name	verify
description	Security scanning with UBS (Ultimate Bug Scanner). Use before commits, when scanning for bugs, when the user mentions "ubs", "bugs", "scan", "verify", or "security".

Verify — Security Scanning

Scans for 1000+ bug patterns across multiple languages. Direct execution.

Design rationale: This skill executes directly as a simple command sequence. UBS handles the analysis internally. No subagents needed.

When This Applies

Signal	Action
Before committing	`ubs --staged`
Scanning changes	`ubs --diff`
Scanning specific file	`ubs path/to/file`
User says "/verify"	Run security scan
Closing a bead	`ubs --staged` (mandatory)

Mandatory Gate

UBS is a mandatory gate before every commit. This is not optional.

Research shows ~40% of LLM-generated code contains security vulnerabilities. The ubs --staged command must pass before any commit.

Pre-Commit (Required)

Run before every commit:

ubs --staged                       # Scan staged changes
ubs --staged --fail-on-warning     # Strict mode (exit 1 on any issue)

Fix all issues before committing. Rerun until clean.

Scanning Options

# Scan current directory
ubs .

# Scan specific file
ubs path/to/file.ts

# Scan working tree changes vs HEAD
ubs --diff

# Verbose with code examples
ubs -v .

Profiles

# Strict (fail on warnings) - for production code
ubs --profile=strict .

# Loose (skip nits) - for prototyping
ubs --profile=loose .

Language Filters

# Single language
ubs --only=python .

# Multiple languages
ubs --only=typescript,javascript .

Supported languages:

javascript, typescript
python
c, c++
rust, go
java, ruby

Output Formats

ubs . --format=json                # JSON
ubs . --format=jsonl               # Line-delimited JSON
ubs . --format=sarif               # GitHub Code Scanning

CI Integration

ubs --ci                           # CI mode
ubs --comparison baseline.json .   # Regression detection

Suppressing False Positives

Add to the line:

// ubs:ignore
const result = eval(userInput); // ubs:ignore

Use sparingly. Over-suppression defeats the purpose.

Health Check

ubs doctor
ubs doctor --fix

Workflow Integration

The standard pre-commit workflow (via /advance):

# 1. Run tests
pytest  # or npm test, etc.

# 2. Scan staged changes (MANDATORY)
ubs --staged

# 3. Fix any issues found
# 4. Re-run until clean (counts toward 3-iteration cap)
ubs --staged

# 5. Commit
git add -A && git commit

Issue Handling

Issue Level	Action
Critical	Fix immediately, blocks commit
High	Fix before commit
Medium	Fix or document justification
Low	Fix if easy, otherwise note

Fixing UBS issues counts toward your 3-iteration cap. If you've hit 3 iterations and still have issues, stop and escalate.

Quick Reference

ubs --staged               # Pre-commit scan (required)
ubs --staged --fail-on-warning   # Strict pre-commit
ubs --diff                 # Working tree changes
ubs path/to/file           # Specific file
ubs --profile=strict .     # Production mode
ubs doctor --fix           # Health check

Anti-Patterns

Don't	Why	Do Instead
Skip `ubs --staged`	Bugs slip into commits	Always run before commit
Ignore warnings	May be real issues	Review each warning
Over-suppress with `// ubs:ignore`	Defeats the purpose	Use sparingly
Run unlimited fix iterations	Security degrades	Max 3 iterations

verify

Install Skill

SKILL.md