Habilidades Verification & Quality Assurance
📦
Verification & Quality Assurance
Revisión del contenido r1 Riesgo medio ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno
Verifica la calidad del código con las guardas de Ruflo
El código y las salidas de agentes pueden sufrir regresiones sin señales claras. Esta skill documenta las guardas de verificación de Ruflo, las puntuaciones de veracidad, los informes y los flujos de rollback para Claude, Codex y Claude Code.
Compatible con: Claude Codex Code(CC)
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "Verification & Quality Assurance" from https://skillstore.io/skills/ruvnet-verification-quality-assurance.md and its manifest at https://skillstore.io/api/skills/ruvnet-verification-quality-assurance/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "Verification & Quality Assurance". Un ingeniero de releases pregunta si un paquete está listo para publicarse.
Resultado esperado:
- Las comprobaciones recomendadas incluyen verificación local, smoke tests de CI, verificación de witness y revisión de informes.
- No se recomienda el rollback hasta que el working tree tenga backup y se hayan identificado los archivos fallidos.
Usando "Verification & Quality Assurance". Un ingeniero DevOps quiere verificación en flujos de pull request.
Resultado esperado:
- La respuesta describe una puerta de calidad con instalación de dependencias, ejecución de verificación, revisión de puntuación y carga de artefactos.
- También señala que las exportaciones de monitoreo externas necesitan aprobación y redacción de secretos.
Usando "Verification & Quality Assurance". Un líder de IA quiere evaluar código generado por varios agentes.
Resultado esperado:
- La respuesta compara tendencias de puntuación de veracidad, criterios fallidos, frecuencia de rollback y formatos de informes.
- Separa las guardas de Ruflo ya disponibles de las funciones de dashboard que son solo de diseño.
Auditoría de seguridad
Riesgo mediov9 • 20/7/2026 Abrir el informe versionado
Most static alerts are false positives caused by Markdown code fences, inline code, and fixed local command examples. The audit confirms unpinned ruflo@alpha execution, optional telemetry that sends report data and a key, and a predictable temporary file in the hook example. The guide also documents rollback actions that need stronger destructive-action safeguards.
1
Archivos escaneados
692
Líneas analizadas
62
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (2)
Medio
Destructive rollback guidance lacks a mandatory preview
The guide presents rollback commands that can revert to a previous commit, including a hard git reset, without making a dry run, backup, or explicit confirmation mandatory.
The cited instructions explicitly include rollback and git reset --hard commands. The same document offers preview and backup options, but does not require them before destructive actions.
Bajo
Feature claims exceed the documented shipped implementation
The skill describes truth scoring, automatic rollback, and a WebSocket dashboard as capabilities, but states that these surfaces are only partly shipped or design work.
The capability list appears at lines 11 through 18, while line 20 expressly distinguishes shipped CI guards from partly shipped or design features.
Elementos de revisión de capacidades (62)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Generic API/secret keys
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The example expands DD_API_KEY directly into an external request URL. URL query strings can be retained by logs, proxies, and process displays.
Medio
Ruby/shell backtick execution
- Ruflo installed (`npx ruflo@alpha`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
- `@noble/ed25519` (for the witness verifier — a single runtime dep, `npm i @noble/ed25519`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
- `npx ruflo@alpha pair` - Collaborative development with verification
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
- `npx ruflo@alpha train` - Training with verification feedback
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
- `npx ruflo@alpha swarm` - Multi-agent coordination with quality checks
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Ruby/shell backtick execution
- `npx ruflo@alpha report` - Generate comprehensive project reports
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medio
Hardcoded URL
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The optional example posts generated report data and an environment-sourced API key to an external DataDog endpoint. Users must explicitly authorize that telemetry transfer.
Medio
Temp directory access
npx ruflo@alpha verify check --threshold 0.95 --json > /tmp/verify.json
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Medio
Temp directory access
score=$(jq '.overallScore' /tmp/verify.json)
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Factores de riesgo
⚙️ Comandos externos (50)
SKILL.md:20 SKILL.md:24 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:35-55 SKILL.md:55-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:65-68 SKILL.md:68 SKILL.md:72-84 SKILL.md:84-97 SKILL.md:97-109 SKILL.md:109-112 SKILL.md:112-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133-138 SKILL.md:138-158 SKILL.md:158-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-186 SKILL.md:186-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-222 SKILL.md:222-260 SKILL.md:260-283 SKILL.md:283-292 SKILL.md:292-301 SKILL.md:301-304 SKILL.md:304-313 SKILL.md:313-327 SKILL.md:327-339 SKILL.md:339-342 SKILL.md:342-354 SKILL.md:354-371 SKILL.md:371-383 SKILL.md:383-398 SKILL.md:398-400 SKILL.md:400-430 SKILL.md:430-435 SKILL.md:435-444
🌐 Acceso a red (3)
📁 Acceso al sistema de archivos (3)
🔑 Variables de entorno (1)
Auditado por: claude Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-verification-quality-assurance/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/ruvnet-verification-quality-assurance.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
ruvnet. (2026). Verification & Quality Assurance security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9Cita BibTeX
@techreport{ruvnet-ruvnet-verification-quality-assurance-2026,
author = {ruvnet},
title = {Verification & Quality Assurance security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Verification & Quality Assurance security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9"
identifiers:
- type: other
value: "skillstore:ruvnet-verification-quality-assurance:audit:9"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Alto 55
Arquitectura
85
Mantenibilidad
87
Contenido
71
Comunidad
61
Cumplimiento de la especificación
Lo que puedes crear
Validar la preparación de una release
Ejecuta las comprobaciones de verificación documentadas antes de publicar un paquete o fusionar un cambio de alto riesgo.
Agregar puertas de calidad en CI
Usa los ejemplos de CI para exigir resultados de verificación antes de aceptar pull requests.
Revisar salidas de agentes
Aplica flujos de puntuación de veracidad e informes para evaluar código generado antes de que llegue a los usuarios.
Prueba estos prompts
Elegir una comprobación básica
Usa esta skill para elegir una comprobación básica de verificación de Ruflo para mi repositorio. Incluye qué significa el resultado y cuándo el rollback no es seguro.
Planificar la verificación en CI
Usa esta skill para diseñar una puerta de verificación de CI para mi proyecto. Resume las comprobaciones, los informes y el manejo de fallos necesarios.
Evaluar la seguridad del rollback
Usa esta skill para revisar un resultado de verificación fallido. Recomienda una ruta de rollback solo después de listar los pasos de backup y confirmación.
Auditar la cobertura de verificación
Usa esta skill para auditar nuestra cobertura de verificación en smoke tests, witness manifests, descripciones de herramientas, informes y exportaciones de monitoreo.
Mejores prácticas
- Ejecuta la verificación antes de decisiones de merge, release o rollback automatizado.
- Revisa los informes generados antes de enviarlos a sistemas de monitoreo externos.
- Usa pasos de dry-run y backup antes de cualquier comando de rollback.
Evitar
- No trates las funciones aspiracionales de dashboard como funcionalidad instalada.
- No ejecutes comandos de rollback o reset sin aprobación explícita del usuario.
- No coloques API keys en URLs ni en informes de verificación compartidos.
Preguntas frecuentes
¿Esta skill implementa la verificación de Ruflo en sí?
No. Documenta flujos de verificación de Ruflo, comandos, informes y patrones de guardas de CI.
¿Puede usarse con Claude, Codex y Claude Code?
Sí. El informe enumera soporte para Claude, Codex y Claude Code.
¿Cuál es la principal preocupación de seguridad?
La guía de rollback puede descartar cambios locales si los comandos se ejecutan sin backup y confirmación.
¿Las URLs de monitoreo son llamadas de red automáticas?
No. Son ejemplos de documentación para exportaciones configuradas explícitamente por el usuario.
¿Qué deben verificar los usuarios antes de usarla?
Los usuarios deben confirmar la disponibilidad de Ruflo alpha, el estado del repositorio, la versión de Node.js y las rutas de archivos de CI.
¿Cómo deben usar los equipos el umbral de puntuación de veracidad?
Los equipos deben establecer umbrales más estrictos para código de producción y umbrales más bajos para experimentos.