Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andresharpe/dotbot --skill verifygit clone --depth 1 https://github.com/andresharpe/dotbotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andresharpe/dotbot/verify)<a href="https://agentmods.dev/skills/andresharpe/dotbot/verify"><img src="https://agentmods.dev/badge/skills/andresharpe/dotbot/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andresharpe/dotbot/verify"><img src="https://agentmods.dev/badge/skills/andresharpe/dotbot/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00436 |
| Opus 5.5 | $0.00008 | $0.00174 |
| Sonnet 5.5 | $0.00004 | $0.00087 |
| Haiku 4.5 | $0.00002 | $0.00044 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Run Verification Gates
Run all verification hooks in .bot/hooks/verify/ and present a clear pass/fail report.
Steps
1. Privacy Scan
Run the privacy/secrets scanner:
pwsh .bot/hooks/verify/00-privacy-scan.ps1
If the user said /verify staged or mentioned "staged only", add the -StagedOnly flag:
pwsh .bot/hooks/verify/00-privacy-scan.ps1 -StagedOnly
2. Git Clean Check
Check for uncommitted changes outside .bot/:
pwsh .bot/hooks/verify/01-git-clean.ps1
3. Git Pushed Check
Check for unpushed commits:
pwsh .bot/hooks/verify/02-git-pushed.ps1
Presentation Format
Present results as a verification report:
## Verification Report
| Gate | Result |
|----------------|--------|
| Privacy scan | PASS/FAIL |
| Git clean | PASS/FAIL |
| Git pushed | PASS/FAIL |
Overall: ALL PASSED / N FAILED
### Failures (if any)
#### <Gate name>
- Issue: <description>
- Remediation: <what to do>
Rules
- Read-only: Never fix issues automatically — only report them with remediation guidance
- Always run all gates: Do not stop on first failure; run every gate and report all results
- Report honestly: Show exact output from each hook; do not summarize away important details
- Exit code awareness: Each hook outputs JSON to stdout with
issuesanddetailskeys — parse these for structured reporting - Remediation guidance: For each failure, provide a concrete command or action the user can take to resolve it
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 64 lines · 20 tokens per session scan A 4cc49b01af43
verify is a skill published in the GitHub repository andresharpe/dotbot (52 stars, last pushed 1mo ago), licensed MIT. It adds 20 tokens to every session and 436 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
memorix-git-memory
Use when the task depends on commit history, what changed, when a fix shipped, or linking engineering evidence to reasoning memory.
conventional-commits
Use when uncommitted changes need to be split into atomic, conventional commits ordered for review. Triggers on "commit this", "make commits", "clean up commits", "commit the changes". In Hedgehog, each Loop step is already meant to be its own commit — this skill matters most when a Correction Protocol fast-forward…
hedgehog-contributing
Use when the user wants to contribute a fix or roadmap item back to the Hedgehog project itself (skyf0xx/hedgehog) rather than their own project. Triggers on "let's fix that in Hedgehog", "I want to contribute", "let's pick up a roadmap item", or when tweaker offers this at the end of a build and the user says yes.…
pr-writing
Use whenever writing a PR title/description, a commit message body, a code review comment, or an issue — in Hedgehog's own repo or any consuming project. Triggers on "open a PR", "write the PR description", "comment on this PR", "file an issue". Covers writing style (terse, info-dense, Simplified Technical English)…
hedgehog-orchestrating
Use at the start of any session on a project with a build graph (.hedgehog/hedgehog.db), and again at every claim/dispatch/verify cycle within it. Owns consuming the build graph — claiming task packets, delegating each to the layer's agent, running hedgehog verify to gate the commit, recording debt and decisions, the…
recall
Answer "why" and "when" questions about a project's decisions — the intent behind a past choice, when it was made, what was tried before and rejected. Use when asked why something was decided, what the rationale was, or before reversing or redoing earlier work. For why the code mechanically behaves a certain way use…