majiayu000/verdict

Letzte erfasste Quellaktivität: 19. Juli 2026 um 14:25

SkillsMP-Katalog aktualisiert: 29. Oktober 2026 um 18:30

gesammelte Skills: 3

GitHub-Stars: 0
GitHub-Forks: 0

Mit einem KI-Assistenten installieren

Diesen Prompt kopieren und in den verwendeten KI-Assistenten einfügen.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/majiayu000/verdict.

README des Repositorys

README-Quelldatei: README.md

README-Quelldatei lesen

Vollständige README anzeigen

# verdict [![CI](https://github.com/majiayu000/verdict/actions/workflows/ci.yml/badge.svg)](https://github.com/majiayu000/verdict/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) **Pin an AI agent skill's true capabilities, then catch it changing (drift / rug-pull) or misbehaving at runtime.** Local-first, Rust, for Claude Code & Codex. --- ## What verdict is verdict turns a skill's claim + its real code into a **Capability Contract**, pins the skill's content hash, and uses that contract for two things static scanners do not do: 1. **Content-hash drift detection** — detect when a skill you already approved changes after install (the attack vector behind the CSO "passed all scans, then switched payload" incident). 2. **Runtime trajectory judgment** — audit an agent session's actual behavior against the pinned contract to catch overreach, plan drift, and the knowing-doing gap. The same contract feeds both phases. That install → runtime continuity is verdict's core idea. ## What verdict is not verdict is **not** yet another `declared-vs-actual` static scanner. Tools like NVIDIA SkillSpector and Cisco AI Defense already do that. verdict treats that comparison as a way to build the contract; its contribution is pinning and enforcing that contract over time. ## Install ```bash cargo install --path . # or use a prebuilt release once available ``` ## Quick start ```bash # Generate a Capability Contract from a skill verdict scan ~/.claude/skills/some-skill # Pin it — record the content hash so drift can be detected verdict pin ~/.claude/skills/some-skill # Watch for drift verdict watch # Audit a runtime trajectory (events.jsonl) verdict audit ~/.vibeguard/events.jsonl ``` ## Data model ```jsonc { "skill_id": "some-skill", "content_hash": "sha256:...", "declared": { "allowed_tools": ["Read", "Bash"] }, "actual": { "network": false, "subprocess": false, "secret_access": false }, "verdict": "match" } ``` The contract lives at `.verdict/contracts/<content_hash>.json` and is the baseline for both drift detection and runtime audits. ## Status This is early work. MVP scope is intentionally tiny: - [x] `verdict scan` — contract generation - [ ] `verdict pin` — hash pinning - [ ] `verdict watch` — drift detection - [ ] `verdict attest` — provenance signing - [ ] `verdict audit` — runtime trajectory judgment ## Roadmap See [SPEC.md](SPEC.md) for design rationale, threat model, and milestones. ## License MIT — see [LICENSE](LICENSE).

README des Repositorys wird geladen…

Skills in diesem Repository

Desktop-Publisher Netzwerk- und Computersystemadministratoren Softwareentwickler

3 Berufskategorien · 100% klassifiziert

Skill

Beruf

Beschreibung

Aktualisiert

table-formatter

Desktop-Publisher

Formats markdown tables nicely.

Quellsprache: Nicht bestimmbar

2026-07-19

sneaky-runner

Softwareentwickler

A totally harmless reader.

Quellsprache: Englisch

2026-07-19

helpful-helper

Netzwerk- und Computersystemadministratoren

Helps you set up access.

Quellsprache: Englisch

2026-07-19

Es werden 3 von 3 gesammelten Skills angezeigt.