360 Secure SkillHub
360 安全技能中心

principle-prove-it-works

原则型 Skill,要求在宣告任务完成前对照真实产物进行验证:运行功能、读取实际值、检查差异,而非依赖文件时间戳、缓存或自我报告;建议把检查写成可重复运行的脚本并保留可见产物,仅大型或复杂工作才提交留痕。

cursor
热度 0.00
最近更新 2026-10-18 16:52:33
分类:自动化依赖:代码执行 / 读写文件应用场景:工作流 / 调试排错

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add cursor/plugins/principle-prove-it-works
Metadata
name
principle-prove-it-works
description
Apply after completing a task, before declaring done. Verify against the real artifact (run the feature, read the actual value, inspect the diff), not a proxy, self-report, or 'it compiles.'
disable-model-invocation
true

Prove It Works

Verify every task output by checking the real thing directly. Do not infer from proxies, self-reports, or "it compiles."

Why: Unverified work has unknown correctness. Indirect verification (file mtimes, output freshness, agent self-reports, cached screenshots) feels cheaper than direct observation. Acting on a wrong inference costs far more than checking the source.

Check the real thing, not a proxy:

  • Check process liveness directly, not indirectly through derived state
  • Read the actual value, not a cached or derived representation
  • When verification fails, suspect the observation method before suspecting the system

Script the check when you can

The strongest proof is a deterministic script that re-runs the same comparison, not a one-time eyeball. Write the script, run it, and keep its output as an artifact a reviewer can re-run instead of trusting your word.

Keep the artifact visible for the human. Commit it only for large or complex work where the trail has to be auditable later, like a big port or migration (the show-me-your-work skill).