Skills when-verifying-quality-use-verification-quality
📦
when-verifying-quality-use-verification-quality
v1.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access⚡ Contains scripts
Verify Release Quality With Evidence
Teams need consistent release checks before code reaches production. This skill organizes static analysis, tests, integration validation, certification, and reports into one workflow.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "when-verifying-quality-use-verification-quality" from https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-verifying-quality-use-verification-quality/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "when-verifying-quality-use-verification-quality". Review this release candidate for quality readiness.
Expected outcome:
The release is not ready. Static analysis passed, but integration validation found three failed checks. Fix the webhook race condition before approval.
Using "when-verifying-quality-use-verification-quality". Summarize the quality gate results for stakeholders.
Expected outcome:
The report lists gate status, coverage results, failed tests, service health, known risks, and the evidence needed for sign-off.
Using "when-verifying-quality-use-verification-quality". Help me convert this process into CI steps.
Expected outcome:
Recommended stages are install, static analysis, dynamic tests, integration validation, certification scoring, artifact upload, and manual approval.
Security Audit
High Riskv9 • 7/5/2026 Open versioned report
Most static detections are false positives caused by Markdown fences, inline backticks, local report reads, and sample report text. Real risks remain around private-key signing, unpinned alpha package execution, and pre-filled approval language that could be used without evidence.
4
Files scanned
2,040
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Certificate/key files
openssl dgst -sha256 -sign private-key.pem -out certification.sig
The documented signing command uses private-key.pem, which requires access to a sensitive signing key. This can be legitimate certification work, but it must require explicit user approval and protected key storage.
High
Certificate/key files
openssl dgst -sha256 -sign private-key.pem -out certification.sig
The documented signing command uses private-key.pem, which requires access to a sensitive signing key. This can be legitimate certification work, but it must require explicit user approval and protected key storage.
Medium
Unpinned Alpha Package Execution
The workflow repeatedly instructs users to run npx claude-flow@alpha. That can download and execute a moving third-party package version during quality verification.
The command is explicit in both primary workflow documentation files and uses the alpha tag instead of a pinned version. The risk is supply-chain exposure, not evidence of malicious intent.
Medium
Pre-Filled Release Approval Claims
The templates include approval language such as Security Team approved and approved for production release. If copied without evidence, this can misrepresent release governance.
The files show explicit approval and compliance text inside report templates. The context is documentation, so the finding is governance risk rather than direct malware behavior.
Risk Factors
⚙️ External commands (134)
PROCESS.md:629-636 PROCESS.md:318 PROCESS.md:607 README.md:92 SKILL.md:36-40 SKILL.md:40-45 SKILL.md:45-56 SKILL.md:56-59 SKILL.md:59-72 SKILL.md:72-75 SKILL.md:75-98 SKILL.md:98-101 SKILL.md:101-113 SKILL.md:113-116 SKILL.md:116-122 SKILL.md:122-125 SKILL.md:125-138 SKILL.md:138-139 SKILL.md:139-152 SKILL.md:152-155 SKILL.md:155-160 SKILL.md:160-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171-181 SKILL.md:181-185 SKILL.md:185-190 SKILL.md:190-195 SKILL.md:195-198 SKILL.md:198-211 SKILL.md:211-214 SKILL.md:214-222 SKILL.md:222-225 SKILL.md:225-237 SKILL.md:237-240 SKILL.md:240-269 SKILL.md:269-272 SKILL.md:272-288 SKILL.md:288-291 SKILL.md:291-311 SKILL.md:311-312 SKILL.md:312-313 SKILL.md:313-314 SKILL.md:314-315 SKILL.md:315-316 SKILL.md:316-317 SKILL.md:317-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-326 SKILL.md:326-330 SKILL.md:330-331 SKILL.md:331-332 SKILL.md:332-335 SKILL.md:335-340 SKILL.md:340-349 SKILL.md:349-350 SKILL.md:350-351 SKILL.md:351-361 SKILL.md:361-365 SKILL.md:365-370 SKILL.md:370-375 SKILL.md:375-378 SKILL.md:378-390 SKILL.md:390-393 SKILL.md:393-403 SKILL.md:403-406 SKILL.md:406-436 SKILL.md:436-439 SKILL.md:439-467 SKILL.md:467-470 SKILL.md:470-476 SKILL.md:476-479 SKILL.md:479-521 SKILL.md:521-524 SKILL.md:524-529 SKILL.md:529-538 SKILL.md:538-539 SKILL.md:539-540 SKILL.md:540-550 SKILL.md:550-554 SKILL.md:554-559 SKILL.md:559-564 SKILL.md:564-567 SKILL.md:567-611 SKILL.md:611-614 SKILL.md:614-646 SKILL.md:646-649 SKILL.md:649-718 SKILL.md:718-721 SKILL.md:721-745 SKILL.md:745-748 SKILL.md:748-753 SKILL.md:753-762 SKILL.md:762-763 SKILL.md:763-764 SKILL.md:764-774 SKILL.md:774-778 SKILL.md:778-783 SKILL.md:783-788 SKILL.md:788-791 SKILL.md:791-799 SKILL.md:799-802 SKILL.md:802-827 SKILL.md:827-830 SKILL.md:830-840 SKILL.md:840-873 SKILL.md:873-876 SKILL.md:876-885 SKILL.md:885-888 SKILL.md:888-899 SKILL.md:899-902 SKILL.md:902-907 SKILL.md:907-916 SKILL.md:916-917 SKILL.md:917-918 SKILL.md:918-919 SKILL.md:919-925 SKILL.md:925-937 SKILL.md:937-944 SKILL.md:944-973 SKILL.md:973-987 SKILL.md:987-996 SKILL.md:996-1003 SKILL.md:1003-1009 SKILL.md:1009-1012 SKILL.md:1012-1033 SKILL.md:1033-1039 SKILL.md:1039-1040 SKILL.md:1040-1041 SKILL.md:729 SKILL.md:1026 SKILL.md:721-745 SKILL.md:1012-1033
🌐 Network access (2)
📁 Filesystem access (10)
⚡ Contains scripts (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-verifying-quality-use-verification-quality/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-verifying-quality-use-verification-quality.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
DNYoussef. (2026). when-verifying-quality-use-verification-quality security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality/audits/9BibTeX citation
@techreport{dnyoussef-dnyoussef-when-verifying-quality-use-verification-quality-2026,
author = {DNYoussef},
title = {when-verifying-quality-use-verification-quality security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality/audits/9},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-verifying-quality-use-verification-quality security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
- name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-verifying-quality-use-verification-quality/audits/9"
identifiers:
- type: other
value: "skillstore:dnyoussef-when-verifying-quality-use-verification-quality:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
70
Community
70
Spec Compliance
What You Can Build
Audit a Release Candidate
Run static checks, tests, integration validation, and certification before a release branch is approved.
Build CI Quality Gates
Convert the workflow into CI stages that fail builds when quality scores or coverage targets are missed.
Prepare Stakeholder Reports
Generate evidence-based summaries for quality, security, performance, and compliance review meetings.
Try These Prompts
Start a Quality Check
Use this skill to review my project quality. Start with static analysis and tell me which commands you need before running anything.
Review Test Health
Use this skill to evaluate unit, integration, and end-to-end test results. Summarize failures, flaky tests, coverage gaps, and next actions.
Validate Release Gates
Use this skill to check release gates for this branch. Compare the evidence against thresholds and identify blockers before approval.
Design a CI Workflow
Use this skill to design a CI quality verification workflow for my repository. Include phases, required tools, artifacts, thresholds, and manual approval points.
Best Practices
- Run the workflow in a clean branch with project-specific tool configuration already committed.
- Replace every sample approval, score, and compliance claim with evidence from the current build.
- Review all external commands, package downloads, and signing operations before execution.
Avoid
- Do not treat sample certification text as real stakeholder approval.
- Do not run unreviewed project scripts or package downloads in a sensitive environment.
- Do not publish quality reports that omit failed tests, flaky tests, or known issues.
Frequently Asked Questions
Does this skill run the quality tools by itself?
No. It provides a workflow and command examples. The project must include the tools, scripts, services, and configuration.
Which tools does the workflow mention?
It references SonarQube, ESLint, TypeScript, Jest, Cypress, Playwright, Pact, Newman, and claude-flow hooks.
Can it certify a production release?
It can structure certification evidence. Real release approval must come from verified test results and authorized stakeholders.
Is it suitable for CI pipelines?
Yes, if the repository provides matching scripts and the team reviews command execution, artifacts, and failure thresholds.
What should I check before using it?
Confirm package sources, local service requirements, signing key handling, and whether the sample thresholds match your risk policy.
Does it replace security review?
No. It includes security compliance checks, but teams still need evidence-based security review and approval.
Developer Details
Author
DNYoussefLicense
MIT
Author version
v1.0.0
Skillstore revision
r1
Ref
c579efd02184f1128d6741d16e6c8d951d7d4208
Maintenance freshness
7/20/2026
Usage
5 downloads · 212 views
File structure