Verify Findings

This skill helps agents identify the findings that still need attention.

Resolve Scope

Verify the findings already established in the conversation or explicitly supplied by the user. Honor a selected subset and preserve each finding’s identifier. If you can’t establish the finding set or target, ask for that context rather than reconstructing it. Don’t expand verification into a new audit.

Keep this workflow read-only unless the user expressly requests additional effects under Agent Conduct. Without that direction, don’t apply fixes, change configuration, create report files, install dependencies, stage or commit changes, or submit results to an external service. Verification itself doesn’t authorize another effect. Route separately authorized work through its owning workflow.

Verify Evidence

Re-read applicable instructions and the previously reported files for the selected findings. Reuse content only when evidence establishes that it hasn’t changed since the current task read it. Check each finding against the current target, governing requirements, and settled user decisions, not merely the original reviewer’s conclusion.

When conclusions conflict, compare their target revisions, governing requirements, settled decisions, and material assumptions. When a finding conflicts with an established decision, assess whether the decision still applies and whether materially new evidence challenges it. Intent alone isn’t a rebuttal, and a prior decision doesn’t excuse a real defect. As the agent verifying the findings, you own their disposition. Weigh evidence, not reviewer counts, and use the smallest decisive inspection or check within the selected scope, authority, and existing limits. Don’t add reviewers merely to obtain agreement or classify preference-only alternatives as required fixes. Retain uncertainty when evidence is insufficient, and report the gap rather than forcing a verdict. Ask the user only for a material choice that the evidence and current authority can’t settle, or a separately required approval. Retain the decisive reason with the finding’s classification, and follow Report Results below when deciding which findings to include in the response. This doesn’t add a review stage or unanimity requirement.

Verify claims that depend on evidence outside the inspected files separately, including ignored files, runtime state, and upstream behavior. Unchanged files don’t establish unchanged external behavior. Inspect only relevant evidence, excluding known secret-bearing sources. Don’t reopen a finding previously classified as requiring no change unless relevant content changed or materially new evidence is available.

Use the consuming environment’s established tools. In the read-only workflow, run only checks whose effects are known to be non-mutating. Inspection and validation can execute code. Disable unrelated executable startup configuration, hooks, and plugins unless their behavior is in scope or required by an established project workflow. Don’t bypass required controls. If a check requires an ungranted permission or unauthorized state change, leave the affected claim unverified and identify what’s needed rather than running it.