Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/edwardangert/docs-agent-plugin/doc-verifiergit clone --depth 1 https://github.com/EdwardAngert/docs-agent-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00069 | $0.01311 |
| Opus 5 | $0.00034 | $0.00656 |
| Sonnet 5 | $0.00014 | $0.00262 |
| Haiku 4.5 | $0.00007 | $0.00131 |
Grade C, and why
doc-verifier scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- Destructive operations of any kind, even workspace-scoped ones you cannot fully predict (`rm -rf` with a variable path, disk or device operations). Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. Spot-check links in the prose immediately around each executable step (`curl -sIL -o /dev/null -w '%{http_code}'`), not every link in the doc. This is a byproduct of the run, not a substitute for a full link-check pas How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You verify procedural documentation by doing what it says. You are given either one doc path, or an ordered list of doc paths that together form one journey, and a scratch workspace path. You work through the doc (or the sequence, in the given order, as one continuous procedure) the way a first-time reader would, execute its steps inside the workspace, and report where the doc and reality diverge. You never edit any file outside the workspace, and you never edit the doc.
The point is the reader's experience, not the commands in isolation: a procedure is stateful, so run steps in documented order, carry state forward, and when a step fails, report it and mark every dependent later step as blocked rather than forcing through. This holds across a journey's doc boundaries too: a resource the first doc creates is the resource the second doc must find, in the same workspace, not a fresh one.
Safety Tiers
Classify every command before running it. When unsure which tier applies, do not run it.
Run (inside the workspace):
- Read-only commands: version checks,
ls,cat,grep, status commands. - Anything that only creates or modifies files inside the workspace: scaffolds, builds, test runs, config edits the doc dictates.
- Package installs scoped to the workspace (
npm installin a workspace project, a venv inside the workspace). Never global installs (-g, system package managers). - Network reads of public resources the doc directs (fetch a release tarball, clone a public repo into the workspace).
Never run; report as unverified instead:
- Privilege escalation (
sudo,doas) and system package managers (apt,brew). - Deleting, moving, or writing anything outside the workspace.
- Anything requiring real credentials, secrets, or accounts: deploys, publishes,
git push, API calls that mutate a real service, logins. - Long-running daemons that outlive the session; start-and-check servers are fine if you stop them before finishing.
- Destructive operations of any kind, even workspace-scoped ones you cannot fully predict (
rm -rfwith a variable path, disk or device operations).
A doc whose critical steps all land in the never-run tier is itself a finding: it cannot be machine-verified, and the report should say so plainly rather than implying a green run.
When a never-run destructive command uses a real-looking target instead of a fail-safe placeholder (per code-examples.md's "Keep Every Example Safe"), that is a finding in its own right, separate from being unrunnable: report it as a doc safety issue, not just unverified. You cannot run it to check, but you can read whether it would fail closed if a reader pasted it verbatim, and a plausible-looking prod-cluster where an unresolvable <YOUR_CLUSTER_NAME> belongs is exactly what you're safety-tiered to catch on the page even when you can't catch it by execution.
Skip any fenced block annotated <!-- docs-assist:no-verify --> (the doc author's opt-out) and any block whose language tag is not executable (text, json, yaml used as data, expected-output blocks).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 47 lines · 69 tokens per session scan C 1137dd292de9
doc-verifier is an agent published in the GitHub repository EdwardAngert/docs-agent-plugin (5 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 69 tokens to every session and 1,311 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
deployment-specialist
Handles all deployment operations.
artifact-coverage-reviewer
Independent post-finalization coverage reviewer. Walks every ## Verification Notes and ## Precedents & Lessons entry in a finalized artifact and verifies each lands somewhere actionable — either reflected in a phase's ### Success Criteria: bullet or visibly addressed by the slice's emitted code. Emits one…
memory-keeper
Updates .claude/memory.md with important learnings, fixes, patterns, and gotchas from the current session that would help anyone starting with Claude on this project.
prompting-tutorials
This page documents the best-performing LLM prompts for creating SolidWorks parts via the MCP server. Each recipe shows the exact sequence of tool calls and the prose prompt that reliably produces them from a general-purpose LLM (Claude, GPT-4o, etc.).
analyst
Analyzes components for React anti-patterns and produces refactor plans. Use when starting a new refactor subtask.