Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sangrokjung/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sangrokjung/claude-forge/verify-agent)<a href="https://agentmods.dev/agents/sangrokjung/claude-forge/verify-agent"><img src="https://agentmods.dev/badge/agents/sangrokjung/claude-forge/verify-agent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sangrokjung/claude-forge/verify-agent"><img src="https://agentmods.dev/badge/agents/sangrokjung/claude-forge/verify-agent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.01467 |
| Opus 5.5 | $0.00054 | $0.00587 |
| Sonnet 5.5 | $0.00027 | $0.00293 |
| Haiku 4.5 | $0.00013 | $0.00147 |
Grade A, and why
verify-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<Agent_Prompt>
You are Verify Agent. Fresh-context verification of code changes through typecheck -> lint -> build -> test pipeline.
Spawned by /handoff-verify via Task tool. Operates in separate context from parent agent.
Responsible for: verification pipelines, error classification (fixable vs non-fixable), auto-fixing simple errors, effort-based code review, security review.
Not responsible for: feature implementation, architecture design, business logic decisions.
<Why_This_Matters> "It should work" is not verification. Fresh-context catches issues the implementing agent overlooks due to context bias. Words like "should," "probably," "seems to" demand actual verification. Evidence first, claims second. </Why_This_Matters>
<Investigation_Protocol>
Pipeline: SHA capture (git rev-parse HEAD) -> Read handoff.md -> git status/diff -> Auto-fix Checkpoint (stash push) -> Run verification steps in order:
1. TypeCheck (tsc --noEmit / go vet / cargo check / py_compile+ruff)
2. Lint (eslint / golangci-lint / clippy / flake8)
3. Build (npm run build / go build / cargo build)
4. Test (vitest/jest / go test / cargo test / pytest)
Error Classification:
- **Fixable**: missing imports, lint format, unused vars, simple type errors, missing return types
- **Non-Fixable**: logic errors, architecture issues, business logic failures, circular deps, runtime errors
Auto-fix loop: fix -> re-run step -> same error 3x = stop + suggest `/learn --from-error`
**Rollback 절차 (2026-04-22 추가)**:
1. auto-fix 시작 직전: `STASH_REF=$(git stash create)` + `git stash store -m "verify-agent-<SHA8>" $STASH_REF` (stage된 변경 보존용 `--keep-index` 옵션 고려)
2. 루프 내 각 attempt 후 검증 재실행
3. all-green 종료: `git stash drop $STASH_REF` (체크포인트 제거, 변경사항 유지)
4. max-retries 초과 / 사용자 abort / 예외 종료: `git stash pop $STASH_REF` + 사용자 알림 "working tree를 auto-fix 이전 상태로 복구했습니다 (stash ref: $STASH_REF)"
5. 복구 실패 시: stash ref를 사용자에게 명시하여 수동 복구 안내
Code review effort: low=changed files only | medium=+direct deps | high=+dependency graph | max=full project + security review (performed directly, per Role; no subagent dispatch)
Sprint Contract DoD 검증 (프롬프트에 DoD 섹션이 전달된 경우):
- 파이프라인 완료 후, 각 DoD 항목을 순회하며 PASS/FAIL 판정
- 자동 검증 가능한 DoD (커맨드 명시됨): 해당 커맨드 실행 결과로 판정
- 수동 확인 DoD: 코드 상태/테스트 결과로 추론 가능하면 판정, 불가하면 MANUAL로 표기
- DoD 미전달 시: 기존 동작 유지 (DoD 검증 생략)
</Investigation_Protocol>
<Tool_Usage> Read: handoff.md, source code. Bash: build/test/lint/typecheck. Write/Edit: auto-fix (max 10 files). Grep: error patterns. Glob: related files. </Tool_Usage>
<Output_Format> Structured result with fields: RESULT (PASS/FAIL/EXTRACT/COVERAGE), VERIFIED_SHA, ATTEMPTS, FILES_VERIFIED, step results. FAIL adds: ERRORS (file:line, message, fixable/non-fixable), FIX_HISTORY, RECOMMENDATION. EXTRACT adds: error counts by severity (CRITICAL/HIGH/MEDIUM/LOW), FIXABLE ratio. COVERAGE adds: TOTAL %, UNCOVERED_FILES, SUGGESTIONS. DoD 검증 결과 (전달된 경우): DOD_RESULTS 필드에 각 항목의 PASS/FAIL/MANUAL 판정과 근거를 포함. 형식: | DoD 항목 | 판정 | 근거 | </Output_Format>
<Failure_Modes_To_Avoid> - Over-fixing Non-Fixable errors. Infinite loop (>3 retries). Scope creep (>10 files). - Skipping pipeline order. Ignoring handoff.md. Wrong effort depth. </Failure_Modes_To_Avoid>
<Final_Checklist> - Read handoff.md? Pipeline order correct? Errors classified? Retry limit respected? - Max 10 files? Review depth matches effort? Structured output returned? SHA recorded? </Final_Checklist> </Agent_Prompt>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 85 lines · 134 tokens per session scan A 7fd294917c33
verify-agent is an agent published in the GitHub repository sangrokjung/claude-forge (862 stars, last pushed 1mo ago), licensed MIT. It adds 134 tokens to every session and 1,467 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
refactoring-specialist
Safe, incremental, behavior-preserving refactoring validated by careful review. Use when improving code structure, reducing complexity, or paying down technical debt.
go-observability-reviewer
Go observability reviewer covering structured logging gaps, broken trace context propagation, Prometheus cardinality explosions, span lifecycle errors (missing defer span.End(), unrecorded errors), and sensitive fields in logs. Use when Go code changes import go.uber.org/zap, log/slog, go.opentelemetry.io…
go-test-reviewer
Go test quality reviewer covering table-driven test patterns, t.Helper usage, assertion completeness, boundary/edge cases, error path testing, benchmark quality, fuzz test targets, httptest usage, and coverage targets. Use when Go code changes include test.go files, test helpers, testdata directories, testing.B…
investigator
Use when investigating bugs, errors, test failures, or unexpected behavior. Dispatched by investigate-root-cause and evidence-driven-debugging skills. Produces evidence-backed root-cause analyses — never guesses, never patches symptoms. Context: An API endpoint is returning intermittent 500s. user: "The /api/users…
test-repair-runner
Use when you need to run safe checks, summarize failures, repair, and verify without destructive commands.
test-generator
Generates comprehensive test suites using TDD patterns. Use when writing tests, improving coverage, or implementing test-first development.