Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →hashgraph-online/codetruss
Operate CodeTruss local acceptance gates for coding-agent changes.
Passed 15 of 19 test cases with the skill, and 8 of 19 without it.
and 8 more in the full report
10 fixed7 passed either way3 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
We reviewed and approved the exact list of detected verification scripts in our repo setup. Which flag should be passed during setup execution so fingerprint trust is included?
| Checked | Without skill | With skill |
|---|---|---|
| Includes the --trust-verify flag when running setup after developer explicit approval. | Missed | Passed |
The instructions your model reads when the skill loads.
Use the installed codetruss CLI as the source of truth. Do not reimplement
scope classification, analyzers, verdict rules, signing, or hook behavior in the
agent.
codetruss --version first. This skill targets v0.2.35 or newer. If the
CLI is missing or older, explain the prerequisite, then
obtain explicit consent before downloading or installing software, including an upgrade.https://codetruss.com/cli. Let
the developer inspect a downloaded installer instead of piping it when they
prefer an inspect-first flow.--llm, codetruss auth login, or codetruss sync unless the
developer explicitly requests that networked action. Never search for or
print provider keys.allow, remove deny, add --no-verify, or edit a receipt to
manufacture a green verdict. Fix the change or ask the developer to approve a
genuine policy change.codetruss run and codetruss review, treat exit 0 as PASS, exit 1
as REVIEW_REQUIRED, exit 2 as FAILED, and exit 3 as a usage or
environment failure. Exits 1 and 2 still produce receipts; other commands
may use nonzero exits differently, so read their output.==, and N+1
queries in loops. The rest of the rule pack (command injection, code
injection, path traversal, SSRF, open redirect, XSS, insecure
deserialization), every non-JavaScript language, and the hosted symbol graph
stay hosted-only. Read the receipt's own "What did not run" section instead
of asserting either way from memory.
Report a PASS as the deterministic passes finding nothing new, never as
evidence that the change is secure.REVIEW_REQUIRED at most. They never fail a
verdict on their own, so do not report one as a blocking failure.test cases passed, vs 8 / 19 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.