스킬 Verification & Quality Assurance
📦
Verification & Quality Assurance
콘텐츠 리비전 r1 중간 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수
Ruflo 가드로 코드 품질 검증하기
코드와 에이전트 출력은 명확한 신호 없이도 회귀할 수 있습니다. 이 스킬은 Claude, Codex, Claude Code를 위한 Ruflo 검증 가드, 진실성 점수, 보고서, 롤백 워크플로를 문서화합니다.
지원: Claude Codex Code(CC)
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "Verification & Quality Assurance" from https://skillstore.io/skills/ruvnet-verification-quality-assurance.md and its manifest at https://skillstore.io/api/skills/ruvnet-verification-quality-assurance/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"Verification & Quality Assurance" 사용 중입니다. 릴리스 엔지니어가 패키지를 게시할 준비가 되었는지 묻습니다.
예상 결과:
- 권장 검사는 로컬 검증, CI 스모크 테스트, 증거 검증, 보고서 검토를 포함합니다.
- 작업 트리가 백업되고 실패한 파일이 식별될 때까지 롤백은 권장되지 않습니다.
"Verification & Quality Assurance" 사용 중입니다. DevOps 엔지니어가 풀 리퀘스트 워크플로에 검증을 추가하려고 합니다.
예상 결과:
- 응답은 의존성 설치, 검증 실행, 점수 검토, 아티팩트 업로드를 포함한 품질 게이트를 개요로 제시합니다.
- 또한 외부 모니터링 내보내기에는 승인과 비밀 정보 삭제가 필요하다고 언급합니다.
"Verification & Quality Assurance" 사용 중입니다. AI 리드가 여러 에이전트가 생성한 코드를 평가하려고 합니다.
예상 결과:
- 응답은 진실성 점수 추세, 실패한 기준, 롤백 빈도, 보고서 형식을 비교합니다.
- 출시된 Ruflo 가드와 설계 전용 대시보드 기능을 구분합니다.
보안 감사
중간 위험v9 • 2026. 7. 20. 버전별 보고서 열기
Most static alerts are false positives caused by Markdown code fences, inline code, and fixed local command examples. The audit confirms unpinned ruflo@alpha execution, optional telemetry that sends report data and a key, and a predictable temporary file in the hook example. The guide also documents rollback actions that need stronger destructive-action safeguards.
1
스캔된 파일
692
분석된 줄 수
62
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (2)
중간
Destructive rollback guidance lacks a mandatory preview
The guide presents rollback commands that can revert to a previous commit, including a hard git reset, without making a dry run, backup, or explicit confirmation mandatory.
The cited instructions explicitly include rollback and git reset --hard commands. The same document offers preview and backup options, but does not require them before destructive actions.
낮음
Feature claims exceed the documented shipped implementation
The skill describes truth scoring, automatic rollback, and a WebSocket dashboard as capabilities, but states that these surfaces are only partly shipped or design work.
The capability list appears at lines 11 through 18, while line 20 expressly distinguishes shipped CI guards from partly shipped or design features.
기능 검토 항목 (62)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
Generic API/secret keys
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The example expands DD_API_KEY directly into an external request URL. URL query strings can be retained by logs, proxies, and process displays.
중간
Ruby/shell backtick execution
- Ruflo installed (`npx ruflo@alpha`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
- `@noble/ed25519` (for the witness verifier — a single runtime dep, `npm i @noble/ed25519`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
- `npx ruflo@alpha pair` - Collaborative development with verification
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
- `npx ruflo@alpha train` - Training with verification feedback
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
- `npx ruflo@alpha swarm` - Multi-agent coordination with quality checks
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Ruby/shell backtick execution
- `npx ruflo@alpha report` - Generate comprehensive project reports
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
중간
Hardcoded URL
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The optional example posts generated report data and an environment-sourced API key to an external DataDog endpoint. Users must explicitly authorize that telemetry transfer.
중간
Temp directory access
npx ruflo@alpha verify check --threshold 0.95 --json > /tmp/verify.json
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
중간
Temp directory access
score=$(jq '.overallScore' /tmp/verify.json)
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:20 SKILL.md:24 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:35-55 SKILL.md:55-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:65-68 SKILL.md:68 SKILL.md:72-84 SKILL.md:84-97 SKILL.md:97-109 SKILL.md:109-112 SKILL.md:112-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133-138 SKILL.md:138-158 SKILL.md:158-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-186 SKILL.md:186-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-222 SKILL.md:222-260 SKILL.md:260-283 SKILL.md:283-292 SKILL.md:292-301 SKILL.md:301-304 SKILL.md:304-313 SKILL.md:313-327 SKILL.md:327-339 SKILL.md:339-342 SKILL.md:342-354 SKILL.md:354-371 SKILL.md:371-383 SKILL.md:383-398 SKILL.md:398-400 SKILL.md:400-430 SKILL.md:430-435 SKILL.md:435-444
🌐 네트워크 접근 (3)
📁 파일 시스템 접근 (3)
🔑 환경 변수 (1)
감사자: claude 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-verification-quality-assurance/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/ruvnet-verification-quality-assurance.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
ruvnet. (2026). Verification & Quality Assurance security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9BibTeX 인용
@techreport{ruvnet-ruvnet-verification-quality-assurance-2026,
author = {ruvnet},
title = {Verification & Quality Assurance security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Verification & Quality Assurance security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9"
identifiers:
- type: other
value: "skillstore:ruvnet-verification-quality-assurance:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 높음 55
아키텍처
85
유지보수성
87
콘텐츠
71
커뮤니티
61
사양 준수
만들 수 있는 것
릴리스 준비 상태 검증
패키지를 게시하거나 고위험 변경 사항을 병합하기 전에 문서화된 검증 검사를 실행합니다.
CI 품질 게이트 추가
풀 리퀘스트가 승인되기 전에 검증 결과를 요구하도록 CI 예제를 사용합니다.
에이전트 출력 검토
생성된 코드가 사용자에게 도달하기 전에 평가하기 위해 진실성 점수와 보고서 워크플로를 적용합니다.
이 프롬프트를 사용해 보세요
기본 검사 선택
이 스킬을 사용해 내 저장소에 적합한 기본 Ruflo 검증 검사를 선택하세요. 결과가 의미하는 바와 롤백이 안전하지 않은 시점을 포함하세요.
CI 검증 계획
이 스킬을 사용해 내 프로젝트를 위한 CI 검증 게이트를 설계하세요. 필요한 검사, 보고서, 실패 처리 방식을 요약하세요.
롤백 안전성 평가
이 스킬을 사용해 실패한 검증 결과를 검토하세요. 백업 및 확인 단계를 먼저 나열한 후에만 롤백 경로를 권장하세요.
검증 범위 감사
이 스킬을 사용해 스모크 테스트, 증거 매니페스트, 도구 설명, 보고서, 모니터링 내보내기 전반의 검증 범위를 감사하세요.
모범 사례
- 병합, 릴리스 또는 자동 롤백 결정을 내리기 전에 검증을 실행하세요.
- 생성된 보고서를 외부 모니터링 시스템으로 보내기 전에 검토하세요.
- 모든 롤백 명령 전에 dry-run 및 백업 단계를 사용하세요.
피하기
- 지향점에 가까운 대시보드 기능을 설치된 기능으로 간주하지 마세요.
- 명시적인 사용자 승인 없이 롤백 또는 reset 명령을 실행하지 마세요.
- API 키를 URL이나 공유 검증 보고서에 넣지 마세요.
자주 묻는 질문
이 스킬이 Ruflo 검증 자체를 구현하나요?
아니요. Ruflo 검증 워크플로, 명령, 보고서, CI 가드 패턴을 문서화합니다.
Claude, Codex, Claude Code와 함께 사용할 수 있나요?
예. 보고서에는 Claude, Codex, Claude Code 지원이 명시되어 있습니다.
가장 중요한 안전상 우려는 무엇인가요?
백업과 확인 없이 명령을 실행하면 롤백 안내가 로컬 변경 사항을 삭제할 수 있습니다.
모니터링 URL은 자동 네트워크 호출인가요?
아니요. 명시적으로 사용자가 구성하는 내보내기를 위한 문서 예제입니다.
사용자는 사용 전에 무엇을 확인해야 하나요?
사용자는 Ruflo alpha 사용 가능 여부, 저장소 상태, Node.js 버전, CI 파일 경로를 확인해야 합니다.
팀은 진실성 점수 임계값을 어떻게 사용해야 하나요?
팀은 프로덕션 코드에는 더 엄격한 임계값을, 실험에는 더 낮은 임계값을 설정해야 합니다.