Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/nel-neru/LibrAIumnpx agentmods add commands/nel-neru/libraium/verifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/nel-neru/libraium/verify)<a href="https://agentmods.dev/commands/nel-neru/libraium/verify"><img src="https://agentmods.dev/badge/commands/nel-neru/libraium/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/nel-neru/libraium/verify"><img src="https://agentmods.dev/badge/commands/nel-neru/libraium/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00815 |
| Opus 5.5 | $0.00008 | $0.00326 |
| Sonnet 5.5 | $0.00004 | $0.00163 |
| Haiku 4.5 | $0.00002 | $0.00081 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 33 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Run LibrAIum's complete verification pipeline and iterate until it passes.
How to run
export PATH="/opt/homebrew/bin:$PATH" # cargo lives here (Homebrew Rust)
bash scripts/verify-all.sh
Run it from the repo root. If a stage fails: read the failure output, find the root cause in the source, fix it, and re-run the whole script. Repeat until all stages pass. Do not stop at the first green re-run of a single stage — the script must complete end-to-end.
The six stages
- validate-data —
node scripts/validate-data.mjs --data-dir data. Lints every file underdata/entries/**/*.mdplusdata/master/categories.yaml: frontmatter parses, required fields present (github_url,full_name,category), enums valid (status: active|stale|archived,source: manual|mcp|x-collection),categorymatches an id in the category master, and the filename matchesslugify(full_name). - cargo test —
cd src-tauri && cargo test. All core Rust logic (frontmatter, store, search, github, gitops, settings). Note: Tauri'sgenerate_context!embedsdist/; verify-all.sh handles this automatically by running the frontend build before cargo test whendist/is missing (stages 2 and 3 swap on a fresh clone). A rawcargo testoutside the script still needsnpm run buildfirst. - vite build + frontend unit tests —
npm run build && npm test. Frontend production build (catches Svelte 5 compile errors and broken imports), thennode --test tests/*.test.mjs— currently the markdown-renderer hardening tests: entry bodies are untrusted, so raw HTML must be escaped and unsafe link schemes stripped. - mcp tests —
cd mcp-server && npm test. Unit tests forlib/store.jsandlib/suggest.js, then the stdio smoke test exercising all four tools (search_repos,get_repo_details,suggest_for_new_project,add_repo) end to end. - conformance —
node scripts/conformance.mjs. Feeds shared fixtures AND a function corpus (slugify/normalizeGithubUrl) through BOTH data-format implementations — Rust (src-tauri/src/frontmatter.rs,store.rs) and Node (mcp-server/lib/store.js) — and diffs the results. A failure here means the two implementations drifted apart. - app binary build —
cd src-tauri && cargo build --bin libraium. The only stage that builds the REAL application binary; catches startup/bundle wiring regressions that tests alone miss (a broken barecargo runonce passed stages 1–5).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 33 lines · 20 tokens per session scan A 0a90f967dfea
verify is a command published in the GitHub repository nel-neru/LibrAIum (0 stars, last pushed 28d ago), licensed MIT. It adds 20 tokens to every session and 815 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
cli-test
Comprehensive test of the blz CLI tool.
ui-aqa-flow-test-report-analysis
Phase 7 Test Report Analysis of ui-aqa-flow.
api-aqa-flow-execution-and-report-analysis
Phase 6 Execution & Report Analysis of api-aqa-flow (USER INTERACTION REQUIRED).
iai-directive
Record, list, or remove a standing order the user typed themselves.
amazing-e2e-check
Run explicitly requested E2E, browser, device, or installed-deployment scenarios in an independent verification workflow.
tree-ring-certify
Generate Tree Ring harness or recall-quality evidence without confusing it with the full framework release suite.