# Cross Model Verification

> Use when correctness matters more than speed, when working on high-stakes changes (production, security, data migration), or any time the first model's confidence feels unverified. Use when the user says "换个模型检查", "cross-model", "cross-validation", "second opinion", or "verify with another model".

- **Type:** Skill
- **Install:** `agentstack add skill-2702207741-dev-agent-skills-pipeline-cross-model-verification`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [2702207741-dev](https://agentstack.voostack.com/s/2702207741-dev)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [2702207741-dev](https://github.com/2702207741-dev)
- **Source:** https://github.com/2702207741-dev/agent-skills-pipeline/tree/main/cross-model-verification
- **Website:** https://github.com/2702207741-dev/agent-skills-pipeline/blob/main/docs/README.md

## Install

```sh
agentstack add skill-2702207741-dev-agent-skills-pipeline-cross-model-verification
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Cross-Model Verification

## Overview

A single model shares blind spots with itself—fresh context from a different architecture catches them. This skill orchestrates the second-opinion workflow: collect the artifact, generate an adversarial prompt, dispatch to a second model, diff the results, and report findings classified by severity.

## The Process

```
Security Gate → Collect → Adversarial Prompt → Dispatch → Diff → Report
      │            │            │                  │         │        │
      ▼            ▼            ▼                  ▼         ▼        ▼
  Redaction     Artifact   "Find issues"      Which      Compare   Severity
  decision      isolation  NOT "is it good"   model?     outputs   labels
```

### Step 0: Security Gate

**Expected Output:** `safe-to-dispatch / redacted / local-only / abort`

Before sending anything to another model, classify and scrub the artifact.

```
Artifact contains secrets, credentials, production data, customer data, or private repo context?
  │
  ├── No → safe-to-dispatch
  │
  ├── Yes, can be redacted without losing review value
  │     ├── Replace values with placeholders: , , 
  │     └── Output: redacted + list of redaction classes
  │
  ├── Yes, cannot be safely redacted
  │     ├── External model or web UI → ask user before dispatch
  │     └── No approval → local-only degraded review
  │
  └── Security auth / production migration + unredacted sensitive data + no second model under approved boundary
        └── abort and escalate to human review
```

Run a quick scan before dispatch:

```bash
grep -Ei "sk-|AKIA|AIza|xox|password|secret|private_key|token|BEGIN .*PRIVATE KEY" 
# Expected: no matches, or every match is intentionally redacted before dispatch
```

### Step 1: Collect

**Expected Output:** `artifact + contract, smallest reviewable unit, no prior CLAIM`

Isolate the smallest reviewable unit. Strip your reasoning—handing over conclusions biases the reviewer toward agreement.

```
What to review?
  │
  ├── Code diff / PR → paste the diff
  ├── Architecture decision → 3-5 sentence proposal + constraints
  └── Assertion → the claim + supporting evidence (distinct from your CLAIM)
```

**Rule:** The unit must be small enough that a reviewer can hold it in one read. If it's a 500-line PR, decompose first.

### Step 2: Adversarial Prompt

**Expected Output:** `prompt contains ARTIFACT + CONTRACT, asks to find issues, omits author's CLAIM`

Framing decides the answer. Always "find issues", never "is it good".

```
Adversarial review. Find what is wrong with this artifact.
Assume the author is overconfident. Look for:
- Unstated assumptions
- Edge cases not handled
- Hidden coupling or shared state
- Ways the contract could be violated
- Existing conventions this might break
- Failure modes under unexpected input

Do NOT validate. Do NOT summarize. Find issues, or state
explicitly that you cannot find any after thorough examination.

ARTIFACT: 
CONTRACT: 
```

**Do NOT pass your CLAIM.** The reviewer must independently determine whether the artifact satisfies the contract.

### Step 3: Dispatch

**Expected Output:** `model choice + invocation method + security decision recorded`

```
Which model?
  │
  ├── CLI tool (gemini, codex) →
  │     ├── which gemini / which codex
  │     ├── gemini --version / codex --version
  │     ├── Confirm invocation with user
  │     └── Pipe via stdin (never inline -p with untrusted artifact)
  │
  ├── Same session model only → Degraded self-review
  │     └── 同模型不构成 cross-model，必须标记 degraded
  │
  ├── Web interface → Manual (user pastes)
  │
  └── None available → Degraded self-review
        └── Write ARTIFACT + CONTRACT as fresh self-prompt
        └── Walk Steps 1-5 with hard mental separator
        └── Flag result as degraded
```

**Shell escaping (load-bearing):** Artifacts contain `$(...)`, backticks, quotes. Inline arguments truncate or execute embedded shell.

```bash
# Write to temp file, pipe via stdin
echo "$PROMPT" > /tmp/cross-model-prompt.md
gemini --approval-mode plan -p ""  - 
  模型 B: 

  发现:
  [Critical]  — 必须修复
  [Required]  — 建议修复
  [Optional]  — 可改进
  [FYI]  — 供参考

  结论: approve / request changes / needs discussion
```

## Failure / Degraded Strategy

```
Second model unavailable?
  │
  ├── CLI tool missing → Ask user to install, or use degraded
  │
  ├── Artifact too large → Decompose and review in chunks
  │
  ├── Timeout / no response → Re-dispatch with same prompt (retry once)
  │
  └── None available → Degraded self-review
        ├── Write ARTIFACT + CONTRACT as fresh self-prompt
        ├── Walk Steps 1-5 with hard mental separator
        ├── Flag result explicitly as "degraded" in output
        └── Never claim "cross-verified" if only self-reviewed
```

**Degraded self-review protocol:**
1. Close any open tabs with the artifact—you must come back cold.
2. Rewrite the adversarial prompt as a self-prompt, strip any "I found X" from it.
3. Set a 5-minute timer. If you finish early, you didn't try hard enough.
4. In the output, prefix every finding with `[degraded]` to remind downstream consumers this wasn't cross-validated.

**When to abort rather than degrade:**
- High-stakes change (production migration, security auth) AND no second model AND the artifact is > 500 lines → Escalate to human review, don't fake verification.
- Artifact contains unredacted secrets or regulated data and no approved second-model boundary exists → abort, redact, or use local-only degraded review.

## Common Pitfalls

| Symptom | Root cause | Fix |
|---------|-----------|-----|
| Second model agrees too easily | Prompt asks "is this good" or includes the author's CLAIM | Rewrite as adversarial "find issues" prompt and remove prior conclusions |
| Review leaks secrets to external model | Artifact was dispatched before redaction | Run Step 0, redact values, or keep review local-only |
| Findings are noisy | Contract too broad or artifact too large | Decompose the artifact and provide a tighter contract |
| Result is reported as cross-verified with no second model | Degraded path not labeled | Prefix findings with `[degraded]` and state the limitation |

## When to Use

| Use When | Don't Use When |
|----------|----------------|
| 用户说"换个模型检查""cross-model""second opinion" | 简单问题不需要二次验证（如 typos、格式调整） |
| 高风险变更：production、安全、数据迁移 | 用户只是问"这个对不对"（先用自己的判断） |
| 第一个模型的输出看起来太自信但缺乏证据 | 时间紧迫、需要立即执行（cross-model 增加延迟） |
| 审查结果中的 Critical 项需要二次确认 | 唯一能用的模型和当前模型架构相同（无多样性优势） |
| coding agent 完成复杂任务后验证方案正确性 | 已有明确答案的事实性问题（如查文档） |

## Verification Checklist

- [ ] Artifact 已隔离为最小可审查单元
- [ ] Artifact 已完成敏感信息扫描；外发内容已 redacted 或获得明确许可
- [ ] Adversarial prompt 使用"find issues"而非"is it good"
- [ ] 未将个人判断或 CLAIM 传入 prompt
- [ ] 通过 stdin 传递 artifact（不使用 -p 内联参数）
- [ ] 所有发现已分类（Critical/Required/Optional/FYI）
- [ ] 结论明确：approve / request changes / needs discussion

## Interaction with Other Skills

- **skill-review-workflow**: skill-review 的审查结果可送入本 skill 做二次验证。skill-review 发现 Critical 问题时自动触发。
- **agent-security-guard**: 安全相关发现（API key、shell 注入）优先用 agent-security-guard 专项检测，本 skill 负责一般性逻辑审查。

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [2702207741-dev](https://github.com/2702207741-dev)
- **Source:** [2702207741-dev/agent-skills-pipeline](https://github.com/2702207741-dev/agent-skills-pipeline)
- **License:** MIT
- **Homepage:** https://github.com/2702207741-dev/agent-skills-pipeline/blob/main/docs/README.md

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-2702207741-dev-agent-skills-pipeline-cross-model-verification
- Seller: https://agentstack.voostack.com/s/2702207741-dev
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.