技能 executor-verification

📦

executor-verification

Name: executor-verification
Author: atri10

内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问

Verify Completion Claims With Recorded Evidence

Completion claims can hide failed, skipped, or untested requirements. This skill guides requirement-level verification with observed output, commit-bound evidence, and explicit human acceptance.

支持: Claude Codex Code(CC)

📊 69 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "executor-verification" from https://skillstore.io/skills/atri10-executor-verification.md and its manifest at https://skillstore.io/api/skills/atri10-executor-verification/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/atri10-executor-verification.md 已签名 manifest GET /api/skills/atri10-executor-verification/manifest 已签名 lockfile GET /api/skills/atri10-executor-verification/lockfile

测试它

正在使用“executor-verification”。 Verify an integration criterion that requires HTTP 409 with no partial write.

预期结果:

Illustrative outcome: FAILED.
Observed: the integration test received HTTP 500 instead of HTTP 409.
Required: HTTP 409 with no partial write.
Next step: return the mismatch to execution and reverify after the fix.

正在使用“executor-verification”。 Summarize a verification round where one manual criterion was never checked.

预期结果:

Illustrative summary: 11 PROVEN, 0 FAILED, 1 NOT-RUN, 0 UNAVAILABLE.
Exception: the manual criterion has no recorded observation.
Completion remains unproven. Present the exception for human acceptance or further verification.

正在使用“executor-verification”。 Run a criterion when the evidence runner lacks a required credential.

预期结果:

Illustrative runner outcome: NOT-RUN.
Evidence: none; no run and no evidence file.
Reason: the criterion requires a credential that was not provided.
Do not inspect the environment for secrets or assume the criterion passes.

安全审计

中风险

v1 • 2026/10/5 打开版本化报告

All 155 static findings are false positives involving Markdown formatting, intended local verification, companion paths, or protective secret-handling guidance. Two semantic workflow risks concern unisolated regression reverts and retained evidence after secret-scan failures. No evidence found of malicious prompt injection or exfiltration; companion helper implementations are outside the two reviewed files.

已扫描文件

819

分析行数

复核项

已忽略误报

已确认安全问题 (2)

中

SKILL.md:173-183

Regression Verification Reverts Fixes Without Isolation

The regression workflow says "Revert the fix" and "Restore the fix" without an isolated worktree or recovery checkpoint. Following it in a shared worktree can discard edits or disrupt concurrent work.

The ordered steps explicitly require reverting and restoring code, but provide no isolation or preservation procedure. No destructive command is specified, so damage depends on implementation.

中

evidence-runner-prompt.md:183-187 SKILL.md:305-311

Secret Recovery Does Not Address Retained Evidence Copies

After a secret finding, the runner says "redact and rewrite" through the evidence helper. The storage policy creates new attempt files instead of overwriting, so sensitive originals may remain in tracked evidence.

Recovery requests another write while the documented helper preserves earlier attempts. No cleanup or quarantine of detected sensitive originals is specified; the helper implementation is outside this audit.

风险因素

⚙️ 外部命令 (50)

📁 文件系统访问 (8)

evidence-runner-prompt.md:71 evidence-runner-prompt.md:185 SKILL.md:13 SKILL.md:15 SKILL.md:307 SKILL.md:479 SKILL.md:481 SKILL.md:485

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/atri10-executor-verification/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/atri10-executor-verification/security.svg)](https://skillstore.io/skills/atri10-executor-verification?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/atri10-executor-verification?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/atri10-executor-verification/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/atri10-executor-verification.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

atri10. (2026). executor-verification security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/atri10-executor-verification/audits/1

BibTeX 引用

@techreport{atri10-atri10-executor-verification-2026,
  author = {atri10},
  title = {executor-verification security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/atri10-executor-verification/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "executor-verification security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "atri10"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/atri10-executor-verification/audits/1"
identifiers:
  - type: other
    value: "skillstore:atri10-executor-verification:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Verify a Feature Before Handoff

Walk existing acceptance criteria, gather suitable evidence, and present unresolved requirements before a feature handoff.

Review Requirement Coverage

Compare observed test and smoke outcomes with requirements, without treating a passing unit suite as full feature proof.

Coordinate Agent Verification

Dispatch one evidence runner per criterion, inspect the returned artifact, and route failures back to the owning implementation plan.

试试这些提示

Check One Requirement

Verify criterion [reference] in [verification document] at the current state. Report its requirement, named method, observed output, and status without changing code.

Build an Outcomes Round

Walk every criterion in [verification document]. Record state, commands, outcomes, and evidence citations. Summarize all four statuses and stop for human acceptance.

Dispatch an Evidence Runner

Prepare one runner for [criterion] using the provided template. Fill every placeholder, select a model explicitly, and verify prerequisites before dispatch.

Reverify After a Shared-Code Fix

Review fix [commit] against the existing ledger. Identify affected criteria and append a new round. Use isolated regression checks and scan retained evidence before committing.

最佳实践

Record the exact tested state and match each requirement to the evidence type its strategy names.
Use an isolated worktree for regression reverts and preserve all existing user changes.
Redact before capture, scan every retained evidence attempt, and resolve sensitive originals before tracking or committing.

避免

Treating passing unit tests, clean review reports, or expected output as proof of every requirement.
Changing code during verification to obtain a passing result without a separate fix and new evidence round.
Hiding FAILED, NOT-RUN, or UNAVAILABLE outcomes when presenting the completion summary.

常见问题

What does this skill verify?

It guides checks against existing verification criteria and records observed outcomes. It does not invent acceptance criteria or guarantee software correctness.

Can I use it with Claude, Codex, or Claude Code?

The report lists all three tools. The workflow still requires command execution, repository access, and the referenced Executor dependencies.

Are the helper scripts included?

No. The reviewed skill contains instructions and an evidence runner template. Companion Executor helpers are referenced separately and were not audited here.

What happens when a check cannot run?

Record NOT-RUN or UNAVAILABLE with the exact blocker. Missing evidence is not a pass, and residual gaps require explicit human acceptance.

Does verification fix failing code?

No. Failures return to execution. After fixes land, append a new round and reverify every criterion the change could affect.

What precautions apply to stored evidence?

Redact sensitive output before writing and scan retained files. A redacted replacement does not guarantee earlier sensitive attempts were removed.

开发者详情

作者

atri10

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/atri10/executor/tree/39ddcfe1d9f3497102622b72aa235fb0770187fe/skills/executor-verification

引用

6d0b11444384184b7ae743742a7e233a9a705cd9

维护新鲜度

2026/10/6

使用量

0 次下载 · 1 次浏览

文件结构

📄 evidence-runner-prompt.md

📄 SKILL.md