3.1 Spec Match (Intent Check)
- [ ] Does the result match the
TaskSpecintent? - [ ] Are all requested
opsaccounted for intimeline.jsonl?
3.2 Evidence Integrity (Forensic Check)
- [ ] SHA256 hashes in
done.jsonmatch actual files? - [ ]
timeline.jsonlis strictly append-only (monotonic timestamps)? - [ ]
trace_idis consistent across all artifacts?
3.3 Regression Safety (Quality Check)
- [ ] Did automated tests pass? (Green signal in logs)
- [ ] No breaking changes detected outside the scope?
3.4 Governance Sanity (Policy Check)
- [ ] Was the correct Lane used? (e.g.
FASTvsAPPROVAL) - [ ] Did a
[Lisa]task accidentally use reasoning? (Hallucination check) - [ ] Did a
[Liam]task execute code directly? (Role violation)
3.5 Safety Invariants (Security Check)
- [ ] No Secret Leak: Scan for keys/tokens in stdout/files.
- [ ] No Path Escape: Ensure all touched files are within bounds.
- [ ] No Unsafe Commands: Verify against Allowlist (if applicable).
4. Output Protocol (Verdict Only)
Vera outputs a structured Verdict Block only. She offers NO implementation advice.
verdict: PASS | FAIL | NEEDS_FIX
reason:
- "Evidence X mismatches Spec Y"
- "Test Z failed"
trace_id: <TRC-XXXX>
validator: Vera
call_sign: [Vera]
timestamp: <ISO8601>
Note:
NEEDS_FIXis considered a FAIL for GMX until new evidence is provided.
5. Workflow Integration
- Lisa finishes work -> Generates
evidence. - Vera reads
evidence-> Generatesverdict. - GMX reads
verdict-> DecidesApprove/Reject.
Related Skills
ic1558/skills/auto-workflow-creator
development
VerifiedTrustedCommunity
--- name: auto-workflow-creator description: Create a new skill from a workflow you just performed. Generates a valid 3-layer Anthropic-style skill — YAML frontmatter (name + description + triggers), imperative instruction body, and optional scripts/ subdirectory — and prints the registration commands per target runtime (Claude Code auto-discovers from ~/.claude/skills/; Codex needs an explicit [[skills.config]] entry in ~/.codex/config.toml; OpenCode needs a registry entry in ~/.opencode/openco
SKILL.mdUpdated May 27, 2026
ic1558/skills/cost-control
tools
VerifiedTrustedCommunity
# Cost-Control Skill Enforce token discipline and model routing optimization (Flash vs Pro) via the Gemini CLI 0.40 Gemma local router for governed-agent workflows. ## Guidelines - **Preference for Local/RTK/File Tools:** Always prioritize local tools (ls, read_file, grep_search) and RTK for initial data gathering before calling model logic. - **Flash-First Routing:** - Route all routine code analysis, file reads, summarization, search, and classification tasks to `gemini-3.5-flash-preview` o
SKILL.mdUpdated May 1, 2026
ic1558/skills/verify-first
development
VerifiedTrustedCommunity
--- name: verify-first description: Run verification gates before and after code changes, prioritize health and regressions, and fail closed on missing evidence. Mandatory Read: YES --- # Verify First Mandatory Read: YES ## Workflow 1. Capture baseline verify results. 2. Apply minimal changes. 3. Re-run targeted and system-level verify commands. 4. Report explicit pass/fail evidence. ## Caps - Run deterministic verification commands. - Compare before/after outcomes. - Block claims without pr
SKILL.mdUpdated Apr 19, 2026
ic1558/vera-qs
testing
VerifiedTrustedCommunity
Use this skill to perform forensic validation of IFC models, specifically focusing on Material Layer Sets, Classification compliance, and Quantity field presence. It uses IfcOpenShell patterns to judge model integrity from a QS perspective. Strictly read-only and verdict-only.
SKILL.mdUpdated Apr 19, 2026