Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sangrokjung/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sangrokjung/claude-forge/handoff-verify)<a href="https://agentmods.dev/commands/sangrokjung/claude-forge/handoff-verify"><img src="https://agentmods.dev/badge/commands/sangrokjung/claude-forge/handoff-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/sangrokjung/claude-forge/handoff-verify"><img src="https://agentmods.dev/badge/commands/sangrokjung/claude-forge/handoff-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.02919 |
| Opus 5 | $0.00012 | $0.01460 |
| Sonnet 5 | $0.00005 | $0.00584 |
| Haiku 4.5 | $0.00002 | $0.00292 |
Grade C, and why
handoff-verify scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
dod = sh("grep -E '^- \\[ \\] DoD-' .claude/sprint-contract.md 2>/dev/null").strip() or "(없음)" Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
WF_PATH=$(ls ~/.claude/skills/handoff-verify/handoff-verify.workflow.js 2>/dev/null \ Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/handoff-verify — Workflow Parallel Fan-out (8 reviewers + adversarial verify)
트리거 주체 (§12, 2026-06-12): 본 스킬은 이미 Skill이다 — §12 "스킬화"는 완료 상태다. 미해결이었던 것은 트리거 주체다. 비단순 코드 변경 완료 후 에이전트가 자율 호출한다(사람이 매번
/handoff-verify를 입력하는 것은 폴백). 근거: verification.md "자율 검증 §11".
Workflow tool 기반 pre-merge 검증 게이트. v7의 "단일 메시지 8× Task() 수동 fan-out"을 Workflow tool parallel()로 전환 — 결정론적 동시 spawn(사일런트 spawn 실패 0) + schema 강제 구조화 회수 + CRITICAL/HIGH 적대적 재검증(false positive 제거).
| Reviewer | 영역 | gating |
|---|---|---|
| code-reviewer | 정적 보안+품질 | always |
| verify-agent | typecheck/lint/build/test 실행 (수정 금지) | always |
| security-reviewer | OWASP+STRIDE | always |
| database-reviewer | RLS/EXPLAIN/N+1 | always |
| a11y-reviewer | WCAG 2.1 AA | always |
| performance-reviewer | Core Web Vitals | always |
| codex-reviewer | GPT-5.5 크로스모델 | command -v codex |
| gemini-reviewer | Gemini 프론트엔드 | command -v gemini |
워크플로우 SSOT: ~/.claude/skills/handoff-verify/handoff-verify.workflow.js
reviewer 상세 체크리스트: ~/.claude/skills/handoff-verify/reviewer-prompts.md
v7 → v8 변경 (왜 Workflow인가)
| v7 (Task 수동 fan-out) | v8 (Workflow tool) |
|---|---|
단일 응답에서 8× Task() 발화 — 비결정적, 사일런트 spawn 실패 가능 |
parallel(8) 결정론 fan-out — 모든 reviewer 회수 보장 |
| §3 "발화 검증 가드"(C3)로 7/8 누락 재시도 | 구조적 불필요 — barrier가 8/8 보장 |
| perl placeholder 치환 → 메인이 추출 → Task() | args 객체 1회 주입 |
| 결과 Severity 분류·dedup LLM 추론 | schema 강제 + 스크립트 결정론 집계·dedup |
| dedup 없음 (D5) | file_line+severity 키 dedup (reviewer 목록 보존) |
| 없음 | CRITICAL/HIGH adversarial 재검증 — 오탐 제거 |
1단계: 환경 수집 + args 생성 (bash)
# 변경 없으면 abort
if [ -z "$(git status --short)" ]; then
echo "변경사항 없음. git status 빈 결과. /handoff-verify 종료."
exit 0
fi
# CLI 가용성 안내 (미설치 reviewer는 워크플로우가 자동 skip)
CODEX_OK=$(command -v codex >/dev/null 2>&1 && echo true || echo false)
GEMINI_OK=$(command -v gemini >/dev/null 2>&1 && echo true || echo false)
if [ "$CODEX_OK" = "false" ] || [ "$GEMINI_OK" = "false" ]; then
echo "⚠️ 크로스모델 가용성 — codex:$CODEX_OK gemini:$GEMINI_OK"
echo " 미설치 reviewer는 자동 skip + 푸터 명시. 설치: Read ~/.claude/skills/handoff-verify/cli-setup.md"
fi
# args JSON 생성 (python3로 안전 인코딩 — diff 8KB·따옴표·줄바꿈 이스케이프)
python3 - "$ARGUMENTS" << 'PYEOF'
import json, os, subprocess, sys
def sh(cmd):
try:
return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout
except Exception:
return ""
def has(cmd):
return subprocess.run(f"command -v {cmd}", shell=True,
capture_output=True).returncode == 0
def read(path, fallback="(없음)"):
try:
with open(path) as f:
return f.read().strip() or fallback
except Exception:
return fallback
intent = sys.argv[1] if len(sys.argv) > 1 and sys.argv[1].strip() else "(없음)"
dod = sh("grep -E '^- \\[ \\] DoD-' .claude/sprint-contract.md 2>/dev/null").strip() or "(없음)"
payload = {
"intent": intent,
"changed_files": sh("git diff --name-only HEAD").strip() or "(없음)",
"diff": sh("git diff HEAD")[:8000] or "(없음)",
"handoff": read(".claude/handoff.md"),
"dod": dod,
"has_codex": has("codex"),
"has_gemini": has("gemini"),
}
print(json.dumps(payload, ensure_ascii=False))
PYEOF
# 워크플로우 본체 경로 탐지 (.claude 우선 → dotclaude fallback. 멀티PC 견고 — 동기화 가정 제거)
WF_PATH=$(ls ~/.claude/skills/handoff-verify/handoff-verify.workflow.js 2>/dev/null \
|| ls ~/qjc-office/dotclaude/skills/handoff-verify/handoff-verify.workflow.js 2>/dev/null)
if [ -z "$WF_PATH" ] || [ ! -f "$WF_PATH" ]; then
echo "❌ handoff-verify.workflow.js 미발견 — 동기화 필요 (/dc pull 또는 /company-sync)"; exit 1
fi
echo "WF_PATH=$WF_PATH"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 209 lines · 24 tokens per session scan C 0e9dd528506f
handoff-verify is a command published in the GitHub repository sangrokjung/claude-forge (835 stars, last pushed 6d ago), licensed MIT. It adds 24 tokens to every session and 2,919 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (reads agent configuration directories, enumerates other installed skills, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
assemble-team
Assemble a pre-built agent team for parallel work - review, feature, debug, cross-platform, full-stack, or research.
review-code
Trigger a comprehensive code review on recent changes or specified files.
sonarqube
Analyze SonarCloud quality issues for a specific PR.
review-pr
Perform a comprehensive code review of a pull request.
pr
Analyze changes, detect scope issues, and create a well-structured PR.
refactor
Analyze code for SOLID violations and suggest targeted improvements.