Borrowing it
Nothing to install: this file belongs to advenimus/conduit-desktop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/advenimus/conduit-desktop/main/.claude/skills/verify-ownership/SKILL.mdgit clone --depth 1 https://github.com/advenimus/conduit-desktopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/advenimus/conduit-desktop/verify-ownership)<a href="https://agentmods.dev/skills/advenimus/conduit-desktop/verify-ownership"><img src="https://agentmods.dev/badge/skills/advenimus/conduit-desktop/verify-ownership/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/advenimus/conduit-desktop/verify-ownership"><img src="https://agentmods.dev/badge/skills/advenimus/conduit-desktop/verify-ownership.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.01559 |
| Opus 5.5 | $0.00060 | $0.00624 |
| Sonnet 5.5 | $0.00030 | $0.00312 |
| Haiku 4.5 | $0.00015 | $0.00156 |
Grade A, and why
verify-ownership scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/verify-ownership: vault ownership and plan limits suite
Runs npm run verify:ownership (node scripts/verify/run.mjs ownership). Real Electron devices of
two accounts share one "cloud" folder, sign in as generated test users on a local Appwrite, and are
driven like a user. The spec under test is docs/PLAN_ENFORCEMENT.md (sections 1, 3, 4 and 7.3);
the harness reference is scripts/verify/README.md. Every suite at once is the verify skill; the
device-lease basics (take-over, plan changes, owner claims) are the verify-sync skill.
Needs
The plan enforcement rules in the deployed api function (appwrite/src/api/rpc/sessions.ts for
ownership, grace, device cap and minimum version; appwrite/src/api/storage.ts for the backup gate).
The harness redeploys appwrite/ from the checkout under test whenever it changed, so run it from the
checkout you want to test. Everything else is as in verify-sync (Docker and the local Appwrite stack
from npm run appwrite:setup).
What it proves
Each scenario uses its own devices (o1a, o1b, ...) and its own <cloud>/o<n>/Vault.conduit.
Clocks move by backdating personal_vault_owners, personal_vault_guest_grace and lease rows (ctx.shiftBack).
| Scenario | In plain words |
|---|---|
owner-and-grace |
The account that creates a vault owns it (personal_vault_owners, owner tag in the file). Another account opens it at once with "This vault belongs to another Conduit account. You can use it until ..." and its four buttons; the owner sees "Another Conduit account is using this vault until ...". |
grace-ends |
With the grace clocks moved back 15 days the guest's open vault locks ("... your 14 days of access ended.") with no [Use here instead]; unlocking again shows "This vault belongs to another account"; [Make my own copy] saves next to the original ("Your copy is ready."), the copy opens and is owned by the guest, and the owner still opens the original. |
release-hand-over |
The owner (moved past the 7-day cooldown) releases in Settings > Sync ("Vault released."); the owner row is empty with released_by set and the file carries {"a": null}; the next account to open it owns it; the ex-owner may use it during grace and afterwards sees "You released this vault and another account now owns it." |
release-survives-reacquire |
After a release on one of two devices of the owner, the other device's lease is expired by hand; its background re-acquire (p_claim false) leaves the vault unowned. |
signed-out-tag |
A signed-out device of another account gets "Sign in to open this vault"; the owner device, signed out, still opens (its cached owner check). |
offline-owner |
With the backend cut, the owner opens its vault; another account's device gets "Connect to the internet so Conduit can check who owns this vault". |
device-cap |
With five other devices holding leases, unlocking shows "Too many devices" naming the least recently used one; [Use here instead] opens and displaces it with device_cap. |
update-required |
With min_app_version.desktop at 99.0.0 the open vault locks ("Update Conduit to keep using this vault.") and unlocking shows "Update required" with the version. The setting is put back to 0.0.0 at the end of the scenario and at cleanup. |
cloud-backup-free |
A Free account's direct upload to the vaults bucket is refused by the server; after a downgrade [Back Up Now] leaves "Cloud backup needs Pro or Team. Your earlier backups are still here." with [Upgrade]. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +10 lines · +14 tokens per session db0dbac9f5a2
- 28d ago First seen · 74 lines · 137 tokens per session scan A 53b90d74a521
verify-ownership is a skill published in the GitHub repository advenimus/conduit-desktop (19 stars, last pushed yesterday), licensed Apache-2.0. It adds 151 tokens to every session and 1,559 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other skills, from other repositories
winui-ui-testing
Write and run automated UI tests for Windows desktop apps (WinUI 3, WPF, WinForms, Win32) with the winapp ui harness: one batch script, assertions, input, file pickers, dialogs, screenshots, locally or in Windows Sandbox. Use when asked for UI tests or to verify a feature end to end.
Appium Mobile Testing
Mobile application testing skill using Appium for iOS and Android, covering device capabilities, selectors, gestures, and cross-platform testing strategies.
browser-qa
Use when validating or debugging a workflow in the embedded browser and you need a reproducible, evidence-first loop.
performance-engineer
Becomes a senior performance engineer who identifies bottlenecks, designs optimization strategies, and conducts load testing using systematic profiling and benchmarking methodology. Use when the user needs performance analysis, load testing, bottleneck identification, latency optimization, or capacity planning. Do NOT…
Desktop Application Testing
Testing desktop applications built with Electron, Tauri, or native frameworks including window management, IPC, tray icons, and auto-update testing.
playwright
Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via playwright-cli or the bundled wrapper script.