Навыки Verification & Quality Assurance
📦
Verification & Quality Assurance
Ревизия содержимого r1 Средний риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе🔑 Переменные окружения
Проверка качества кода с помощью защитных проверок Ruflo
Код и результаты работы агентов могут регрессировать без четких сигналов. Этот навык документирует защитные проверки Ruflo, оценки достоверности, отчеты и рабочие процессы отката для Claude, Codex и Claude Code.
Поддерживает: Claude Codex Code(CC)
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "Verification & Quality Assurance" from https://skillstore.io/skills/ruvnet-verification-quality-assurance.md and its manifest at https://skillstore.io/api/skills/ruvnet-verification-quality-assurance/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «Verification & Quality Assurance». Инженер по релизам спрашивает, готов ли пакет к публикации.
Ожидаемый результат:
- Рекомендуемые проверки включают локальную верификацию, smoke-тесты CI, witness-верификацию и проверку отчетов.
- Откат не рекомендуется, пока рабочее дерево не будет сохранено в резервную копию и не будут определены файлы, вызвавшие сбой.
Использование «Verification & Quality Assurance». DevOps-инженер хочет добавить верификацию в рабочие процессы pull requests.
Ожидаемый результат:
- Ответ описывает шлюз качества с установкой зависимостей, запуском верификации, проверкой оценки и загрузкой артефактов.
- В нем также отмечается, что внешние экспорты мониторинга требуют одобрения и редактирования секретов.
Использование «Verification & Quality Assurance». Руководитель AI-команды хочет оценить сгенерированный код от нескольких агентов.
Ожидаемый результат:
- Ответ сравнивает тренды оценок достоверности, проваленные критерии, частоту откатов и форматы отчетов.
- Он отделяет поставляемые защитные проверки Ruflo от функций панели мониторинга, существующих только на уровне дизайна.
Аудит безопасности
Средний рискv9 • 20.07.2026 Открыть версионный отчет
Most static alerts are false positives caused by Markdown code fences, inline code, and fixed local command examples. The audit confirms unpinned ruflo@alpha execution, optional telemetry that sends report data and a key, and a predictable temporary file in the hook example. The guide also documents rollback actions that need stronger destructive-action safeguards.
1
Просканировано файлов
692
Проанализировано строк
62
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Средний
Destructive rollback guidance lacks a mandatory preview
The guide presents rollback commands that can revert to a previous commit, including a hard git reset, without making a dry run, backup, or explicit confirmation mandatory.
The cited instructions explicitly include rollback and git reset --hard commands. The same document offers preview and backup options, but does not require them before destructive actions.
Низкий
Feature claims exceed the documented shipped implementation
The skill describes truth scoring, automatic rollback, and a WebSocket dashboard as capabilities, but states that these surfaces are only partly shipped or design work.
The capability list appears at lines 11 through 18, while line 20 expressly distinguishes shipped CI guards from partly shipped or design features.
Пункты проверки возможностей (62)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
Generic API/secret keys
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The example expands DD_API_KEY directly into an external request URL. URL query strings can be retained by logs, proxies, and process displays.
Средний
Ruby/shell backtick execution
- Ruflo installed (`npx ruflo@alpha`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
- `@noble/ed25519` (for the witness verifier — a single runtime dep, `npm i @noble/ed25519`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
- `npx ruflo@alpha pair` - Collaborative development with verification
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
- `npx ruflo@alpha train` - Training with verification feedback
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
- `npx ruflo@alpha swarm` - Multi-agent coordination with quality checks
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Ruby/shell backtick execution
- `npx ruflo@alpha report` - Generate comprehensive project reports
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Средний
Hardcoded URL
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The optional example posts generated report data and an environment-sourced API key to an external DataDog endpoint. Users must explicitly authorize that telemetry transfer.
Средний
Temp directory access
npx ruflo@alpha verify check --threshold 0.95 --json > /tmp/verify.json
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Средний
Temp directory access
score=$(jq '.overallScore' /tmp/verify.json)
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Факторы риска
⚙️ Внешние команды (50)
SKILL.md:20 SKILL.md:24 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:35-55 SKILL.md:55-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:65-68 SKILL.md:68 SKILL.md:72-84 SKILL.md:84-97 SKILL.md:97-109 SKILL.md:109-112 SKILL.md:112-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133-138 SKILL.md:138-158 SKILL.md:158-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-186 SKILL.md:186-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-222 SKILL.md:222-260 SKILL.md:260-283 SKILL.md:283-292 SKILL.md:292-301 SKILL.md:301-304 SKILL.md:304-313 SKILL.md:313-327 SKILL.md:327-339 SKILL.md:339-342 SKILL.md:342-354 SKILL.md:354-371 SKILL.md:371-383 SKILL.md:383-398 SKILL.md:398-400 SKILL.md:400-430 SKILL.md:430-435 SKILL.md:435-444
🌐 Доступ к сети (3)
📁 Доступ к файловой системе (3)
🔑 Переменные окружения (1)
Аудитор:: claude Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-verification-quality-assurance/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/ruvnet-verification-quality-assurance.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
ruvnet. (2026). Verification & Quality Assurance security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9Цитата BibTeX
@techreport{ruvnet-ruvnet-verification-quality-assurance-2026,
author = {ruvnet},
title = {Verification & Quality Assurance security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Verification & Quality Assurance security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9"
identifiers:
- type: other
value: "skillstore:ruvnet-verification-quality-assurance:audit:9"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Высокий 55
Архитектура
85
Сопровождаемость
87
Контент
71
Сообщество
61
Соответствие спецификации
Что вы можете построить
Проверка готовности релиза
Запускайте документированные проверки верификации перед публикацией пакета или слиянием изменения с высоким риском.
Добавление шлюзов качества CI
Используйте примеры CI, чтобы требовать результаты верификации до принятия pull requests.
Проверка результатов агента
Применяйте рабочие процессы оценки достоверности и отчетов, чтобы оценивать сгенерированный код до того, как он попадет к пользователям.
Попробуйте эти промпты
Выбрать базовую проверку
Используй этот навык, чтобы выбрать базовую проверку Ruflo для моего репозитория. Укажи, что означает результат и когда откат небезопасен.
Спланировать CI-верификацию
Используй этот навык, чтобы спроектировать шлюз CI-верификации для моего проекта. Кратко опиши необходимые проверки, отчеты и обработку сбоев.
Оценить безопасность отката
Используй этот навык, чтобы проверить неудачный результат верификации. Рекомендуй путь отката только после перечисления шагов резервного копирования и подтверждения.
Аудит покрытия верификацией
Используй этот навык, чтобы провести аудит нашего покрытия верификацией по smoke-тестам, witness-манифестам, описаниям инструментов, отчетам и экспортам мониторинга.
Лучшие практики
- Запускайте верификацию перед merge, релизом или автоматизированными решениями об откате.
- Проверяйте сгенерированные отчеты перед отправкой во внешние системы мониторинга.
- Используйте dry-run и шаги резервного копирования перед любой командой отката.
Избегать
- Не считайте перспективные функции панели мониторинга установленной функциональностью.
- Не запускайте команды отката или reset без явного одобрения пользователя.
- Не размещайте API keys в URLs или общих отчетах верификации.
Часто задаваемые вопросы
Реализует ли этот навык саму верификацию Ruflo?
Нет. Он документирует рабочие процессы, команды, отчеты и паттерны защитных проверок CI для верификации Ruflo.
Можно ли использовать его с Claude, Codex и Claude Code?
Да. В отчете указана поддержка Claude, Codex и Claude Code.
В чем основная проблема безопасности?
Рекомендации по откату могут привести к потере локальных изменений, если команды выполняются без резервного копирования и подтверждения.
Являются ли monitoring URLs автоматическими сетевыми вызовами?
Нет. Это примеры документации для экспортов, явно настроенных пользователем.
Что пользователям следует проверить перед использованием?
Пользователям следует подтвердить доступность Ruflo alpha, состояние репозитория, версию Node.js и пути к файлам CI.
Как командам следует использовать порог оценки достоверности?
Командам следует задавать более строгие пороги для production-кода и более низкие пороги для экспериментов.