360 Secure SkillHub
360 安全技能中心

verification-loop

该 Skill 在功能开发或重构完成后,依次执行构建、类型检查、lint、测试覆盖率、密钥与 console.log 安全扫描、git diff 审查六个阶段,汇总各阶段 PASS/FAIL 结果并列出待修复问题,作为创建 PR 前的质量门禁检查。

affaan-m
热度 0.00
最近更新 2026-10-18 16:20:28
分类:开发依赖:代码执行 / 读写文件应用场景:代码审查 / 调试排错 / DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add affaan-m/ecc/verification-loop
Metadata
name
verification-loop
description
Run a six-phase verification of a Claude Code session's work — build, type check, lint, tests with coverage, security grep, and diff review — then produce a PASS/FAIL verification report. Use when verifying work after completing a feature or refactor, before creating a PR, or when quality gates must pass.
license
MIT
metadata
{"origin":"ECC"}

Verification Loop Skill

A comprehensive verification system for Claude Code sessions.

When to Use

Invoke this skill:

  • After completing a feature or significant code change
  • Before creating a PR
  • When you want to ensure quality gates pass
  • After refactoring

Verification Phases

Phase 1: Build Verification

set -o pipefail  # report the build's exit status, not tail's
# Check if project builds
npm run build 2>&1 | tail -20
# OR
pnpm build 2>&1 | tail -20

If build fails, STOP and fix before continuing.

Phase 2: Type Check

set -o pipefail
# TypeScript projects
npx --no-install tsc --noEmit 2>&1 | sed -n '1,30p'

# Python projects
pyright . 2>&1 | sed -n '1,30p'

Report all type errors. Fix critical ones before continuing.

Phase 3: Lint Check

Use sed to limit displayed output while consuming the whole stream. This keeps a successful linter from failing on SIGPIPE when pipefail is enabled.

set -o pipefail
# JavaScript/TypeScript
npm run lint 2>&1 | sed -n '1,30p'

# Python
ruff check . 2>&1 | sed -n '1,30p'

Phase 4: Test Suite

set -o pipefail
# Run tests with coverage
npm run test -- --coverage 2>&1 | tail -50

# Check coverage threshold
# Target: 80% minimum

Report:

  • Total tests: X
  • Passed: X
  • Failed: X
  • Coverage: X%

Phase 5: Security Scan

# Check for secrets
grep -rn "sk-" --include="*.ts" --include="*.js" . 2>/dev/null | head -10
grep -rn "api_key" --include="*.ts" --include="*.js" . 2>/dev/null | head -10

# Check for console.log
grep -rn "console.log" --include="*.ts" --include="*.tsx" src/ 2>/dev/null | head -10

Phase 6: Diff Review

# Show what changed
git diff --stat
git diff HEAD~1 --name-only

Review each changed file for:

  • Unintended changes
  • Missing error handling
  • Potential edge cases

Output Format

After running all phases, produce a verification report:

VERIFICATION REPORT
==================

Build:     [PASS/FAIL]
Types:     [PASS/FAIL] (X errors)
Lint:      [PASS/FAIL] (X warnings)
Tests:     [PASS/FAIL] (X/Y passed, Z% coverage)
Security:  [PASS/FAIL] (X issues)
Diff:      [X files changed]

Overall:   [READY/NOT READY] for PR

Issues to Fix:
1. ...
2. ...

Continuous Mode

For long sessions, run verification every 15 minutes or after major changes:

Set a mental checkpoint:
- After completing each function
- After finishing a component
- Before moving to next task

Run: /verify

Integration with Hooks

This skill complements PostToolUse hooks but provides deeper verification. Hooks catch issues immediately; this skill provides comprehensive review.