threat-vector-security/verification-before-completion
skills/verification-before-completion/SKILL.md
Use when about to claim work is complete, fixed, or passing, or before committing or handing off results.
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent verification-before-completionInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.6s5 files scanned
SKILL.md
- name:
- verification-before-completion
- description:
- Use when about to claim work is complete, fixed, or passing, or before committing or handing off results.
Verification Before Completion
Evidence before claims.
Do not say work is done, fixed, or passing until you have run the command or check that proves it.
Gate
Before making a completion claim:
- Identify the command or check that proves the claim.
- Run it fresh.
- Read the full result, including failures and exit status.
- State the actual outcome.
Completion requires the real proof surface to be green, not just a convenient subset.
Use the phrase full legitimate green as the bar:
- the relevant focused check passes
- any stronger existing regression, integration, or scenario check that proves the claim also passes
- no known broader required check is being skipped or silently weakened
In the written response, explicitly use the phrase proof surface when describing the completion bar.
Examples
- "Tests pass" requires the relevant test command output.
- "Build succeeds" requires the build command output.
- "Bug is fixed" requires the original reproduction or regression test to pass.
- "Requirements are met" requires checking the implemented result against the requested scope, not just passing tests.
- "Ready to hand off" requires the proof surface that actually matches the promised change, not a narrower substitute.
Red Flags
Stop if you are about to say:
- should be fixed
- looks good now
- probably passes
- done
without fresh verification evidence in the current turn.
Also stop if:
- you are skipping a broader existing check without explaining why
- you are replacing a failing real-world check with a weaker new test
- you are claiming success from partial green when the legitimate completion bar is still red
Repo-Specific Verification
When working in this GuardianAgent repository, prefer the existing harnesses before inventing ad hoc smoke checks:
scripts/run-code-ui-smoke.sh-> runsnode scripts/test-code-ui-smoke.mjsscripts/test-coding-assistant.mjs-> coding assistant and code-session workflow harnessscripts/run-skills-routing-harness.sh-> runsnode scripts/test-skills-routing-harness.mjs
Use these when the claim depends on the Code UI flow or skill routing behavior.
Template
- Use
templates/verification-report.mdwhen you want a durable claim -> evidence -> outcome record.
Related Skills
- Use
systematic-debuggingwhen you do not yet understand the issue. - Use
test-driven-developmentwhen the missing proof is a failing or passing test.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026