Skills Verification & Quality Assurance
📦
Verification & Quality Assurance
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Verify Code Quality with Ruflo Guards
Code and agent outputs can regress without clear signals. This skill documents Ruflo verification guards, truth scores, reports, and rollback workflows for Claude, Codex, and Claude Code.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "Verification & Quality Assurance" from https://skillstore.io/skills/ruvnet-verification-quality-assurance.md and its manifest at https://skillstore.io/api/skills/ruvnet-verification-quality-assurance/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "Verification & Quality Assurance". A release engineer asks whether a package is ready to publish.
Expected outcome:
- Recommended checks include local verification, CI smoke tests, witness verification, and report review.
- Rollback is not recommended until the working tree is backed up and the failed files are identified.
Using "Verification & Quality Assurance". A DevOps engineer wants verification in pull request workflows.
Expected outcome:
- The response outlines a quality gate with dependency install, verification run, score review, and artifact upload.
- It also notes that external monitoring exports need approval and secret redaction.
Using "Verification & Quality Assurance". An AI lead wants to evaluate generated code from several agents.
Expected outcome:
- The response compares truth score trends, failed criteria, rollback frequency, and report formats.
- It separates shipped Ruflo guards from design-only dashboard features.
Security Audit
Medium Riskv9 • 7/20/2026 Open versioned report
Most static alerts are false positives caused by Markdown code fences, inline code, and fixed local command examples. The audit confirms unpinned ruflo@alpha execution, optional telemetry that sends report data and a key, and a predictable temporary file in the hook example. The guide also documents rollback actions that need stronger destructive-action safeguards.
1
Files scanned
692
Lines analyzed
62
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Destructive rollback guidance lacks a mandatory preview
The guide presents rollback commands that can revert to a previous commit, including a hard git reset, without making a dry run, backup, or explicit confirmation mandatory.
The cited instructions explicitly include rollback and git reset --hard commands. The same document offers preview and backup options, but does not require them before destructive actions.
Low
Feature claims exceed the documented shipped implementation
The skill describes truth scoring, automatic rollback, and a WebSocket dashboard as capabilities, but states that these surfaces are only partly shipped or design work.
The capability list appears at lines 11 through 18, while line 20 expressly distinguishes shipped CI guards from partly shipped or design features.
Capability review items (62)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The example expands DD_API_KEY directly into an external request URL. URL query strings can be retained by logs, proxies, and process displays.
Medium
Ruby/shell backtick execution
- Ruflo installed (`npx ruflo@alpha`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
- `@noble/ed25519` (for the witness verifier — a single runtime dep, `npm i @noble/ed25519`)
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
```
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
- `npx ruflo@alpha pair` - Collaborative development with verification
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
- `npx ruflo@alpha train` - Training with verification feedback
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
- `npx ruflo@alpha swarm` - Multi-agent coordination with quality checks
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Ruby/shell backtick execution
- `npx ruflo@alpha report` - Generate comprehensive project reports
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Template literal with command substitution
```yaml
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Template literal with command substitution
```bash
The documented command uses npx with the floating ruflo@alpha tag, which can download and execute changing third-party package code. Users should treat it as a supply-chain execution boundary.
Medium
Hardcoded URL
curl -X POST "https://api.datadoghq.com/api/v1/series?api_key=${DD_API_KEY}" \
The optional example posts generated report data and an environment-sourced API key to an external DataDog endpoint. Users must explicitly authorize that telemetry transfer.
Medium
Temp directory access
npx ruflo@alpha verify check --threshold 0.95 --json > /tmp/verify.json
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Medium
Temp directory access
score=$(jq '.overallScore' /tmp/verify.json)
The hook writes and reads a predictable shared /tmp/verify.json path. A local attacker can race or pre-create that path, affecting the verification result.
Risk Factors
⚙️ External commands (50)
SKILL.md:20 SKILL.md:24 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:35-55 SKILL.md:55-59 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:65-68 SKILL.md:68 SKILL.md:72-84 SKILL.md:84-97 SKILL.md:97-109 SKILL.md:109-112 SKILL.md:112-124 SKILL.md:124-127 SKILL.md:127-133 SKILL.md:133-138 SKILL.md:138-158 SKILL.md:158-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-186 SKILL.md:186-198 SKILL.md:198-201 SKILL.md:201-210 SKILL.md:210-213 SKILL.md:213-222 SKILL.md:222-260 SKILL.md:260-283 SKILL.md:283-292 SKILL.md:292-301 SKILL.md:301-304 SKILL.md:304-313 SKILL.md:313-327 SKILL.md:327-339 SKILL.md:339-342 SKILL.md:342-354 SKILL.md:354-371 SKILL.md:371-383 SKILL.md:383-398 SKILL.md:398-400 SKILL.md:400-430 SKILL.md:430-435 SKILL.md:435-444
🌐 Network access (3)
📁 Filesystem access (3)
🔑 Env variables (1)
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/ruvnet-verification-quality-assurance?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-verification-quality-assurance/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/ruvnet-verification-quality-assurance.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ruvnet. (2026). Verification & Quality Assurance security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9BibTeX citation
@techreport{ruvnet-ruvnet-verification-quality-assurance-2026,
author = {ruvnet},
title = {Verification & Quality Assurance security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Verification & Quality Assurance security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/ruvnet-verification-quality-assurance/audits/9"
identifiers:
- type: other
value: "skillstore:ruvnet-verification-quality-assurance:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
71
Community
61
Spec Compliance
What You Can Build
Validate Release Readiness
Run documented verification checks before publishing a package or merging a high-risk change.
Add CI Quality Gates
Use the CI examples to require verification results before pull requests are accepted.
Review Agent Output
Apply truth score and report workflows to evaluate generated code before it reaches users.
Try These Prompts
Choose a Basic Check
Use this skill to choose a basic Ruflo verification check for my repository. Include what the result means and when rollback is unsafe.
Plan CI Verification
Use this skill to design a CI verification gate for my project. Summarize required checks, reports, and failure handling.
Assess Rollback Safety
Use this skill to review a failed verification result. Recommend a rollback path only after listing backup and confirmation steps.
Audit Verification Coverage
Use this skill to audit our verification coverage across smoke tests, witness manifests, tool descriptions, reports, and monitoring exports.
Best Practices
- Run verification before merge, release, or automated rollback decisions.
- Review generated reports before sending them to external monitoring systems.
- Use dry-run and backup steps before any rollback command.
Avoid
- Do not treat aspirational dashboard features as installed functionality.
- Do not run rollback or reset commands without explicit user approval.
- Do not place API keys in URLs or shared verification reports.
Frequently Asked Questions
Does this skill implement Ruflo verification itself?
No. It documents Ruflo verification workflows, commands, reports, and CI guard patterns.
Can it be used with Claude, Codex, and Claude Code?
Yes. The report lists support for Claude, Codex, and Claude Code.
What is the main safety concern?
Rollback guidance can discard local changes if commands run without backup and confirmation.
Are the monitoring URLs automatic network calls?
No. They are documentation examples for explicit user-configured exports.
What should users verify before using it?
Users should confirm Ruflo alpha availability, repository state, Node.js version, and CI file paths.
How should teams use the truth score threshold?
Teams should set stricter thresholds for production code and lower thresholds for experiments.