Pre-Ship Verification for Code Changes
Before calling a code change done, Claude grades every claim by evidence, tries to break it, and reports what's verified vs assumed.
Before & after
Same prompt, same agent — the only difference is the skill.
I can review your authentication code. It looks reasonable at first glance. What testing have you already done? Are you using any standard libraries or rolling custom crypto? I'd suggest checking for common vulnerabilities, but to be thorough, it would help to know more about your specific implementation and threat model.
VERIFICATION CHECKLIST: Authentication Module → SECURITY VERIFICATION (DO THIS FIRST) ✓ Password hashing: bcrypt or argon2? (if MD5 or SHA1, FAIL) ✓ Salt unique per hash? (check db – not stored plaintext) ✓ Timing attack vulnerability? (use constant-time comparison) ✓ Session token generation: cryptographically secure? (not Math.random()) ✓ Token storage: httpOnly cookie + secure flag set? ✗ TRAP: Many auth breaches from session fixation – always regenerate token on login → EDGE CASE COVERAGE ✓ Test concurrent login attempts (same user, 2 browsers) ✓ Test token expiration (attempt use at expiry+1ms) ✓ Test password reset flow (invalid token after use, expiry honored) ✓ Test logout across all sessions (one logout doesn't kill others) ✓ Test admin escalation (user can't self-promote to admin) Question to resolve: LDAP fallback – scope of directory users included? → COMPLIANCE & AUDIT ✓ Confirm password policy (min 8 chars, no common patterns) ✓ Failed attempt logging (locked after 5 tries / 15min window) ✓ No credentials in logs (grep for password variables in output) ✓ PII properly scoped in error messages (user doesn't see system internals) → DEPLOYMENT GATE Stop: Run full integration test suite before ship (required pass rate: 100%) Stop: Security scan on dependencies (run npm audit / pip audit) Action: Coordinate staged rollout – 10% traffic first (1 hour), then 50%, then 100%
About this skill
"Fixed!" Then it isn't. Coding agents declare victory on a green test run that never touched the changed line. They skip the exact boundary value where the bug lives, and they bury real doubts in a closing "you may want to test X." This skill turns "done" into a claim-by-claim verdict backed by evidence, with problems fixed before you hear about them.
What it does
- Builds a claim ledger of everything the change depends on, including hidden assumptions like "input is never null" or "runs single-threaded"
- Grades each claim as EXECUTED, READ, INFERRED, or ASSUMED, and only uses "verified" for the first two
- Proves tests cover the change by checking they fail without the fix, and catches mocks, loosened assertions, and snapshot rewrites that fake coverage
- Attacks boundaries on purpose: limit-1, limit, limit+1, empty, null, unicode, DST, last page
- Hunts down every caller, string reference, and copy-pasted twin of the buggy logic, then flags concurrency, retry, and environment gaps between your test setup and production
- Re-reads the final diff for debug leftovers, unintended files, and tests weakened to get green
What you get
A compact verification report with a status line, each claim and its evidence, the breakage attempts and their results, any fixes made during verification, and a short list of what still needs you to run or check.
Best for
Developers who use Claude Code or other coding agents on real codebases and are tired of "it's fixed" turning out wrong. Also useful for reviewers who want a skeptical second pass on a diff before merging.
SKILL.md preview
---
name: pre-ship-verification-for-code-changes
description: Runs a skeptical verification pass on a code change before it is called done. It lists every claim the change depends on, grades each by evidence (executed, read, inferred, assumed), proves the tests actually exercise the change, attacks boundaries and other call sites, then reports verified vs unverified honestly. Use when the user says "is this actually done?", "double-check your work before you tell me it's fixed", "the tests pass but I don't trust it", "you said it was fixed and it wasn't", "my agent keeps declaring victory too early", "review this diff before I merge", "verify this fix".
---
… (sign up to view the full skill)More development skills
View all Development skills →React and Next.js Regression Test Coverage
Generate React and Next.js tests with Jest, Testing Library, MSW, and Playwright, prioritized by regression risk.
Playwright E2E Tests and Flake Repair
Build reliable Playwright tests, repair flakes from evidence, migrate suites, and configure faster, diagnosable CI.
TestRail Case and CI Result Sync
Sync automated tests to TestRail cases and scoped runs with stable mappings, retry handling, and verified result counts.
Claude Skill Validation and Quality Scoring
Audit SKILL.md structure, test supplied scripts, and get an evidence-backed grade, quality tier, and prioritized fixes.