Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/andrewcigan/vibe-dev-plugin/verifynpx skills add andrewcigan/vibe-dev-plugin --skill verifygit clone --depth 1 https://github.com/andrewcigan/vibe-dev-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.01723 |
| Opus 5 | $0.00026 | $0.00861 |
| Sonnet 5 | $0.00011 | $0.00345 |
| Haiku 4.5 | $0.00005 | $0.00172 |
Grade A, and why
verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
layer_4/5; api → curl + статус; cli → команда + exit; job → лог реального прогона; How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/verify
Four-layer verification (4-уровневая проверка) активной фичи.
Layer 0: Enforcement жив? (v6.2 F2)
P="$(cat .harness/profile 2>/dev/null)"; HB=.harness/hooks-heartbeat
case "$P" in pending-*) echo "❌ профиль $P не подтверждён живым хуком"; esac
[ -f "$HB" ] && [ $(( $(date +%s) - $(awk '{print $1;exit}' "$HB") )) -le 1800 ] \
|| echo "❌ heartbeat несвежий — хуки в этой сессии НЕ работают"
❌ → СТОП: verify при мёртвых сторожах легко станет «зелёным враньём» (passing-гейт
не проверит evidence). Сначала /doctor.
Layer 1: Syntax & Static Analysis
Минимальный gate, фундамент.
# JavaScript/TypeScript
npm run check # tsc --noEmit
npm run lint # eslint
# Python
ruff check .
mypy src/
# Common
git diff --check # whitespace
Если хоть что-то красное — STOP, чинить.
Layer 2: Runtime Behavior (unit + integration)
# из feature_list.json[active].verification.layer_2_runtime
npm test -- --filter=<feature>
# или
pytest tests/test_<feature>.py -v
Все тесты зелёные = pass.
Layer 3: End-to-End
Закрывает lecture-10 (E2E меняет результат).
# Из feature_list.json[active].verification.layer_3_e2e
./e2e/test-<feature>.sh
# или
playwright test e2e/<feature>.spec.ts
# или chrome-devtools-mcp scenarios
Кейс из реального проекта: unit-тесты прошли 3/3, e2e нашёл 5 дефектов на границах. Этот слой не пропускать.
Evidence по поверхности (v6.2 F5)
Тип доказательства обязан соответствовать surface фичи — полная таблица:
rules/verification-lanes.md. Кратко: ui → браузер +
layer_4/5; api → curl + статус; cli → команда + exit; job → лог реального прогона;
service → behavior-probe (НЕ pgrep). Hook не пустит passing с пустым evidence у этих поверхностей.
«Не могу прогнать живьём» → Live-Target Probe, 4 яруса (см. ту же таблицу): найти живой
сервер → поднять самому → preview-деплой → только после задокументированного провала всех трёх —
честный UNIT_VERIFIED (не passing). Skip молча — не вариант.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 163 lines · 53 tokens per session scan A e1f4b8667088
verify is a skill published in the GitHub repository andrewcigan/vibe-dev-plugin (5 stars, last pushed 1mo ago), licensed MIT. It adds 53 tokens to every session and 1,723 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
penguin-harness-manual-test
Use when standing PenguinHarness up to try a change by hand — launching the Web App, the desktop shell, the landing page or the docs site to click through it, screenshot it, or reproduce a report. Covers the four dev entry points and their ports, which data root each writes to, and the four ways a healthy setup looks…
moai-ref-testing-pyramid
Test pyramid strategy, coverage targets, test patterns, and quality metrics reference. Agent-extending skill that amplifies manager-develop test-creation and quality-validation work with production-grade testing patterns. NOT for: production code implementation, architecture design, DevOps, security audits.
cherry-pr-test
Test Cherry Studio PRs by resolving and checking out a PR, statically inspecting its changes, running interactive UI tests against a safely tracked Electron instance through CDP, producing a structured report, cleaning up only the owned test instance, and restoring the original branch.
local-test
Build, run, and test IronClaw locally using Docker containers and Chrome MCP browser automation.
playwright-pro
Production-grade Playwright testing toolkit. Use when the user mentions Playwright tests, end-to-end testing, browser automation, fixing flaky tests, test migration, CI/CD testing, or test suites. Generate tests, fix flaky failures, migrate from Cypress/Selenium, sync with TestRail, run on BrowserStack. 55 templates…
browserstack
Run tests on BrowserStack. Use when user mentions "browserstack", "cross-browser", "cloud testing", "browser matrix", "test on safari", "test on firefox", or "browser compatibility".