Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0fuk/OpenACCP --skill verify-3waygit clone --depth 1 https://github.com/0fuk/OpenACCPWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0fuk/openaccp/verify-3way)<a href="https://agentmods.dev/skills/0fuk/openaccp/verify-3way"><img src="https://agentmods.dev/badge/skills/0fuk/openaccp/verify-3way/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0fuk/openaccp/verify-3way"><img src="https://agentmods.dev/badge/skills/0fuk/openaccp/verify-3way.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00155 | $0.03866 |
| Opus 5.5 | $0.00062 | $0.01546 |
| Sonnet 5.5 | $0.00031 | $0.00773 |
| Haiku 4.5 | $0.00015 | $0.00387 |
Grade A, and why
verify-3way scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/verify-3way — 发版三路验证与修复定谳(含根场景按原始症状重放盲测)
存在理由:全量自动测试全绿的版本,根场景盲测仍抓出十余张红卡、走查抓出 P0——单独任何一路都会漏,交叉规则双向立功(盲测归因错被源码证伪;盲测判「全废」被走查翻案)。项目范式件与环境护栏读项目根 PROJECT-PROFILE.md。
1 · 三路定义
| 路 | 执行体 | 管什么 | 管不了什么 |
|---|---|---|---|
| 全量回归 | 后台代理跑真实全量入口(禁 glob 子集充全量) | 旧功能被改坏 | 没写过测试的地方:权限维度/多角色剧本/数据加载层/副本不一致 |
| 根场景复现盲测 | 不带任何背景的代理,只给原始症状,禁读修复件/源码 | 新修的东西真人手里能不能用 | 覆盖窄;归因常错(禁其下结论) |
| 规范走查 | 可读规范/交回件的代理,逐判据验收 | 修复是否兑现规范承诺;边界值 | 测试数据造不出的形态灰掉 |
| 判定权在主编排,三路执行体不写 PASS/FAIL 总判。 |
2 · 盲测卡组制(红绿灰逐字执行)
一条问题一张卡,卡数=源件子条目数。卡式六栏:卡号+源条目 / 根场景前置(数据形态,库里没有经业务入口造,禁直改库表)/ 角色与入口 / 操作步骤(人类节奏,报错先截图再重试一次)/ 原始症状原文 / 红绿灰判据。
- 红=原症状或同一类异常再现(症状截图+结果态读数)。
- 绿=业务动作走通且三件齐:前置形态读数/完成态截图/结果态读数。「没报错」不算绿;不符形态跑一遍=灰。
- 灰=不可达,记原因+止步截图,禁充绿。
- 卡的绿判据必须引设计出处;章程里的数字必回原件亲核(实案:把生产行金额抄进 staging 卡、把「按设计排除的行」当必须可见,两处都错在章程)。
- 章程干跑(20261003 回写):开工前派便宜代理逐卡只读核前置(账号能力集 / 授权步骤 / 数据形态),每卡期望写出处;干跑不过的卡先改章程再发(实案:漏授「审批发起」首轮 5 红、两张期望有误,事后调查 + 补测)。
- 盲测记录的时刻 date 实取;截图 mtime 与请求时戳为真值锚。验法按规矩(用户 2026-10-12 裁定):验的是「用户看到什么、能不能点到」(按钮显隐、文案、列表排序分页、表单提交、页面切换状态)必须真点界面并附截图;验的是「后端判不判、算得对不对、扣没扣」(发起资格、签几道、金额、库存、权限收回)走接口并附抓到的前端真实请求原文(先从浏览器抓一次再重放,禁手写参数);两头都验的拆两张卡;每车至少三条端到端真点:一条动钱、一条动权限、一条跨店。模板
C:/VyqoAI/Yirun/coordination_dawn/C1-模板-盲测章程.md。
3 · 交叉判读协议(主编排亲执)
- 单路收货门:数字回 测试脚本原文亲对(≥2 处);截图非零字节且抽开≥2 张比对;卡组抽 4 张回源件;绿卡抽 3 张结果态回库查数。执行体降级(如 sonnet)时「关键宣称回数据库核对」为标准加码。不过门=打回。
- 交叉矩阵:行=全部发现;列=各路见/未见/未覆盖+基线归属+验证等级(端到端实证/代码+真库级/结构性不可达)+定谳。
- 孤证禁采信:单路独见须亲手复现;复现不出=存疑项,不静默丢。
- 双路矛盾优先:自动化绿但真人挂=亲手复现终裁,禁数票。
- 全绿反证抽验:两路都报好消息反而加抽。
- 红卡处置:每张=候选阻发车项,亲手定性(真缺陷/环境/测试数据/范围外预期红/章程判据错)后分流;未覆盖项如实进下一站清单。
- 测试结果可否沿用的判定:两个 tag 之间的 diff 与某路测试面零交集才许继承,判读件贴
diff --stat为证;能实测不记推算值。
4 · 修复证据纪律(每笔四步)
- SSOT-first:先读规则权威规范;两副本打架由 权威规范 定谳;权威规范 与裁决冲突=候裁不修。
- 验证方式与真实运行一致(同角色同操作同上下文):真实角色+真实动词+真实上下文(实案:探 INSERT 宣布闭合,运行时失败的是 UPDATE)。
- 先在数据库事务里试跑再回滚:BEGIN→改→以运行时身份做真实动作→断言→ROLLBACK,再落正式迁移。
- 落车后定点+读数:改动面既有测试全跑+补≥1 回归用例;数字来自 跑测试的脚本/库读数原文。 同一规则同一规则的多份抄写(契约/前端/后端/终局器/守卫)改值域前先数副本;动了被封印/被清单登记的源→连带重封/同步。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 82 lines · 155 tokens per session scan A bb840c7dcfa0
verify-3way is a skill published in the GitHub repository 0fuk/OpenACCP (2 stars, last pushed 2d ago), licensed MIT. It adds 155 tokens to every session and 3,866 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
interactive-live-testing
Drive Playwright against a running application step-by-step, screenshot, analyze, decide, act. Applies to any web frontend regardless of stack.
wshobson-agents
A large collection of engineering agents, plugins, and skills organized by stages of software development. It covers architecture, testing, debugging, security, and delivery collaboration.
test-conversion-reviewer
Reviewer for converting unit tests to browser tests for Project Bedrock. Invoke this when the user needs to review their work while removing complex Browser dependencies from tests.
nexent-daily-test
A procedure for running Nexent daily, full-layer tests on a self-hosted Ubuntu machine. Nexent is tested across separate layers such as unit, service, AI runtime, and browser journeys, with results and evidence kept locally.
moai-ref-testing-pyramid
Test pyramid strategy, coverage targets, test patterns, and quality metrics reference. Agent-extending skill that amplifies manager-develop test-creation and quality-validation work with production-grade testing patterns. NOT for: production code implementation, architecture design, DevOps, security audits.
test-automation
Execute Vitest and Playwright test suites with result collection and failure analysis.