verify

Verify — Security Scanning

Scans for 1000+ bug patterns across multiple languages. Direct execution.

Design rationale: This skill executes directly as a simple command sequence. UBS handles the analysis internally. No subagents needed.

When This Applies

Signal	Action
Before committing	ubs --staged
Scanning changes	ubs --diff
Scanning specific file	ubs path/to/file
User says "/verify"	Run security scan
Closing a bead	ubs --staged (mandatory)

---

Mandatory Gate

UBS is a mandatory gate before every commit. This is not optional.

Research shows ~40% of LLM-generated code contains security vulnerabilities. The ubs --staged command must pass before any commit.

---

Pre-Commit (Required)

Run before every commit:

ubs --staged                       # Scan staged changes
ubs --staged --fail-on-warning     # Strict mode (exit 1 on any issue)

Fix all issues before committing. Rerun until clean.

---

Scanning Options

# Scan current directory
ubs .

# Scan specific file
ubs path/to/file.ts

# Scan working tree changes vs HEAD
ubs --diff

# Verbose with code examples
ubs -v .

---

Profiles

# Strict (fail on warnings) - for production code
ubs --profile=strict .

# Loose (skip nits) - for prototyping
ubs --profile=loose .

---

Language Filters

# Single language
ubs --only=python .

# Multiple languages
ubs --only=typescript,javascript .

Supported languages:

• javascript, typescript
• python
• c, c++
• rust, go
• java, ruby

---

Output Formats

ubs . --format=json                # JSON
ubs . --format=jsonl               # Line-delimited JSON
ubs . --format=sarif               # GitHub Code Scanning

---

CI Integration

ubs --ci                           # CI mode
ubs --comparison baseline.json .   # Regression detection

---

Suppressing False Positives

Add to the line:

// ubs:ignore
const result = eval(userInput); // ubs:ignore