verify-and-stop
An agent skill by JuliusBrussee, from JuliusBrussee/caveman. Tags: qa, review, testing, validation.
What it does
Prove existing work meets acceptance conditions without expanding scope. Use for validation-only tasks, completion checks, focused gate runs, and last-mile proof.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add JuliusBrussee/caveman --skill verify-and-stopOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/JuliusBrussee/caveman
cp -r caveman/skills/verify-and-stop ~/.claude/skills/verify-and-stopSafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is documentation-only and is meant to narrow an agent to validation work: prove acceptance criteria, reuse current results, and stop once proof is complete. It does not ship scripts or automation, so the main consideration is behavioral scope, not machine access.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No executable scripts or commands are shipped; the repo contains only `SKILL.md` and `agents/openai.yaml`, both plain text. |
| Network access | 0 (none) | There is no code or configuration that downloads data or sends it to remote hosts. |
| Filesystem reach | 0 (none) | The skill does not instruct reads or writes outside the working repo, and it explicitly says not to edit product code unless fixes are requested. |
| Secrets & credentials | 0 (none) | It does not request tokens, keys, passwords, `.env` files, or other credential stores. |
| Privilege & persistence | 0 (none) | There is no sudo, global install, service registration, shell startup modification, or OS setting change. |
| Instruction hijack surface | 0 (none) | The text only scopes work to verification and stopping; it does not tell the agent to ignore rules, hide actions, or follow untrusted remote instructions. |
| Irreversible actions | 0 (none) | It does not perform external actions like posting, deploying, paying, booking, or deleting; it is explicitly validation-only. |
| Transparency | 0 (none) | Everything provided is readable text; there are no binaries, blobs, or unpinned downloads. |
Before installing
- Read `SKILL.md` and `agents/openai.yaml`; there are no executable scripts in this skill.
- Verify the repo still contains only these two text files before relying on it.
- Use it on a scratch verification task first to confirm it stops after proof and does not edit files.
Rated 2026-10-17 by an automated review of 2 files from the skill's repository.
Source
- Repository
- JuliusBrussee/caveman (all skills from this repository)
- Path
- skills/verify-and-stop/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- principle-prove-it-works — Apply after completing a task, before declaring done.
- principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.
- maintain-verification-skill — Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature.
- tdd — Use only when the user explicitly asks for TDD, a failing test, or a regression test, OR when the bug has an obvious cheap local test target.
- github-review-pr — Reviews or re-reviews one contributor pull request—including an explicitly named closed PR being reconsidered—or a bounded newest-to-oldest sweep of all open.
- qa-expert — This skill should be used when establishing comprehensive QA testing processes for any software project.