Install
$ agentstack add skill-mehrad-dm-mastermind-mastermind-verify ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
MasterMind — Verify
Proving a change works is never optional — but that doesn't mean writing tests. This is the disciplined way to QA a feature by driving the real thing and watching what it does. Writing automated tests / adopting TDD is a project choice — ask first (~/.mastermind/engineering/core/rigor.md); verifying that it works is not. "Looks right" is not verification.
The loop
- Define "works." Restate the expected behavior and the acceptance criteria — what the user asked
for, in observable terms. If you can't say what correct looks like, you can't verify it.
- Pick the lightest real check. Prefer driving the actual thing over reasoning about it: run the
app and click the flow, hit the endpoint, run the script/CLI, render the component. Reuse the project's run/dev command; don't build harness the project doesn't have.
- Exercise the happy path — then the edges that matter. Walk the intended flow, then the cases
rigor.md names: empty, null, error, loading, zero/one/many, unauthorized, malformed input, offline/ slow. Observe actual output and state, not what the code "should" do.
- Check the invisible. Typecheck, lint, and build. Watch the console/network for errors and
warnings. For UI: keyboard + focus, contrast, and no layout shift/regression in nearby areas.
- Report with evidence. Show what you ran and what you observed (command output, the response, a
screenshot). State confidence plainly. If you couldn't run a check (no environment), say so and fall back to the most rigorous manual trace available — never present unrun work as verified.
Rules
- Don't add tests, a test framework, or TDD to a project that has none unprompted — offer them as a
suggestion instead. Where the project does test, run its suite as part of step 2–4.
- Verify against the requirement, not the implementation you just wrote — a hostile reviewer's eye.
- Found a bug? Fix the root cause (or route to
mastermind-debugif it's not obvious) — never
suppress a symptom to make the check pass.
Output
A plain verdict — works / doesn't, with the evidence — the edge cases exercised, and any gaps you couldn't cover (with why). If the user wants this locked in permanently, offer mastermind-tdd.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: mehrad-dm
- Source: mehrad-dm/mastermind
- License: MIT
- Homepage: https://mastermind.mehrad.me
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.