Why?

AI coding agents are powerful — but they skip linting, ignore security basics, and hallucinate tool calls. Code reviews catch some of this, but not consistently.

Agent Verifier is an AI agent skill that acts as an automated reviewer. It checks for:

• 🔒 Security gaps — hardcoded secrets, missing input validation, exposed stack traces
• 🔄 Dangerous agent patterns — infinite loops, unbounded retries, hallucinated tools
• 📏 Code quality — naming, docs, error handling, magic values
• 🐍🟦🐹 Language-specific issues — Python type hints, TypeScript strict mode, Go error handling

Install it once. It runs every time you say "verify agent".

Author's Note

💡 If Agent Verifier looks interesting to you — or saves you a prod bug — consider giving it a ⭐. It's the only signal GitHub gives us that this is worth maintaining and adding more capabilities to this repo.

🤝 Contributions and feature requests welcome — open an issue or PR any time.

What You Get

Run "verify agent" in your coding assistant (eg. Claude Code, Cursor or others) and get a structured report:

✅ 8 checks passed | ⚠️ 3 warnings | ❌ 2 issues

❌ Hardcoded API key at config.py:12
  → Move to environment variable

❌ Hallucinated tool reference: execute_sql
  → Tool referenced in prompts but not defined

⚠️ Unbounded loop at agent/loop.py:45
  → Add MAX_ITERATIONS constant

⚠️ System prompt exceeds recommended size (6.2K tokens)
  → Split into modular sections

All analysis runs locally. Your code never leaves your machine.

# Verification Report

**Project:** my-project
**Date:** 2026-03-04
**Mode:** Standalone
**Files analyzed:** 12
**Agent type detected:** LangGraph

## Summary

✅ 8 checks passed | ⚠️ 3 warnings | ❌ 2 issues

### By Category
| Category | Pass | Warn | Issue |
|----------|------|------|-------|
| Code Quality | 5 | 1 | 0 |
| Security | 2 | 0 | 1 |
| Agent Patterns | 1 | 2 | 1 |

## Agent Pattern Analysis

### Loop Safety
- [x] All retry mechanisms have explicit limits
- [ ] ⚠️ Potential unbounded loop at `agent/loop.py:45`

### Tool Consistency
- [x] Tool registry found: 5 tools defined
- [ ] ❌ 1 hallucinated tool reference in prompts

### Context Management
- [ ] ⚠️ System prompt exceeds recommended size (6.2K tokens)
- [x] Tool descriptions within limits

## Findings

### ✅ Passing
- Naming conventions: Consistent camelCase used throughout
- Error handling: All async functions have try/catch

### ⚠️ Warnings
- Missing type hints: `utils.py:45`
  - **Location:** `utils.py:45`
  - **Suggestion:** Add type hints to `process_data()` function

### ❌ Issues
- Hardcoded API key: `config.py:12`
  - **Location:** `config.py:12`
  - **Rule:** No secrets in source code
  - **Fix:** Move to environment variable

## Recommendations

1. Move API keys to environment variables
2. Add type hints to public functions

## Agent-Specific Recommendations

1. **Loop Safety:** Add `MAX_ITERATIONS` constant to `agent/loop.py`
2. **Tool Registry:** Remove or implement `execute_sql` tool
3. **Context Management:** Split system prompt into modular sections

Quickstart

# Install (works with Claude Code, Roo Code, Cursor, and 30+ agents)
npx skills add aurite-ai/agent-verifier -a claude-code -a cursor -a <your-fav-coding-agent>

# Then in your agent folder just ask your coding assistant (eg. Claude Code, Cursor, or others):
verify agent

That's it. For more installation options, see Installation.

Learn More

New to Agent Verifier? These guides walk you through everything:

• Getting Started — Install and run your first verification in 5 minutes
• Tutorials — Step-by-step guides:
  • Installation — Detailed installation options
  • First Verification — Run your first verification
  • Understanding Reports — Interpret and prioritize findings
  • Focused Checks — Use individual verification skills

The rest of this README serves as a technical reference.

Contributions

We welcome contributions of all kinds! Here's how you can help:

• 🐛 Found a bug? Open an issue
• 💡 Want a new check? Open a feature request
• 🔧 Want to contribute code? Open a PR

Table of Contents

• Why?
• What You Get
• Quickstart
• Architecture
• Available Skills
• Installation
• Updating Installed Skills
• Usage
• Features
• How It Compares
• Check Reliability
• Privacy
• Contributing
• Citation
• License

Architecture

┌─────────────────────────────────────────────────────────────┐
│                      verification                           │
│                 Full Suite Orchestrator                     │
│                 trigger: "verify agent"                     │
└───────────┬───────────┬───────────┬───────────┬─────────────┘
            │           │           │           │
            ▼           ▼           ▼           ▼
    ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐
    │  verify-  │ │  verify-  │ │  verify-  │ │  verify-  │
    │ security  │ │ patterns  │ │  quality  │ │ language  │
    ├───────────┤ ├───────────┤ ├───────────┤ ├───────────┤
    │ • secrets │ │ • loops   │ │ • naming  │ │ • Python  │
    │ • deps    │ │ • retries │ │ • docs    │ │ • TypeScript│
    │ • input   │ │ • tools   │ │ • errors  │ │ • Go      │
    │ • errors  │ │ • context │ │ • magic   │ │           │
    └───────────┘ └───────────┘ └───────────┘ └───────────┘

Each skill can run independently: "verify agent security", "verify agent patterns", etc.

Available Skills

Installation

Recommended

# Install all skills to all detected agents (Claude Code, Roo Code, Cursor, etc.)
npx skills add aurite-ai/agent-verifier -a claude-code -a <your-fav-coding-agent>

# List available skills in this package
npx skills add aurite-ai/agent-verifier --list

# Install to specific agents (multi select allowed)
npx skills add aurite-ai/agent-verifier -a claude-code -a roo

# Install specific skills only
npx skills add aurite-ai/agent-verifier --skill verification verify-security

# Install globally (available in all projects)
npx skills add aurite-ai/agent-verifier -g

# List available skills
npx skills add github:aurite-ai/agent-verifier --list

# Install to specific agents (multi select allowed)
npx skills add github:aurite-ai/agent-verifier -a claude-code -a roo

# Install all skills from public GitHub repo
npx skills add github:aurite-ai/agent-verifier --all

# Install specific skills only
npx skills add github:aurite-ai/agent-verifier --skill verification verify-security

# From a specific branch
npx skills add github:aurite-ai/agent-verifier#main --all

# From a specific tag/release
npx skills add github:aurite-ai/agent-verifier#v1.0.0 --all

# From private repo (requires GitHub authentication)
npx skills add github:your-org/your-private-skill --all

# List available skills in local repo
npx skills add ./path/to/agent-verifier --list

# Install to specific agents (multi select allowed)
npx skills add ./path/to/agent-verifier -a claude-code -a roo

# Install all skills from local path
npx skills add ./path/to/agent-verifier --all

# Install specific skills only
npx skills add ./path/to/agent-verifier --skill verification verify-patterns

# Install with link (for development - changes reflect immediately)
npx skills link .

# For Roo Code (copy all skills)
cp -r skills/* ~/.roo/skills/

# For Claude Code (copy all skills)
cp -r skills/* ~/.claude/skills/

# For other agents, check their documentation for the skills directory location

Updating Installed Skills

From NPM Registry

Re-run the install command to get the latest published version:

# Update all skills to latest version
npx skills add aurite-ai/agent-verifier --all

# Install to specific agents (multi select allowed)
npx skills add aurite-ai/agent-verifier -a claude-code

# Update specific skills only
npx skills add aurite-ai/agent-verifier --skill verification verify-security -a claude-code

# Or specify a version
npx skills add aurite-ai/agent-verifier@1.2.0 -a claude-code

# Update all skills from default branch
npx skills add github:aurite-ai/agent-verifier --all -a claude-code

# Update from specific branch
npx skills add github:aurite-ai/agent-verifier#main --all -a claude-code

# Update to specific tag/release
npx skills add github:aurite-ai/agent-verifier#v1.2.0 -a claude-code

# Check the skills-lock.json in your project
cat skills-lock.json  # Look for "method": "symlink"

# Or check the installed skill directly
ls -la .agents/skills/verification  # Should show -> pointing to source

# Reinstall from source
npx skills add /path/to/agent-verifier -a claude-code

# Or force reinstall
npx skills add /path/to/agent-verifier -a claude-code --force

# Remove each skill by skill name
npx skills remove verification

# Reinstall from any source
npx skills add aurite-ai/agent-verifier -a claude-code

# Copy updated files directly
cp -r /path/to/agent-verifier/skills/verification ~/.claude/skills/

Usage

Once installed, trigger verification by asking your coding agent:

Full Verification Suite

"verify agent"

This runs the complete verification suite covering security, agent patterns, code quality, and language-specific checks. Use this for comprehensive audits or pre-release reviews.

Focused Verification

For faster, targeted checks, use domain-specific invocations:

Legacy Triggers (Still Supported)

These phrases also trigger the full verification suite:

• "review this implementation"
• "check compliance"
• "audit my agent"
• "validate against best practices"

Features

Dual-Mode Operation

Standalone Mode (default):

• Automatically detects project language and framework
• Applies built-in best practices for code quality and security
• Honors existing lint configs (ESLint, Biome, etc.)

Kahuna-Enhanced Mode (when Kahuna is installed):

• Loads organization-specific rules from knowledge base
• Uses kahuna_ask for deeper context queries
• Applies framework patterns surfaced by kahuna_prepare_context

Verification Checks

The skill performs comprehensive verification across multiple categories:

1. Code Quality

2. Security

3. Language-Specific

Python:

TypeScript/JavaScript:

Go:

4. AI Agent Patterns

Loop Safety:

Retry Limits:

Tool Registry:

Context Management:

Note: "System prompt" refers to your agent's prompt files (e.g. prompts/system.md, prompts.py, system.md). Files in skills/ directories are skill definitions loaded on demand, not static system prompts, and are excluded from this check.

5. Framework Detection

Automatically detects and applies framework-specific checks:

# Navigate to a fixture directory and ask your agent to verify it
cd tests/fixtures/infinite_loop
# Then ask: "verify this code for agent patterns"

# Or verify all fixtures at once
cd tests/fixtures
# Then ask: "verify these test fixtures and report findings"

How It Compares

Agent Verifier is not a replacement for linters — it catches what they cannot: agent-specific patterns, context management issues, and tool hallucinations.

Check Reliability

Because Agent Verifier runs as an AI agent skill rather than a deterministic parser, checks are classified into two tiers. Every finding in the report is tagged accordingly.

Pattern-matched checks (reliable):

Heuristic checks (best-effort):

Privacy

All code analysis happens locally. No telemetry, no external calls, no data collection. Your code never leaves your machine.

Contributing

We welcome contributions of all kinds! Here's how you can help:

• 🐛 Found a bug? Open an issue
• 💡 Want a new check? Open a feature request
• 🔧 Want to contribute code? Open a PR

Citation

If you use Agent Verifier in your research or reference it in a paper, please cite:

@misc{oswal2026agent,
  title={Agent Verifier: Catch security issues, enforce standards, and validate agent patterns — before code ships.},
  author={Oswal, Jiten},
  journal={Github (Open Source)},
  url={https://github.com/Aurite-ai/agent-verifier},
  year={2026}
}

Built by Aurite AI

Built by Aurite AI. Interested in enterprise capabilities — secure agent infrastructure, shared context pools, administrative controls, and centralized hosting? Visit aurite.ai or reach out at info@aurite.ai.

License

MIT License — see LICENSE