# verification

Adopt this skill: https://proskills.md/skills/other/aurite-ai-agent-verifier-skills-verification

Page: https://proskills.md/skills/other/aurite-ai-agent-verifier-skills-verification
This document is the public skill bundle for that page. It contains SKILL.md and every helper file the catalog carries. No login is required.

## File: skills/verification/SKILL.md
size: 7633
sha: 2326b37253122db9f85c5a532584a825f15c4516
upstream: https://github.com/aurite-ai/agent-verifier/blob/main/skills/verification/SKILL.md

````text
---
name: verification
version: "1.0.0"
description: Full agent verification suite. Runs security, patterns, quality, and language-specific checks. Use when asked to "verify agent", "verify my agent", "audit agent", or "full verification".
---

# Agent Verifier

## Purpose

Run comprehensive verification on AI agent code. This orchestrator invokes focused verification skills and consolidates results into a unified report. No telemetry or network calls of its own; the code is processed by the host coding agent and its model provider.

## When to Use

Trigger this skill when the user asks to:
- **"verify agent"** (primary invocation)
- "verify my agent"
- "audit agent"
- "full verification"
- "verify my code" (when agent patterns are detected)
- "check compliance"

## Available Verification Modes

| Command | Skill | What it checks |
|---------|-------|----------------|
| **"verify agent"** | This skill | Full suite (all below) |
| "verify agent security" | verify-security | Secrets, dependencies, input validation |
| "verify agent patterns" | verify-patterns | Loops, retries, tools, context size |
| "verify agent quality" | verify-quality | Naming, organization, documentation |
| "verify agent language" | verify-language | Type hints, idioms, language best practices |

## Process

### Step 1: Context Discovery

Scan the project to identify:

1. **Primary language:**
   - Check for `pyproject.toml`, `package.json`, `go.mod`
   - Look at file extensions in `src/` or project root

2. **Agent framework (if any):**
   - `langgraph` in imports → LangGraph
   - `crewai` in imports → CrewAI
   - `autogen` in imports → AutoGen
   - `langchain` in imports → LangChain
   - Direct SDK usage → Custom agent

3. **Kahuna integration:**
   - Check if `.kahuna/` directory exists
   - If yes, read `.kahuna/context-guide.md` for organizational rules

Record the detected context for reporting.

### Step 2: Run Security Checks

Load the **verify-security** skill and execute its process.

This checks for:
- Hardcoded secrets and API keys
- Dependency version pinning
- Input validation patterns
- Error message exposure
- Secure defaults

Record all findings.

### Step 3: Run Pattern Checks

Load the **verify-patterns** skill and execute its process.

This checks for:
- Loop safety (termination conditions)
- Retry limit enforcement
- Tool registry consistency
- Context size awareness
- LangGraph cycle analysis (if applicable)

Record all findings.

### Step 4: Run Quality Checks

Load the **verify-quality** skill and execute its process.

This checks for:
- Naming conventions
- Code organization
- Magic numbers/strings
- Documentation
- Error handling patterns

Record all findings.

### Step 5: Run Language-Specific Checks

Based on detected language, load the **verify-language** skill and execute its process.

**Python checks:**
- Type hints on public functions
- Docstrings
- Requirements pinning
- Python idioms

**TypeScript/JavaScript checks:**
- Strict mode enabled
- No `any` types
- Async/await error handling
- Promise handling

**Go checks:**
- No ignored errors
- Context propagation
- Package structure
- Go idioms

Record all findings.

### Step 6: Consolidate Report

Combine all findings from Steps 2-5 into a unified verification report.

#### Report Format

```markdown
# Agent Verification Report

**Project:** [project name or path]
**Date:** [current date]
**Mode:** [Kahuna-enhanced | Standalone]
**Language:** [Python | TypeScript | JavaScript | Go]
**Agent framework:** [LangGraph | CrewAI | AutoGen | LangChain | Custom | None]
**Files analyzed:** [count]

## Summary

✅ X checks passed | ⚠️ Y warnings | ❌ Z issues

### By Category
| Category | Pass | Warn | Issue |
|----------|------|------|-------|
| Security | X | X | X |
| Patterns | X | X | X |
| Quality | X | X | X |
| Language | X | X | X |

## Security

*(Summary from verify-security)*

- [x] No hardcoded secrets
- [x] Dependencies pinned
- [ ] ⚠️ [finding]
- [ ] ❌ [finding]

## Agent Patterns

*(Summary from verify-patterns — include only if agent detected)*

### Loop Safety
- [x] All loops have termination conditions
- [ ] ⚠️ Potential unbounded loop at `[file:line]`

### Retry Limits
- [x] All retry mechanisms have explicit limits
- [ ] ❌ Missing retry limit at `[file:line]`

### Tool Consistency
- [x] Tool registry found: X tools defined
- [ ] ❌ Hallucinated tool reference at `[file:line]`
- [ ] ⚠️ Undocumented tool: `[name]`

### Context Size
- [x] System prompt within limits (~X tokens)
- [ ] ⚠️ System prompt exceeds recommended size

## Quality

*(Summary from verify-quality)*

- [x] Naming conventions consistent
- [x] Code well-organized
- [ ] ⚠️ [finding]

## Language ([Python/TypeScript/Go])

*(Summary from verify-language)*

- [x] Type safety enforced
- [ ] ⚠️ [finding]
- [ ] ❌ [finding]

## Detailed Findings

> `[P]` = pattern-matched (structurally reliable) · `[H]` = heuristic (best-effort judgment)

### ✅ Passing
- `[P]` No hardcoded secrets or API keys
- `[P]` All retry decorators have stop conditions
- `[H]` Code organization follows best practices

### ⚠️ Warnings
- `[P|H]` [Check name]: [Description]
  - **Location:** [file:line]
  - **Category:** [Security | Patterns | Quality | Language]
  - **Suggestion:** [How to address]

### ❌ Issues
- `[P|H]` [Check name]: [Description]
  - **Location:** [file:line]
  - **Category:** [Security | Patterns | Quality | Language]
  - **Rule:** [Which rule this violates]
  - **Fix:** [Specific remediation steps]

## Recommendations

1. **[Highest priority]** - [Specific action]
2. **[Second priority]** - [Specific action]
3. [Additional improvements]

---

*Report generated by Agent Verifier v1.0.0*
```

### Step 7: Export Report (Optional)

After presenting the report, ask the user:

> Would you like to save this verification report to a file?

If confirmed:

1. Create the reports directory if it doesn't exist:
   ```bash
   mkdir -p reports/verification
   ```

2. Generate filename using the **current date and time** (NOT placeholders):
   - Get the actual current timestamp from your environment context
   - Format: `reports/verification/{date}_{time}.md`
   - Date format: `YYYY-MM-DD` (e.g., `2026-03-17`)
   - Time format: `HH-MM-SS` (e.g., `08-15-42` for 8:15:42 AM)
   
   **IMPORTANT:** Use the real current time, not zeros or placeholders. Check your system context for "Current Time" information.
   
   **Example:** If the current time is March 17, 2026 at 1:05:30 AM PST, the filename should be:
   `reports/verification/2026-03-17_01-05-30.md`

3. Save the complete report to that file.

## Check Tier Discipline

Throughout all verification steps, maintain tier discipline:

- **`[PATTERN]` checks** — Apply exactly as written. A rule says "flag X" → flag X. No judgment.
- **`[HEURISTIC]` checks** — Apply with judgment. Mark findings clearly with `[H]`.

Tag every finding in the report with `[P]` or `[H]` so readers understand confidence level.

## Notes

- **Privacy first:** This skill adds no telemetry and makes no network calls of its own. Do not tell users their code stays on their machine: it is processed by the host coding agent and its model provider.
- **Kahuna enhances, not requires:** The skill works standalone with built-in rules. Kahuna adds organization-specific knowledge.
- **Be specific:** Include file names and line numbers when reporting issues.
- **Explain the "why":** Help developers understand why each rule matters.
- **Honor existing configs:** Respect project's existing lint rules, `.editorconfig`, etc.
````

## File: README.md
upstream: https://github.com/aurite-ai/agent-verifier/blob/main/README.md

````text
<div align="center">

# 🔍 Aurite Agent Verifier

**Catch security issues, enforce standards, and validate agent patterns — before code ships.**

[![GitHub stars](https://img.shields.io/github/stars/aurite-ai/agent-verifier?style=social)](https://github.com/aurite-ai/agent-verifier/stargazers)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/aurite-ai/agent-verifier/pulls)
[![Last commit](https://img.shields.io/github/last-commit/aurite-ai/agent-verifier)](https://github.com/aurite-ai/agent-verifier/commits)
[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22125316.svg)](https://doi.org/10.5281/zenodo.22125316)

Works with **Claude Code** · **Cursor** · **Windsurf** · **Roo Code** · **Codex** · [30+ more](https://github.com/vercel-labs/skills#supported-agents)

![demo](assets/agent_verifier.gif)

</div>

---

## Why?

AI coding agents are powerful — but they skip linting, ignore security basics, and hallucinate tool calls. Code reviews catch some of this, but not consistently.

Agent Verifier is an AI agent skill that acts as an automated reviewer. It checks for:
- 🔒 **Security gaps** — hardcoded secrets, missing input validation, exposed stack traces
- 🔄 **Dangerous agent patterns** — infinite loops, unbounded retries, hallucinated tools
- 📏 **Code quality** — naming, docs, error handling, magic values
- 🐍🟦🐹 **Language-specific issues** — Python type hints, TypeScript strict mode, Go error handling

Install it once. It runs every time you say `"verify agent"`.

---

## Author's Note

> 💡 **If Agent Verifier looks interesting to you — or saves you a prod bug — consider [giving it a ⭐](https://github.com/aurite-ai/agent-verifier/stargazers).** It's the only signal GitHub gives us that this is worth maintaining and adding more capabilities to this repo.

> 🤝 **Contributions and feature requests welcome** — open an [issue](https://github.com/aurite-ai/agent-verifier/issues) or [PR](https://github.com/aurite-ai/agent-verifier/pulls) any time.

## What You Get

Run `"verify agent"` in your coding assistant (eg. Claude Code, Cursor or others) and get a structured report:

```
✅ 8 checks passed | ⚠️ 3 warnings | ❌ 2 issues

❌ Hardcoded API key at config.py:12
  → Move to environment variable

❌ Hallucinated tool reference: execute_sql
  → Tool referenced in prompts but not defined

⚠️ Unbounded loop at agent/loop.py:45
  → Add MAX_ITERATIONS constant

⚠️ System prompt exceeds recommended size (6.2K tokens)
  → Split into modular sections
```

> No telemetry and no network calls of its own. Your code is read by the coding agent you already use and handled under that agent's data policy.

<details>
<summary>See full report format</summary>

```markdown
# Verification Report

**Project:** my-project
**Date:** 2026-03-04
**Mode:** Standalone
**Files analyzed:** 12
**Agent type detected:** LangGraph

## Summary

✅ 8 checks passed | ⚠️ 3 warnings | ❌ 2 issues

### By Category
| Category | Pass | Warn | Issue |
|----------|------|------|-------|
| Code Quality | 5 | 1 | 0 |
| Security | 2 | 0 | 1 |
| Agent Patterns | 1 | 2 | 1 |

## Agent Pattern Analysis

### Loop Safety
- [x] All retry mechanisms have explicit limits
- [ ] ⚠️ Potential unbounded loop at `agent/loop.py:45`

### Tool Consistency
- [x] Tool registry found: 5 tools defined
- [ ] ❌ 1 hallucinated tool reference in prompts

### Context Management
- [ ] ⚠️ System prompt exceeds recommended size (6.2K tokens)
- [x] Tool descriptions within limits

## Findings

### ✅ Passing
- Naming conventions: Consistent camelCase used throughout
- Error handling: All async functions have try/catch

### ⚠️ Warnings
- Missing type hints: `utils.py:45`
  - **Location:** `utils.py:45`
  - **Suggestion:** Add type hints to `process_data()` function

### ❌ Issues
- Hardcoded API key: `config.py:12`
  - **Location:** `config.py:12`
  - **Rule:** No secrets in source code
  - **Fix:** Move to environment variable

## Recommendations

1. Move API keys to environment variables
2. Add type hints to public functions

## Agent-Specific Recommendations

1. **Loop Safety:** Add `MAX_ITERATIONS` constant to `agent/loop.py`
2. **Tool Registry:** Remove or implement `execute_sql` tool
3. **Context Management:** Split system prompt into modular sections
```

</details>

---

## Quickstart

```bash
# Install (works with Claude Code, Roo Code, Cursor, and 30+ agents)
npx skills add aurite-ai/agent-verifier -a claude-code -a cursor -a <your-fav-coding-agent>

# Then in your agent folder just ask your coding assistant (eg. Claude Code, Cursor, or others):
verify agent
```

### Install as a Claude Code plugin

```bash
# Add the marketplace, then install the plugin
claude plugin marketplace add aurite-ai/agent-verifier
claude plugin install agent-verifier@aurite-ai
```

That's it. For more installation options, see [Installation](#installation).

### Learn More

New to Agent Verifier? These guides walk you through everything:

- **[Getting Started](docs/getting-started.md)** — Install and run your first verification in 5 minutes
- **[Tutorials](docs/tutorials/)** — Step-by-step guides:
  - [Installation](docs/tutorials/01-installation.md) — Detailed installation options
  - [First Verification](docs/tutorials/02-first-verification.md) — Run your first verification
  - [Understanding Reports](docs/tutorials/03-understanding-reports.md) — Interpret and prioritize findings
  - [Focused Checks](docs/tutorials/04-focused-checks.md) — Use individual verification skills

The rest of this README serves as a technical reference.

---

## Contributions

We welcome contributions of all kinds! Here's how you can help:

- 🐛 **Found a bug?** [Open an issue](https://github.com/aurite-ai/agent-verifier/issues)
- 💡 **Want a new check?** [Open a feature request](https://github.com/aurite-ai/agent-verifier/issues/new)
- 🔧 **Want to contribute code?** [Open a PR](https://github.com/aurite-ai/agent-verifier/pulls)

---

## Table of Contents

- [Why?](#why)
- [What You Get](#what-you-get)
- [Quickstart](#quickstart)
- [Architecture](#architecture)
- [Available Skills](#available-skills)
- [Installation](#installation)
- [Updating Installed Skills](#updating-installed-skills)
- [Usage](#usage)
- [Features](#features)
- [How It Compares](#how-it-compares)
- [Check Reliability](#check-reliability)
- [Privacy](#privacy)
- [Contributing](#contributing)
- [Citation](#citation)
- [License](#license)

---

## Architecture

```
┌─────────────────────────────────────────────────────────────┐
│                      verification                           │
│                 Full Suite Orchestrator                     │
│                 trigger: "verify agent"                     │
└───────────┬───────────┬───────────┬───────────┬─────────────┘
            │           │           │           │
            ▼           ▼           ▼           ▼
    ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐
    │  verify-  │ │  verify-  │ │  verify-  │ │  verify-  │
    │ security  │ │ patterns  │ │  quality  │ │ language  │
    ├───────────┤ ├───────────┤ ├───────────┤ ├───────────┤
    │ • secrets │ │ • loops   │ │ • naming  │ │ • Python  │
    │ • deps    │ │ • retries │ │ • docs    │ │ • TypeScript│
    │ • input   │ │ • tools   │ │ • errors  │ │ • Go      │
    │ • errors  │ │ • context │ │ • magic   │ │           │
    └───────────┘ └───────────┘ └───────────┘ └───────────┘

Each skill can run independently: "verify agent security", "verify agent patterns", etc.
```

## Available Skills

| Skill | Purpose |
|-------|---------|
| `verification` | Full verification suite (orchestrator) — runs all checks below |
| `verify-security` | Security checks (secrets, input validation, dependencies) |
| `verify-patterns` | Agent patterns (loops, retries, tools, context) |
| `verify-quality` | Code quality (naming, organization, docs) |
| `verify-language` | La
````