The Userflow Verification Skill checks an existing Userflow.js installation and tells you whether it is correct. Your AI coding agent reads your codebase, reports what it finds with a severity for each issue, and changes nothing until you approve a specific fix.
It catches the problems that don't throw an error: identification running on public pages (which inflates your Monthly Active User count), a token that belongs to a different environment, or a second initialization added by mistake.
Before you start
You'll need:
An existing Userflow.js installation. If you haven't installed it yet, use Install with AI instead
An AI coding agent with access to your project files — Claude Code, Cursor, GitHub Copilot, Codex, Windsurf, and others all work
No Userflow MCP server required
The setup routes are the same for every skill in the library. If you haven't added a Userflow skill to your agent before, see Add the skill to your agent, then come back here.
Step 1: Add the verification skill
Claude Code
/plugin marketplace add userflow/ai-skills-library
/plugin install userflow@ai-skills-libraryThen run /userflow:verify-with-ai, or simply ask Claude to check your Userflow installation and it will invoke the skill on its own.
skills.sh (Cursor, Codex, and other agents)
npx skills add userflow/ai-skills-library@verify-with-aiDirect link (no installation)
Paste this into your agent's chat:
Verify Userflow.js in this project.
Use the Userflow verification skill:
Read https://raw.githubusercontent.com/userflow/ai-skills-library/refs/heads/main/skills/verify-with-ai/SKILL.md and verify my Userflow.js installation.Download
Step 2: Run the skill
Open your coding agent with access to your project and ask it to verify your Userflow installation.
The skill finds every place your code touches Userflow — initialization, identification, sign-out, and any advanced functions — then evaluates each against the checklist below and produces a report. It does not edit anything at this stage.
What the skill checks
Initialization. Exactly one
init()runs per page load, before any other Userflow call, and only in client-side code.Token and environment. The token is real, not a placeholder, and belongs to the environment that build targets rather than being shared across environments or hardcoded in source.
Identification.
identify()runs only after sign-in or sign-up and never on public pages;identify()andidentifyAnonymous()are never both reachable on the same page load; user values are real rather than placeholders.Sign-out.
reset()is wired so the next user on a shared device doesn't inherit the previous identity.Advanced functions. If your install already uses
group(),track(), or identity verification, they're checked for correct usage — including that no Secret Key appears in frontend code.Delivery. Your Content Security Policy allows Userflow.js, and script-tag installs use the official snippet.
The checks that protect your MAU count are treated as the most serious. Anything that lets an unauthenticated visitor be identified is reported as Critical, whether or not your content is otherwise working.
Step 3: Read the report
Every finding cites the file and line it came from, explains the impact, and proposes a fix. Findings are ordered by severity:
Severity | What it means |
|---|---|
Critical | Costs money, corrupts data, or breaks security — for example identifying signed-out visitors, or a token from the wrong environment |
High | The install malfunctions for real users — a duplicate |
Medium | Works today but will break later — a hardcoded token, or a malformed date attribute |
Low | Advisory only, safe to leave as-is |
Some checks can't be answered by reading code. Those are listed separately as runtime checks for you to run in a browser — most importantly, loading a public page while signed out and confirming userflow.isIdentified() returns false.
Step 4: Apply the fixes you approve
The skill asks before it changes anything, one fix at a time. You can accept all of them, some of them, or none — and it re-runs the relevant checks afterwards to confirm each fix landed.
If your installation is tangled enough that patching would be riskier than starting over — several conflicting initializations, or npm and script-tag installs both present — the skill will say so and recommend a clean reinstall with Install with AI instead.
Troubleshooting
The report says a check "needs a runtime check"
That's expected. Some behaviour can only be confirmed in a running browser, and the skill won't claim to have verified something it couldn't see. Follow the steps it lists and report the results back to it.
It found nothing, but content still isn't showing
A correct installation with non-matching flow targeting conditions is not an installation problem. Check your flow's own audience and page conditions in Userflow.
It recommends a reinstall
Take that seriously. It means the defects overlap enough that fixing them individually risks leaving the install in a half-changed state.
Still stuck
Browse the Userflow documentation, ask your coding agent to explain a specific finding, or contact Userflow support.
FAQ
Will it change my code?
Not without asking. The skill reads and reports first, then applies only the fixes you approve, one at a time.
Do I need to have used Install with AI first?
No. It verifies any Userflow.js installation, however it was originally added — by hand, by a developer, or by the install skill.
What if Userflow isn't installed at all?
The skill will tell you and point you to Install with AI. It won't start installing on its own.
Will it suggest new attributes or features?
No. It reports only what correctness requires. Recommendations for attributes and flow targeting are coming in a separate Suggest skill.
Can I see what the skill actually does?
Yes. Read the full verify-with-ai skill on GitHub.
Review any changes before merging. The skill asks before editing, but the fixes it applies are real code changes. Human oversight is recommended.