How do I install the Torusguard Verify skill?

Run npx skillmds@latest add githubmofo/torusguard-verify in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Torusguard Verify safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Torusguard Verify?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Torusguard Verify free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Torusguard Verify?

githubmofo (@githubmofo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Torusguard Verify by githubmofo — Agent Skill

Name: Torusguard Verify
Author: githubmofo

File contents

TorusGuard Verify — Finding Evidence Verification & Calibration

Objective

Audit the evidence sufficiency of candidate findings by reading current disk lines, evaluating unbroken taint source-to-sink flow, filtering false alarms, and calibrating final 0–100 confidence scores.

Execution Steps

Locate Target Findings: Load active findings from .torusguard/runs/<latest-run>/findings.md.
Handle CLI Failures: If python .torusguard/scripts/finding_scorer.py or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.
Live Disk Line Match: Inspect exact cited lines using view_file to confirm code presence.
Audit Evidence Sufficiency: Verify source-to-sink flow against criteria below.

Calibrate Confidence Score:

python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify

Update State: Mark finding as Confirmed, Needs Review, or False Positive.
Emit Verified Evidence: Save report in .torusguard/runs/<run_id>/verified-evidence.md.

Evidence Sufficiency

A finding is verified as sufficient when:

Direct AST Match: The vulnerable API or sink call exists on disk at the cited location.
Exposed Surface: The sink is reachable from an external route, view, or public method.
Absence of Sanitizer: No escaping function, parameterization, or validating middleware neutralizes the input.
Taint Integrity: Untrusted request data flows into the sink without structural validation.

Safety Constraints

Read-only analysis; no files are modified.
Never guess line numbers; always verify via active disk read.
Downgrade findings with sanitizer presence to False Positive.

Output Format

🧪 [TorusGuard] Finding Verification Complete (AI Assisted)
- Findings Audited: <Count> | Confirmed Real: <Count>
- False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
- Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`
Next: Run `/torusguard harden` to formulate surgical fixes for confirmed flaws.

---name: torusguard-verifydescription: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.---# TorusGuard Verify — Finding Evidence Verification & Calibration## ObjectiveAudit the evidence sufficiency of candidate findings by reading current disk lines, evaluating unbroken taint source-to-sink flow, filtering false alarms, and calibrating final 0–100 confidence scores.---## Execution Steps1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.2. **Handle CLI Failures:** If `python .torusguard/scripts/finding_scorer.py` or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.3. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.4. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.5. **Calibrate Confidence Score:** ```bash python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify ```6. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.7. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.---## Evidence SufficiencyA finding is verified as sufficient when:- **Direct AST Match:** The vulnerable API or sink call exists on disk at the cited location.- **Exposed Surface:** The sink is reachable from an external route, view, or public method.- **Absence of Sanitizer:** No escaping function, parameterization, or validating middleware neutralizes the input.- **Taint Integrity:** Untrusted request data flows into the sink without structural validation.---## Safety Constraints- Read-only analysis; no files are modified.- Never guess line numbers; always verify via active disk read.- Downgrade findings with sanitizer presence to `False Positive`.---## Output Format```markdown🧪 [TorusGuard] Finding Verification Complete (AI Assisted)- Findings Audited: <Count> | Confirmed Real: <Count>- False Positives Filtered: <Count> | Refined Mean Score: <Score>/100- Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`Next: Run `/torusguard harden` to formulate surgical fixes for confirmed flaws.```

Frequently asked questions

Torusguard Verify