maintain-verification-skill
An agent skill by cursor, from cursor/plugins. Tags: analysis, review, testing, validation, workflow.
What it does
Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill maintain-verification-skillOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/maintain-verification-skill ~/.claude/skills/maintain-verification-skillSafety box score
Grade B, low risk: 11 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a scoped maintenance loop for verification docs and harnesses: it reads feature-map/source files, runs live verification sessions, and may edit only its own skill directory. The main risk is moderate autonomy, because it can drive the app and ship a PR of corrections, but it is explicitly fenced away from product-code edits and privilege changes.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | The shipped file is plain markdown and does not define shell commands, code evaluation, or native scripts. |
| Network access | 0 (none) | There is no instruction to download from or send data to remote hosts; the skill only describes local reading, driving, and editing. |
| Filesystem reach | 1 (low) | It is allowed to write inside its own directory only: "Only edit the verification skill's own directory (its SKILL.md, features/, and any harness scripts it owns)." |
| Secrets & credentials | 0 (none) | The skill does not ask for tokens, passwords, key files, browser sessions, or other secret stores. |
| Privilege & persistence | 0 (none) | No sudo, global install, service registration, or shell/OS setting changes are described. |
| Instruction hijack surface | 0 (none) | There is no prompt-injection pattern such as fetching external instructions, hiding text, or telling the agent to ignore its rules. |
| Irreversible actions | 2 (moderate) | It performs a live verification pass and can produce a PR: "For changed: one PR ships proven doc, harness, or map corrections." |
| Transparency | 0 (none) | The content is fully readable markdown; no binaries, minified code, or decoded-at-runtime payloads are present. |
Before installing
- Check that the target verification skill actually exists under `.cursor/skills/verify-*` before letting it run.
- Read the skill's own launch/drive guidance and any harness scripts it owns; this skill assumes it can exercise the app live.
- Confirm you are comfortable with the agent creating one PR of docs/harness/map corrections if it finds drift.
Rated 2026-10-20 by an automated review of 1 file from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- pstack/skills/maintain-verification-skill/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- principle-prove-it-works — Apply after completing a task, before declaring done.
- blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
- create-verification-skill — Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform.
- no-comments — Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.
- principle-sequence-verifiable-units — Apply to multi-step work (sweeps, migrations, runs of similar edits) and to how you stack commits and PRs.
- principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.