Guardian Verify Setup

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

- **Discord**: The response includes a `secret` field with the verification code. Show it in the current chat: "Your verification code is **[secret]**. I've also sent it to you as a Discord DM. Open t

- **Discord**: The resend response includes a fresh `secret` field. Show the new code in the current chat: "Your new verification code is **[secret]**. I've also sent it to you as a Discord DM. Open t

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/guardian-verify-setupThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Set up channel verification for phone, Telegram, Slack, Discord, or email channels via outbound verification flow

---
name: guardian-verify-setup
description: Set up channel verification for phone, Telegram, Slack, Discord, or email channels via outbound verification flow
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "🔐"
  vellum:
    category: "integrations"
    display-name: "Guardian Verify Setup"
    activation-hints:
      - "Any guardian verification intent -> load this skill exclusively"
      - '"help me verify my identity" = verification request'
    avoid-when:
      - "Don't load phone-calls for verification intents"
      - "If the user already specified a channel, do not re-ask"
---

You are helping your user set up channel verification for a messaging channel (phone, Telegram, Slack, Discord, or email). This links their identity for verified message delivery on the chosen channel. Use the `assistant channel-verification-sessions` CLI for all verification operations.

## When to Use

Load this skill when:

- The user says "verify me", "verify my identity", "set up verification", "verify my [phone/telegram/slack/discord/email]", or any equivalent identity-handshake intent.
- Another skill is wiring up a channel and needs to bind the guardian's identity to it (e.g., `slack-app-setup` invokes this skill at the end of Slack setup so the user can prove ownership of the configured workspace).

Do not load this skill for:

- Generic "set up X" intents where X is not a guardian channel (use the channel-specific setup skill instead).
- Phone-CALLS intent (use the phone-calls skill — those are outbound calls the assistant makes, not verification handshakes).

## Prerequisites

- Run shell commands for this skill with `bash`.
- Keep narration minimal: execute required calls first, then provide a concise status update. Do not narrate internal install/check/load chatter unless something fails.

## Step 1: Confirm Channel

Ask the user which channel they want to verify:

- **phone** -- verify a phone number for voice calls
- **telegram** -- verify a Telegram account
- **slack** -- verify a Slack account
- **discord** -- verify a Discord account
- **email** -- verify an email address

**Skip the prompt and proceed directly with the named channel when:**

- The user's intent already specifies a channel (e.g. "verify my phone number for voice calls", "verify me on Slack").
- This skill is loaded from another skill that has already established the channel (e.g., `slack-app-setup` finishes configuring Slack then loads this skill — `slack` is already the channel; do not re-prompt the user for which channel after they just spent the prior steps configuring one).

⚠️ CRITICAL — point of action: **Do not re-prompt for channel when it is already determined.** Re-prompting after a parent skill has just configured a channel makes the user feel like the assistant forgot the previous five minutes of setup.

## Step 2: Collect Destination

Based on the chosen channel, ask for the required destination:

- **Phone**: Ask for their phone number. Accept any common format (e.g. +15551234567, (555) 123-4567, 555-123-4567). The API normalizes it to E.164.
- **Email**: Ask for their email address. The bot will send a verification code to that address.
- **Telegram**: Ask for their Telegram chat ID (numeric) or @handle. Explain:
  - If they know their numeric chat ID, provide it directly. The bot will send the code to that chat.
  - If they only know their @handle, the flow uses a bootstrap deep-link that they must click first.
- **Slack**: Offer to look up the user's Slack member ID automatically to reduce friction:
  1. **Auto-lookup (preferred)**: Ask the user for their Slack display name or @handle, then look up their member ID using the Slack API.

     Set `USER_QUERY` to whatever the user gave you (display name, @handle, or full name — the search matches against all of them). For example, if the user says "find me, I'm @alice", set `USER_QUERY="alice"`. If they say "Alice Example", set `USER_QUERY="Alice Example"`. **Do not leave `USER_QUERY` as a literal `<...>` placeholder string.**

     ```bash
     USER_QUERY="alice"  # ← replace with the actual value the user provided
     USER_QUERY="${USER_QUERY#@}"  # strip leading @ — Slack .name fields have no @ prefix

     # Search for matching users (paginate through all workspace members).
     # The request door sends the bot token from inside the assistant; never
     # reveal it into a variable or a curl line, where it would land in the
     # transcript and the tool log. The door exits non-zero when the bot is
     # not configured, when the call is refused, and when Slack answers with
     # ok:false, so one branch covers every failure.
     CURSOR=""
     MATCHES="[]"
     while true; do
       RESPONSE=$(assistant channels request slack "/users.list?limit=200${CURSOR:+&cursor=$CURSOR}") || {
         echo "ERROR: the Slack lookup failed; fall back to manual entry"
         exit 1
       }
       PAGE_MATCHES=$(echo "$RESPONSE" | jq --arg q "$USER_QUERY" '[.members[] | select(.deleted == false) | select(.profile.display_name == $q or .name == $q or .profile.display_name_normalized == $q or .real_name == $q) | {id: .id, name: .name, display_name: .profile.display_name, real_name: .real_name}]')
       MATCHES=$(echo "$MATCHES $PAGE_MATCHES" | jq -s 'add')
       CURSOR=$(echo "$RESPONSE" | jq -r '.response_metadata.next_cursor // empty')
       [ -z "$CURSOR" ] && break
     done
     echo "$MATCHES" | jq '.[]'
     ```

     ⚠️ CRITICAL — point of action: **Substitute `USER_QUERY` with the actual user-provided value before running the bash block.** A literal `USER_QUERY="<query>"` or `USER_QUERY="<name>"` matches nothing and burns a `users.list` cycle.

     Result handling:
     - **Single match**: Present it for confirmation: "I found @username (U01ABCDEF) — is that you?" If confirmed, use the `id` value as the destination for Step 3.
     - **Multiple matches**: Present the list (up to 5) and ask the user to pick: "I found a few m

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-14
   ✕BLOCK D 69 / 100

   first audit · source 19bc86343b63

Questions about Guardian Verify Setup

• github.com/vellum-ai/vellum-assistant/tree/main/skills/guardian- — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology