A user-acceptance testing process that checks whether a built feature does what was promised. It combines fresh-start checks, builds, type checks, linting, automated tests, and step-by-step manual checks.

Use it after executing a plan or developing with TDD, before a code audit, or for a lighter hotfix or command-line verification.

It catches problems that code review alone may miss, including failures in the working application and gaps between requirements and behaviour.

verify-work — Skill for Claude Code and Codex by danielvm-git

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add danielvm-git/bigpowers --skill verify-work

Clone the repo

git clone --depth 1 https://github.com/danielvm-git/bigpowers

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/danielvm-git/bigpowers/verify-work/github.svg)](https://agentmods.dev/skills/danielvm-git/bigpowers/verify-work)

Your own site

<a href="https://agentmods.dev/skills/danielvm-git/bigpowers/verify-work"><img src="https://agentmods.dev/badge/skills/danielvm-git/bigpowers/verify-work/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/danielvm-git/bigpowers/verify-work"><img src="https://agentmods.dev/badge/skills/danielvm-git/bigpowers/verify-work.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,410 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Tool Misuse · line 159
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
medium Excessive Agency · line 3
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00046	$0.02410
Opus 5.5	$0.00018	$0.00964
Sonnet 5.5	$0.00009	$0.00482
Haiku 4.5	$0.00005	$0.00241

Measured 1mo ago against content hash 9653f73785f5, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

verify-work scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletemediumDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf .next/cache node_modules/.cache 2>/dev/null || true

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

sleep 3 && curl -sf http://localhost:<port>/health || echo "BOOT FAIL"

.cline/skills/verify-work/SKILL.md · 192 lines

How it starts

The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify Work

HARD GATE — No story is "done" until manual UAT for the active story is confirmed with evidence.

HARD GATE — Do NOT run on main or master. Use the feature branch from kickoff-branch.

Review answers "is the code good?"; Verify answers "does the built thing do what was promised?"

Modes

Default: full UAT plus gaps loop
--smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
--cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.

Risk-Scaled Depth

verify-work reads the risk: field from the story template (defaults to P1 if absent) to scale verification rigor:

P0: Full verify-work multi-phase + security-review (step 5) + NFR evidence gate (step 5b).
P1: Standard verify-work (build, test, lint, step-by-step manual).
P2: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
P3: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.

Process

Timing: bash scripts/bp-timing.sh start verify-work at invocation; bash scripts/bp-timing.sh end verify-work before handoff.

Branch check — must not be main/master.

0a. Preflight / CI green (HARD GATE — e51s03) — Run Preflight from CLAUDE.md or BP_PREFLIGHT (bp-read-agents.sh). If PR open: gh pr checks (CI green). Failure blocks all phases → quick-fix or fix-bug.

Read active story tasks from specs/epics/<capsule>/eNNsYY-tasks.yaml and story spec from specs/epics/<capsule>/eNNsYY-<slug>.md (countable-story-format, Gherkin in §17). Note the risk: level (P0–P3). 1a. Pre-UAT verify validation — for each task's verify: command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
```
# For a failing grep -q 'PATTERN' FILE, check what is actually in FILE
grep 'PATTERN' FILE || grep -n '' FILE | head -20   # show nearest lines
```
Report: "Pattern 'X' not found. Nearest match: 'Y' at line N" and ask "Update verify command? [Y/n]". Fix before proceeding — a mismatched verify command produces false failures during UAT.
Cold-start smoke (if app; skip if P3): stop server, clear caches, boot from scratch.
AGENTS.md preflight — if 0a skipped BP_PREFLIGHT, run bash scripts/bp-read-agents.sh and use detected command.
Mechanical gates: build → typecheck → lint → tests (from CLAUDE.md or AGENTS.md). Skip tests if P2/P3.

Read the full file on GitHub · 192 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 192 lines · 46 tokens per session scan B 9653f73785f5

Subscribe to this mod's changes

verify-work is a skill published in the GitHub repository danielvm-git/bigpowers (285 stars, last pushed 3d ago), licensed MIT. It adds 46 tokens to every session and 2,410 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code Debugging E2E testing Testing ai-agents automation bmad clean-code cursor-rules

screen-reader-testing

Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive technology support.

wshobson/agents · 39 tokens

e2e-testing-patterns

Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.

wshobson/agents · 51 tokens

verify-omnigent

Drive Omnigent the way a user does and prove a behavior with recorded evidence, using an isolated server, runner, and mock model plus a feature map of every user entry point. Load before reproducing a user-facing bug, before claiming a fix works, or when reviewing whether a change covered every surface (session vs.…

omnigent-ai/omnigent · 100 tokens

qa/test-strategy

A testing strategy based on the testing pyramid: many small unit tests, fewer integration tests, and a smaller set of end-to-end tests that follow real user journeys. It also defines checks for security, boundaries, permissions, and business consistency.

echoVic/boss-skill · 34 tokens

testing-blocks

Use this when you have made AEM Edge Delivery Services code changes to blocks, scripts, or styles and need to validate them before opening a pull request. Covers unit testing for utilities and logic, browser testing with Playwright, linting, and guidance on what to test and how.

adobe/skills · 61 tokens

qa-knowledge

To run QA engineering — requirements/gap analysis, scenario & spec design, test implementation, failure triage — over the QA knowledge base.

griddynamics/rosetta · 32 tokens

verify-work