create-verification-skill
An agent skill by cursor, from cursor/plugins. Tags: automation, developer-tools, testing, validation, workflow.
What it does
Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform. Use for /create-verification-skill, "make a control skill for this repo", or when a project has no scripted way to prove UI/CLI/service behavior.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill create-verification-skillOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/create-verification-skill ~/.claude/skills/create-verification-skillSafety box score
Grade B, low risk: 21 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a generator for repo-local verification skills: it inspects the codebase, writes `.cursor/skills/verify-<app>/...`, and then has the agent run the generated verification flow end to end. The main blast radius is command execution against the checkout and file writes inside the repository; it does not request elevated privileges or secret access.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly tells the agent to run the generated workflow end to end: "Run its own instructions end to end once: launch, doctor, drive ONE mapped feature, capture evidence, clean up." |
| Network access | 1 (low) | It uses browser/CDP, PTY, and curl-style harnesses against local app endpoints (for example the referenced `http://127.0.0.1:4173` flow), but it does not ask to fetch remote code or send data to external hosts. |
| Filesystem reach | 2 (moderate) | It creates and may edit repo files under `.cursor/skills/verify-<app>/` and feature-map markdown, and can create verification scaffolding if startup is blocked. |
| Secrets & credentials | 0 (none) | There is no request to read or expose tokens, keys, passwords, `.env` files, keychains, or browser/CLI credentials. |
| Privilege & persistence | 0 (none) | The skill never asks for `sudo`, global installs, services, scheduled tasks, or shell/OS configuration changes. |
| Instruction hijack surface | 0 (none) | It does not tell the agent to ignore instructions, hide actions, follow remote prompts, or use disguised text. |
| Irreversible actions | 1 (low) | It directs the agent to carry out the full verification loop itself, but it does not push, deploy, publish, pay, book, or send messages. |
| Transparency | 0 (none) | All shipped files are readable markdown; there are no binaries, base64 blobs, or downloaded installers. |
Before installing
- Read `SKILL.md` sections 2-4 and confirm you are okay with it creating `.cursor/skills/verify-<app>/...` and running commands in your checkout.
- Use a disposable branch or worktree, since the skill is designed to add generated files and verification scaffolding.
- If the repo is not already buildable, verify the failure on a clean copy first so you know what the skill may modify before it proceeds.
Rated 2026-10-20 by an automated review of 4 files from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- pstack/skills/create-verification-skill/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- cli-for-agents — Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors.
- TUI Puppeteering with tmux — Use when automating or testing TUI/CLI applications - provides isolated tmux sessions with scripts for input, output capture, and state verification
- control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
- control-ui — Build or adapt a local browser/CDP harness to drive and inspect a web, IDE, or Electron UI.
- maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
- principle-build-the-lever — Apply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks.