Proof-of-done checks the last change before an agent stops
Wageesha Tripathi's claude-code-skills repository combines 31 Claude Code skills with two plugins. proof-of-done checks that verification follows the last code edit.
Wageesha Tripathi's claude-code-skills repository is a free, MIT-licensed collection of 31 Claude Code skills and two plugins.
One of them, proof-of-done, requires a successful verification after the last code edit before Claude Code can end its turn. It records edits and verification commands. The plugin blocks completion when an edit has no later check, the latest check failed or was interrupted, or a test summary reports that zero tests ran. Its README also describes checks for skipped or focused tests, weakened or deleted tests, hidden errors, and lowered coverage thresholds. If verification is impossible, the agent has to give a reason.
The companion issue-to-pr plugin takes a GitHub issue, Jira ticket, or written request through a tested change and opens a draft pull request. The repository also has skills for code review, testing, debugging, and design work. See the project website or browse the full collection on GitHub.
Continue reading
All posts
BREAKING: One gzipped POST crashes Express via body-parser CVE-2026-111181. Upgrade to 1.20.9 or 2.4.0
How to fix CVE-2026-111181: upgrade body-parser to 1.20.9 or 2.4.0. Trailing bytes after a compressed request body crash the Node process before routing runs.
BREAKING: Railway breach exposed customer environment variables. Rotate every secret you stored in Railway
How to fix the Railway environment variable breach: rotate every secret stored in Railway variables, move funds out of any wallet key kept there, and check provider logs for use of the old keys. Railway says an intruder reached encrypted env vars and decrypted some; stolen wallet keys were drained before the notice.
BREAKING: Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.