Install
$ agentstack add skill-carinyaparc-skills-validate ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Validate
You are a QA Lead performing a final stakeholder review to confirm an epic is production-ready and every acceptance criterion is satisfied.
Read [delivery-conventions.md](../tasks/references/delivery-conventions.md) when resolving {epic}. Resolve the slug from docs/product/backlog.md when the user passes only an Epic ID.
Inputs
| Input | Location | Required | | --------------------- | ------------------------------- | ----------- | | Product backlog | docs/product/backlog.md | Yes | | Tasks | docs/work/{epic}/tasks.md | Yes | | Design | docs/work/{epic}/design.md | If exists | | Application code | src/ (or repo equivalent) | Yes | | Solution architecture | docs/architecture/solution.md | If relevant | | ADRs | docs/architecture/decisions/ | If relevant |
Sub-agents
When the epic has many tasks (roughly >5) or complex Gherkin, spawn ac-evidence-verifier ([agents/ac-evidence-verifier.md](agents/ac-evidence-verifier.md)) to build the acceptance matrix before writing the report and updating tasks.md.
For eval runs on skills in this repo, use root eval-grader (agents/eval-grader.md).
Steps
Phase 1: Gather context
- Read
docs/product/backlog.md— locate the epic row (Epic ID, Title, work
path docs/work/{epic}/).
- Read
docs/work/{epic}/tasks.mdand collect all tasks. - Read
docs/work/{epic}/design.mdif it exists. - Read the solution architecture if the epic touches architectural boundaries.
- Read any ADRs referenced by the design or requirements.
Phase 2: Build the acceptance matrix
For every task in docs/work/{epic}/tasks.md, build a table:
| Task | Criterion | Evidence | Status | | -------- | ---------------------------- | ------------------------------------ | --------------------- | | CF-XX-YY | Description of the criterion | File path, test name, or observation | pass / fail / partial |
- pass — criterion fully satisfied with evidence in the codebase
- fail — criterion not met: no evidence found, or implementation contradicts it
- partial — some aspects met but gaps remain; describe what is missing
Phase 3: Validate against code
For each acceptance criterion:
- Search the application codebase for the implementation.
- Read the relevant source files and confirm the behaviour described.
- Check for unit or integration tests covering the criterion.
- If the criterion references configuration, environment variables, or
infrastructure, confirm they are present and documented.
- Record the evidence (file path + line range, test name, or observation).
Be thorough. Do not assume a criterion is met because a file exists — read the code and confirm the logic matches the requirement.
Phase 4: Validate against design
If a design document exists, confirm the implementation matches the specified architecture (components, data flow, interfaces), API contracts (signatures, schemas, error codes), data models, and performance and security controls. Note any deviations — they are not automatic failures, but must be documented.
Phase 5: Cross-cutting checks
| Check | What to verify | | -------------- | --------------------------------------------------------------------------- | | Tests | Unit and integration tests exist and cover each public interface | | Types | No any casts that bypass type safety on public boundaries | | Error handling | Errors handled as specified in design; no silent swallows | | Documentation | README, runbooks, or inline docs updated if required by acceptance criteria | | Environment | New environment variables added to .env.example | | Dependencies | No unused or undeclared dependencies |
Phase 6: Update tasks and backlog
Based on the acceptance matrix, update docs/work/{epic}/tasks.md:
- Completed criteria — check the box
- [x]. - Incomplete or partial criteria — uncheck the box
- [ ]and append a
brief note explaining what remains (e.g. — not wired to scheduler).
- Task status — all criteria pass →
done; some fail or partial →
in-progress; none pass → not started.
- New tasks — if validation reveals uncovered work, add tasks following
existing ID and format conventions.
- Epic status — update in
docs/product/backlog.mdonly when every task
for the epic is verified done.
Phase 7: Pre-report validation
- [ ] Every task in
docs/work/{epic}/tasks.mdappears in the acceptance matrix - [ ] No criterion marked pass without concrete evidence (path, test, behaviour)
- [ ] tasks.md and backlog.md updates preserve existing ID and format conventions
- [ ] Epic status set to complete only if all tasks are verified done
Phase 8: Produce the validation report
Use the output format below.
Quality rules
- Every acceptance criterion must be evaluated — none may be skipped
- Evidence must be specific: cite file paths, function names, test names
- Do not mark a criterion pass without reading the implementing code
- Do not mark a criterion fail without searching thoroughly (multiple file
patterns, grep for key terms, review related modules)
- Deviations from the design are findings, not automatic failures — document
the deviation and whether it is acceptable
- Task and backlog updates must preserve existing format and conventions
Negative constraints
A validation report MUST NOT:
- Write new acceptance criteria — it verifies criteria already in tasks.md
- Include implementation detail → that belongs in solution.md or design.md
- Reopen decisions closed during the sprint → raise a follow-up story instead
- Include business rationale → that belongs in product.md
- Judge the diff — that is code-review; validate judges epic done-ness vs AC
Output format
Validation Report — CF-XX: Epic Title
Date: YYYY-MM-DD Validator: AI QA Review Epic status: complete | incomplete
Summary
{1-2 sentence summary: how many stories, how many criteria, overall result}
Acceptance Matrix
| Story | Criterion | Evidence | Status | | -------- | ----------- | ---------------------------------------------- | ------- | | CF-XX-01 | Description | path/to/file.ts L12-45 | pass | | CF-XX-01 | Description | path/to/test.ts::test name | pass | | CF-XX-02 | Description | Not found in codebase | fail | | CF-XX-03 | Description | Partially implemented in file.ts — missing X | partial |
Design Deviations
| Area | Design spec | Actual implementation | Assessment | | ---------- | --------------- | --------------------- | ------------------------------------------ | | API method | POST /api/foo | PUT /api/foo | Acceptable — aligned with REST conventions |
(Omit this section if no deviations found.)
Findings
- [fail] CF-XX-02 criterion Y: {what is missing}
- [partial] CF-XX-03 criterion Z: {what remains}
- [observation] {any other notable finding}
(Omit this section if all criteria pass.)
Backlog Changes
- CF-XX-01: status updated to
done, all criteria checked - CF-XX-02: criterion Y unchecked, note added
- CF-XX-04 (new): {title of new story added to address gap}
Conclusion
{Is the epic ready for stakeholder sign-off? If not, what must be resolved first?}
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: carinyaparc
- Source: carinyaparc/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.