Install
$ agentstack add skill-contextosai-skills-verify-change ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Change Verification
Produce the smallest evidence set that convincingly supports the change's claims and protects its highest-risk invariants.
Protocol
- Identify the exact change range and read applicable repository instructions.
Preserve unrelated user changes.
- Write a claim ledger: each intended behavior, preserved invariant, affected
boundary, likely failure mode, and the evidence that could falsify it. Use references/verification-matrix.md.
- Classify risk by consequence, reachability, novelty, and reversibility. Raise
rigor for authorization, money, destructive writes, migrations, concurrency, public APIs, and silent corruption.
- Inspect existing test/build commands and CI configuration. Do not guess a
command when the repository declares one.
- Order checks for fast information:
- syntax/type/static validation;
- focused tests for changed logic and regression input;
- integration tests across affected boundaries;
- broader suite/build/package checks;
- runtime smoke, migration, compatibility, performance, or security checks
only when the risk model calls for them.
- Before each expensive check, state which claim it tests. Do not run broad
suites merely to create confidence theater.
- Interpret results, not exit codes alone. Confirm tests were discovered,
assertions exercised the changed path, expected failures did not get swallowed, snapshots/artifacts are meaningful, and warnings are relevant.
- For a bug fix, demonstrate the regression test targets the original failure.
Prefer fail-before/pass-after evidence when safely obtainable without discarding work; otherwise explain the causal link.
- For migrations or irreversible operations, verify on disposable data and
inspect forward, backward/rollback, partial-failure, and repeated-run paths.
- Stop when every material claim has evidence or an explicit gap. Never claim
"fully verified" from a partial environment.
Guardrails
- Do not mutate production, publish, deploy, or exercise real side effects
without explicit authority.
- Do not weaken assertions, delete failing tests, or regenerate snapshots solely
to obtain green output.
- Distinguish product failures, test defects, environmental failures, and checks
that never ran.
- Treat flaky success as inconclusive until the nondeterminism is bounded.
- Report skipped, inaccessible, or environment-dependent checks as gaps with
their risk—not as passes.
Output
Lead with the verification verdict: supported, partially supported, or not supported. Summarize evidence by claim, then failures and residual risk. Include exact commands and concise results so another engineer can reproduce the proof.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: contextosai
- Source: contextosai/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.