verification

2 files shipped with this skill. Inline text is the catalog copy. The upstream link is the source repository.

• skills/verification/SKILL.md7.5 KB2326b3725312upstream ↗

  ---
  name: verification
  version: "1.0.0"
  description: Full agent verification suite. Runs security, patterns, quality, and language-specific checks. Use when asked to "verify agent", "verify my agent", "audit agent", or "full verification".
  ---
  
  # Agent Verifier
  
  ## Purpose
  
  Run comprehensive verification on AI agent code. This orchestrator invokes focused verification skills and consolidates results into a unified report. No telemetry or network calls of its own; the code is processed by the host coding agent and its model provider.
  
  ## When to Use
  
  Trigger this skill when the user asks to:
  - **"verify agent"** (primary invocation)
  - "verify my agent"
  - "audit agent"
  - "full verification"
  - "verify my code" (when agent patterns are detected)
  - "check compliance"
  
  ## Available Verification Modes
  
  | Command | Skill | What it checks |
  |---------|-------|----------------|
  | **"verify agent"** | This skill | Full suite (all below) |
  | "verify agent security" | verify-security | Secrets, dependencies, input validation |
  | "verify agent patterns" | verify-patterns | Loops, retries, tools, context size |
  | "verify agent quality" | verify-quality | Naming, organization, documentation |
  | "verify agent language" | verify-language | Type hints, idioms, language best practices |
  
  ## Process
  
  ### Step 1: Context Discovery
  
  Scan the project to identify:
  
  1. **Primary language:**
     - Check for `pyproject.toml`, `package.json`, `go.mod`
     - Look at file extensions in `src/` or project root
  
  2. **Agent framework (if any):**
     - `langgraph` in imports → LangGraph
     - `crewai` in imports → CrewAI
     - `autogen` in imports → AutoGen
     - `langchain` in imports → LangChain
     - Direct SDK usage → Custom agent
  
  3. **Kahuna integration:**
     - Check if `.kahuna/` directory exists
     - If yes, read `.kahuna/context-guide.md` for organizational rules
  
  Record the detected context for reporting.
  
  ### Step 2: Run Security Checks
  
  Load the **verify-security** skill and execute its process.
  
  This checks for:
  - Hardcoded secrets and API keys
  - Dependency version pinning
  - Input validation patterns
  - Error message exposure
  - Secure defaults
  
  Record all findings.
  
  ### Step 3: Run Pattern Checks
  
  Load the **verify-patterns** skill and execute its process.
  
  This checks for:
  - Loop safety (termination conditions)
  - Retry limit enforcement
  - Tool registry consistency
  - Context size awareness
  - LangGraph cycle analysis (if applicable)
  
  Record all findings.
  
  ### Step 4: Run Quality Checks
  
  Load the **verify-quality** skill and execute its process.
  
  This checks for:
  - Naming conventions
  - Code organization
  - Magic numbers/strings
  - Documentation
  - Error handling patterns
  
  Record all findings.
  
  ### Step 5: Run Language-Specific Checks
  
  Based on detected language, load the **verify-language** skill and execute its process.
  
  **Python checks:**
  - Type hints on public functions
  - Docstrings
  - Requirements pinning
  - Python idioms
  
  **TypeScript/JavaScript checks:**
  - Strict mode enabled
  - No `any` types
  - Async/await error handling
  - Promise handling
  
  **Go checks:**
  - No ignored errors
  - Context propagation
  - Package structure
  - Go idioms
  
  Record all findings.
  
  ### Step 6: Consolidate Report
  
  Combine all findings from Steps 2-5 into a unified verification report.
  
  #### Report Format
  
  ```markdown
  # Agent Verification Report
  
  **Project:** [project name or path]
  **Date:** [current date]
  **Mode:** [Kahuna-enhanced | Standalone]
  **Language:** [Python | TypeScript | JavaScript | Go]
  **Agent framework:** [LangGraph | CrewAI | AutoGen | LangChain | Custom | None]
  **Files analyzed:** [count]
  
  ## Summary
  
  ✅ X checks passed | ⚠️ Y warnings | ❌ Z issues
  
  ### By Category
  | Category | Pass | Warn | Issue |
  |----------|------|------|-------|
  | Security | X | X | X |
  | Patterns | X | X | X |
  | Quality | X | X | X |
  | Language | X | X | X |
  
  ## Security
  
  *(Summary from verify-security)*
  
  - [x] No hardcoded secrets
  - [x] Dependencies pinned
  - [ ] ⚠️ [finding]
  - [ ] ❌ [finding]
  
  ## Agent Patterns
  
  *(Summary from verify-patterns — include only if agent detected)*
  
  ### Loop Safety
  - [x] All loops have termination conditions
  - [ ] ⚠️ Potential unbounded loop at `[file:line]`
  
  ### Retry Limits
  - [x] All retry mechanisms have explicit limits
  - [ ] ❌ Missing retry limit at `[file:line]`
  
  ### Tool Consistency
  - [x] Tool registry found: X tools defined
  - [ ] ❌ Hallucinated tool reference at `[file:line]`
  - [ ] ⚠️ Undocumented tool: `[name]`
  
  ### Context Size
  - [x] System prompt within limits (~X tokens)
  - [ ] ⚠️ System prompt exceeds recommended size
  
  ## Quality
  
  *(Summary from verify-quality)*
  
  - [x] Naming conventions consistent
  - [x] Code well-organized
  - [ ] ⚠️ [finding]
  
  ## Language ([Python/TypeScript/Go])
  
  *(Summary from verify-language)*
  
  - [x] Type safety enforced
  - [ ] ⚠️ [finding]
  - [ ] ❌ [finding]
  
  ## Detailed Findings
  
  > `[P]` = pattern-matched (structurally reliable) · `[H]` = heuristic (best-effort judgment)
  
  ### ✅ Passing
  - `[P]` No hardcoded secrets or API keys
  - `[P]` All retry decorators have stop conditions
  - `[H]` Code organization follows best practices
  
  ### ⚠️ Warnings
  - `[P|H]` [Check name]: [Description]
    - **Location:** [file:line]
    - **Category:** [Security | Patterns | Quality | Language]
    - **Suggestion:** [How to address]
  
  ### ❌ Issues
  - `[P|H]` [Check name]: [Description]
    - **Location:** [file:line]
    - **Category:** [Security | Patterns | Quality | Language]
    - **Rule:** [Which rule this violates]
    - **Fix:** [Specific remediation steps]
  
  ## Recommendations
  
  1. **[Highest priority]** - [Specific action]
  2. **[Second priority]** - [Specific action]
  3. [Additional improvements]
  
  ---
  
  *Report generated by Agent Verifier v1.0.0*
  ```
  
  ### Step 7: Export Report (Optional)
  
  After presenting the report, ask the user:
  
  > Would you like to save this verification report to a file?
  
  If confirmed:
  
  1. Create the reports directory if it doesn't exist:
     ```bash
     mkdir -p reports/verification
     ```
  
  2. Generate filename using the **current date and time** (NOT placeholders):
     - Get the actual current timestamp from your environment context
     - Format: `reports/verification/{date}_{time}.md`
     - Date format: `YYYY-MM-DD` (e.g., `2026-03-17`)
     - Time format: `HH-MM-SS` (e.g., `08-15-42` for 8:15:42 AM)
     
     **IMPORTANT:** Use the real current time, not zeros or placeholders. Check your system context for "Current Time" information.
     
     **Example:** If the current time is March 17, 2026 at 1:05:30 AM PST, the filename should be:
     `reports/verification/2026-03-17_01-05-30.md`
  
  3. Save the complete report to that file.
  
  ## Check Tier Discipline
  
  Throughout all verification steps, maintain tier discipline:
  
  - **`[PATTERN]` checks** — Apply exactly as written. A rule says "flag X" → flag X. No judgment.
  - **`[HEURISTIC]` checks** — Apply with judgment. Mark findings clearly with `[H]`.
  
  Tag every finding in the report with `[P]` or `[H]` so readers understand confidence level.
  
  ## Notes
  
  - **Privacy first:** This skill adds no telemetry and makes no network calls of its own. Do not tell users their code stays on their machine: it is processed by the host coding agent and its model provider.
  - **Kahuna enhances, not requires:** The skill works standalone with built-in rules. Kahuna adds organization-specific knowledge.
  - **Be specific:** Include file names and line numbers when reporting issues.
  - **Explain the "why":** Help developers understand why each rule matters.
  - **Honor existing configs:** Respect project's existing lint rules, `.editorconfig`, etc.
  

• README.mdupstream ↗

  Contents are not inlined in the catalog. Open the upstream file.

Plain-text copy, no login: /skill-bundles/aurite-ai-agent-verifier-skills-verification.md