Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 7xuanlu/wenlan --skill verifygit clone --depth 1 https://github.com/7xuanlu/wenlanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/7xuanlu/wenlan/verify)<a href="https://agentmods.dev/skills/7xuanlu/wenlan/verify"><img src="https://agentmods.dev/badge/skills/7xuanlu/wenlan/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/7xuanlu/wenlan/verify"><img src="https://agentmods.dev/badge/skills/7xuanlu/wenlan/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 27 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Agent Snooping · line 53 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00804 |
| Opus 5.5 | $0.00025 | $0.00322 |
| Sonnet 5.5 | $0.00013 | $0.00161 |
| Haiku 4.5 | $0.00006 | $0.00080 |
Grade A, and why
verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Daemon HTTP: curl the changed route on the isolated port; recipe in How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verifying wenlan — drive the real surfaces
Launch: use the run-wenlan skill — build, isolated boot, stop, the port
allocation (manual instance :17878, smoke-cli.sh :17881, smoke-mcp.sh
:17882 — they are not interchangeable), and the daemon lifecycle checklist all
live there. Never verify against the shared prod daemon on :7878.
Drive by surface — these scripts ARE the drive recipes (read them for the flow, run them for a full round-trip):
- Daemon HTTP: curl the changed route on the isolated port; recipe in
.claude/skills/prove/references/daemon.md. - CLI:
bash scripts/smoke-cli.sh(capture → memories → search, black-box). - MCP:
bash scripts/smoke-mcp.sh(stdio JSON-RPC initialize → capture → recall).
Gotchas (drive-time):
- Ingest is async (batcher + embedding): poll search up to ~60s before calling a miss a failure.
- Record evidence: prefix any check with
bash scripts/attest.sh. It appends one JSON line to.claude/attest.jsonl— the ledger the weekly sweep audits — and passes the command's exit status through unchanged. If it cannot write the ledger it exits non-zero even when the command passed: an unrecorded run reads to the sweep as "the smoke never ran", so it must never be reported as a pass. (~/.claude/bin/attest.shis a personal macOS helper; it is optional, and it does not exist on Windows or in a fresh checkout. Use the repo script.) WENLAN_NO_AUTOSTART=1on every command that talks to a daemon. Without it a connect failure starts the user's registered background service, and the check then passes against the wrong instance.
Windows (Git Bash)
Both smokes run here as-is; the platform differences are handled inside them via
scripts/lib/host-process.sh. What changes for hand-driven checks:
- No
lsof. Port checks go throughnetstat -ano(seerun-wenlan). A probe that could not run is not a free port — treat a failed probe as fatal, never as "nothing is listening". - No
TMPDIR. Always givemktemp -dan explicit template. - MSYS paths are not daemon paths. Convert with
cygpath -mat the daemon boundary only, into a second variable; the shell keeps the MSYS spelling for its own cleanup. $!is not the OS pid, and killing by pid alone can kill a recycled pid's new owner. Resolve the WINPID and compare the image path before killing.python3may not exist —pythonis the usual spelling.scripts/smoke-mcp.shresolves it; do the same in ad-hoc checks rather than assuming.bash scripts/attest.shworks here, so Windows/verifysatisfies its own evidence contract..claude/skills/prove/SKILL.mdnames the same repo wrapper.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +29 lines 9c60359c845b
- 1mo ago First seen · 28 lines · 63 tokens per session scan A 7a9161a9876d
verify is a skill published in the GitHub repository 7xuanlu/wenlan (79 stars, last pushed 14d ago), licensed Apache-2.0. It adds 63 tokens to every session and 804 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
run-wenlan-app
Build, launch, screenshot, and drive the wenlan-app Tauri desktop app in dev mode on macOS (WKWebView) or Windows (WebView2). Use when asked to run or start the app, verify a UI change in the real running app (not just tests), or take a screenshot of it.
verify
Drive/evidence recipe for verifying wenlan changes at their real surfaces (daemon HTTP, CLI, MCP stdio). The handle file the built-in verify protocol expects; launch primitives live in the run-wenlan skill, deeper machinery (mutation audit, behavior trace, weekly sweep) in the prove skill.
prove
Per-surface verification loops for wenlan — daemon, cli, mcp, plugin, suite strength (mutation), behavior trace, weekly sweep. Routes to scripts; every check records evidence via attest. Deeper than the built-in verify skill — use prove for mutation audits, behavior tracing, and the weekly sweep; built-in /verify…
wenlan-handoff
End a work session. Stores durable captures, writes a narrative session log, and automatically applies typed item-level deltas to the current Space Brief. Invoked as /wenlan-handoff.
curate
Power-user audit of Wenlan's pending surfaces: accept or dismiss pending revisions (conflicts/merges), or audit pending captures (not yet confirmed). Most users want /brief for revisions; that handles the daily flow. Use /wenlan curate only for explicit deep-walk audits after bulk imports, or to walk the full queue…
wenlan
A single command entry point for Wenlan, a tool that checks its setup and connection and turns stored memories into notes. It can also open or list notes and report its current status.