Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/danielvm-git/bigpowers/verify-workgit clone --depth 1 https://github.com/danielvm-git/bigpowersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/danielvm-git/bigpowers/verify-work)<a href="https://agentmods.dev/rules/danielvm-git/bigpowers/verify-work"><img src="https://agentmods.dev/badge/rules/danielvm-git/bigpowers/verify-work.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.02405 |
| Opus 5 | $0.00022 | $0.01203 |
| Sonnet 5 | $0.00009 | $0.00481 |
| Haiku 4.5 | $0.00004 | $0.00241 |
Grade B, and why
verify-work scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf .next/cache node_modules/.cache 2>/dev/null || true Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
sleep 3 && curl -sf http://localhost:<port>/health || echo "BOOT FAIL" How it starts
The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify Work
HARD GATE — No story is "done" until manual UAT for the active story is confirmed with evidence.
HARD GATE — Do NOT run on
mainormaster. Use the feature branch fromkickoff-branch.
Review answers "is the code good?"; Verify answers "does the built thing do what was promised?"
Modes
- Default: full UAT plus gaps loop
- --smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
- --cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.
Risk-Scaled Depth
verify-work reads the risk: field from the story template (defaults to P1 if absent) to scale verification rigor:
- P0: Full verify-work multi-phase +
security-review(step 5) + NFR evidence gate (step 5b). - P1: Standard verify-work (build, test, lint, step-by-step manual).
- P2: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
- P3: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.
Process
Timing:
bash scripts/bp-timing.sh start verify-workat invocation;bash scripts/bp-timing.sh end verify-workbefore handoff.
- Branch check — must not be
main/master.
0a. Preflight / CI green (HARD GATE — e51s03) — Run Preflight from CLAUDE.md or BP_PREFLIGHT (bp-read-agents.sh). If PR open: gh pr checks (CI green). Failure blocks all phases → quick-fix or fix-bug.
- Read active story tasks from
specs/epics/<capsule>/eNNsYY-tasks.yamland story spec fromspecs/epics/<capsule>/eNNsYY-<slug>.md(countable-story-format, Gherkin in §17). Note therisk:level (P0–P3). 1a. Pre-UAT verify validation — for each task'sverify:command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
Report:# For a failing grep -q 'PATTERN' FILE, check what is actually in FILE grep 'PATTERN' FILE || grep -n '' FILE | head -20 # show nearest lines"Pattern 'X' not found. Nearest match: 'Y' at line N"and ask"Update verify command? [Y/n]". Fix before proceeding — a mismatched verify command produces false failures during UAT. - Cold-start smoke (if app; skip if P3): stop server, clear caches, boot from scratch.
- AGENTS.md preflight — if 0a skipped BP_PREFLIGHT, run
bash scripts/bp-read-agents.shand use detected command. - Mechanical gates: build → typecheck → lint → tests (from
CLAUDE.mdor AGENTS.md). Skip tests if P2/P3.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 191 lines · 43 tokens per session scan B 9bf63b692932
verify-work is a cursor rule published in the GitHub repository danielvm-git/bigpowers (163 stars, last pushed 2d ago), licensed MIT. It adds 43 tokens to every session and 2,405 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
app-router-patterns
Next.js 14+ App Router patterns — Server Components, Client Components, Route Handlers, Server Actions, and metadata API.
00-project-rules
ContextOS core project rules and role orchestration.
context-os
ContextOS rules for context-os.
database
Database architecture, schema design, Prisma, Drizzle ORM, indexing strategies, migrations, and N+1 query resolution.
vue
Rules for Vue (2 and 3) single-file components.