How to use the Verification Loop agent skill (verification-loop)

What is the Verification Loop skill and what does it make the agent do?

An agent skill is a folder with a SKILL.md file that gives Claude Code a set of instructions for a specific task. When this skill is active, the agent works through six verification phases on your code project: it checks that the build runs, checks types, runs the linter, runs the test suite with coverage, scans for leaked secrets and stray console.log lines, and reviews the git diff of changed files.

At the end, the agent produces a short report with PASS or FAIL for each area and a general verdict of READY or NOT READY for a pull request. The skill's own instructions say to list the problems to fix after the report.

• Build: runs npm run build or pnpm build.
• Types: runs npx tsc --noEmit for TypeScript or pyright for Python.
• Lint: runs npm run lint for JavaScript/TypeScript or ruff check for Python.
• Tests: runs the test script with coverage and checks against a stated goal of at least 80%.
• Security: greps for 'sk-', 'api_key' and console.log.
• Diff: runs git diff --stat and git diff HEAD~1 --name-only, then reviews changed files.

Install the Verification Loop skill

Download the skill ZIP from this page and unzip it. The skill is a single file, SKILL.md. Put the unzipped folder in one of these locations:

For all of your projects, place it in ~/.claude/skills/. For one project only, place it in that project's .claude/skills/ folder.

If you use the Claude apps instead of Claude Code, you can upload the ZIP under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command to start the skill. Ask the agent in plain language, and it should recognise when the skill applies. The skill's own guidance says to run it after finishing a significant feature or code change, before creating a PR, when you want quality gates to pass, and after refactoring.

The source also mentions a command called /verify inside its continuous mode section. Check your setup to confirm how it is exposed in your installation before relying on it.

• "Run the verification loop on my changes before I open a PR."
• "Check whether this feature is ready for a pull request."
• "I just finished refactoring the auth module, verify it."
• "Run the build, types, lint and tests and tell me if it's ready to merge."

What does a typical run look like?

The agent runs each phase in order. The skill says that if the build fails, the agent should stop and fix it before continuing. For type errors, it should report all of them and fix the critical ones before moving on. The instructions are in Spanish, so the agent's report labels and guidance will be in Spanish, while you can still ask in English.

Expect the output to be a checklist-style report. Review the listed problems yourself, because the checks only cover what the commands and greps can detect.

• Example report labels: Build, Tipos, Lint, Pruebas, Seguridad, Diff, General.
• General verdict is either LISTO or NO LISTO para PR.

What does the skill need to run?

The skill assumes a code project with git and build tools already installed. For JavaScript and TypeScript projects, you need Node.js with npm or pnpm, because the build, lint and test steps call scripts defined in your project. For type checking, you need the TypeScript compiler (npx tsc) or pyright. For Python projects, you need ruff. Your project's test suite should be configured with a coverage option, since the command passes --coverage.

The skill runs scripts, and it does not use the network, according to its listing.

• git
• Node.js with npm or pnpm (JavaScript/TypeScript projects)
• TypeScript compiler (npx tsc) or pyright
• ruff (Python projects)
• A test suite configured with a coverage option

Safety notes: scripts and the secret check

The skill runs shell commands in your project, so read SKILL.md before installing and check what the agent is about to run. The secret check is a simple text search for 'sk-' and 'api_key' in .ts and .js files, plus console.log searches in src/. It is not a security audit. It can miss real secrets stored under other names or in other file types, and it can flag harmless text as a secret.

Do not treat a PASS in the security row as proof that your code has no leaked credentials. Use a dedicated secret scanner for that.

• The skill runs scripts in your project folder.
• The secret check only searches for 'sk-' and 'api_key' in .ts and .js files.
• The commands are written for Node/TypeScript and Python. Other stacks need the agent to adapt them.

Tips for getting the most from the skill

Run the skill when a feature is complete, not after every small edit. The source also describes a continuous mode for long sessions, where you pause for a check after each function, component or task. It also notes that the skill complements PostToolUse hooks: hooks catch problems immediately, while this skill gives a fuller review.

Ask the agent to explain any FAIL before it changes code, and keep a clean git state so the diff review is easy to read.

• Run it before opening a pull request, not on every save.
• If your project uses another language or tool, tell the agent which commands to use instead.
• Use the 80% coverage target as a guide and adjust it to your team's standard.
• Pair it with hooks for immediate feedback during a session.