verify

verify is a skill for Claude Code from Bangs00/claude-media-control. It costs 41 tokens per session (1,044 once invoked), scanned B, original, MIT.

A verification guide for testing changes to a Mac media-control plugin from start to finish.

In plain words
What is it for?
It is for testing the command-line script, native helper, status display, and playback controls with isolated data and a controllable fake media app.
Why use it?
It provides a repeatable test setup without changing the user's live media configuration or depending on their music apps.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths.

Part of the media plugin — 16 skills, 1 hook shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/bangs00/claude-media-control/verify
Any agent
npx skills add Bangs00/claude-media-control --skill verify
Clone the repo
git clone --depth 1 https://github.com/Bangs00/claude-media-control

Made for: Claude Code.

Or install media, the plugin that ships this one along with the rest of its 16 skills, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verify

README.md
[![agentmods](https://agentmods.dev/badge/skills/bangs00/claude-media-control/verify.svg)](https://agentmods.dev/skills/bangs00/claude-media-control/verify)
Your own site
<a href="https://agentmods.dev/skills/bangs00/claude-media-control/verify"><img src="https://agentmods.dev/badge/skills/bangs00/claude-media-control/verify.svg" alt="Measured on agentmods" height="20"></a>
Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,044 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00041 $0.01044
Opus 5 $0.00020 $0.00522
Sonnet 5 $0.00008 $0.00209
Haiku 4.5 $0.00004 $0.00104

Measured 5d ago against content hash 0e9a7e0358b7, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade B, and why

verify scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

self-heal) writes to `$HOME/.claude/settings.json` — export a scratch
.claude/skills/verify/SKILL.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verifying claude-media-control

Surface = the scripts/media.sh CLI + the statusline segment it prints. npx bats tests/media.bats covers logic with stubs; real verification runs the actual pipeline (perl loader → adapter.dylib → mediaremoted).

Isolate from the user's live install

Always export a scratch data dir first — without it, media.sh falls back to ~/.claude/plugins/data/media-* and mutates the user's real config/cache:

export CLAUDE_PLUGIN_DATA=/tmp/media-verify-data
scripts/build-native.sh --rebuild   # real dylib for this checkout's version

Publish a controllable now-playing track

Don't drive Music.app via AppleScript (tell app "Music" to … hangs on the Automation-consent dialog in headless contexts, and you can't control track titles). Instead compile a tiny publisher: MPNowPlayingInfoCenter + MPRemoteCommandCenter handlers + a silent AVAudioEngine source node (clang -fobjc-arc -framework Foundation -framework MediaPlayer -framework AVFoundation npub.m -o npub). Publish any title/artist/duration you need (long titles for marquee, CJK for width handling).

Two gotchas:

  • appName/bundleIdentifier only appear when the publisher runs from a real .app bundle launched via open (LaunchServices registration); a bare executable publishes metadata but no app identity.
  • Kill it with pkill -f <name>; media.sh now must return null after.

What to drive

  • media.sh now — JSON incl. outputDevice, appName
  • media.sh statusline after config display.statusline on — run twice with sleep 2 between to see the marquee advance; NO_COLOR=1 and statusline.multiline on are cheap probes
  • Statusline wiring (statusline install/uninstall/status, the auto-wire in config display.statusline on, and the wrapper's uninstall self-heal) writes to $HOME/.claude/settings.json — export a scratch HOME too before driving it, or you will rewire the user's real settings. Simulate "plugin uninstalled" for the self-heal by emptying $HOME/.claude/plugins/installed_plugins.json ({"plugins":{}}) and making the recorded dev root non-executable/absent; the wrapper must restore settings.json and delete itself + the backup.
  • media.sh output / output "<substring>" / output <n> — switch to the CURRENT device for a safe no-op, or switch away and back; output "LG" style ambiguous names must exit 4 with candidates
  • media.sh history / history --json — entries appear only on track change (dedup across statusline ticks); drive an artist-lag amend by changing the published title first, then the artist one read later — the transitional entry must be replaced, not kept
  • cmd+click round-tripbuild-click-handler.sh in the scratch data dir, then open "claude-media-control://seek/50" etc. and assert on the fake publisher's command log. (The legacy claude-media:// scheme is also claimed and accepted, but the user's REAL install claims it too — open routing for it is ambiguous on this machine, so exercise legacy URLs by calling the scratch click-handler.sh directly instead of via open.) Two gotchas: LaunchServices launches the applet WITHOUT CLAUDE_PLUGIN_DATA, so rewrite the scratch click-handler.sh to export it (and to exec THIS checkout's media.sh — the resolution block prefers the marketplace cache, which may hold an older version without open-url). Always build-click-handler.sh --remove afterwards to unregister the scheme, and delete any npub entries that the user's REAL statusline (ticking every second against the real data dir) logged while the fake publisher held now-playing
  • media.sh doctor — check the Output dev line and verdict:

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 83 lines · 41 tokens per session scan B 0e9a7e0358b7

Subscribe to this mod's changes

verify is a skill published in the GitHub repository Bangs00/claude-media-control (4 stars, last pushed 1mo ago), licensed MIT. It adds 41 tokens to every session and 1,044 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

quiz-me

Quiz the user on root cause and intended fix BEFORE writing any non-trivial code, then verify comprehension of every change after. Use when the user asks for a bug fix, refactor, or feature and wants to stay technically sharp instead of vibe-coding. Also use when the user says "quiz me", "don't let me vibe code", or…

emanzurv/quiz-me-skill · 82 tokens

economist-style

Apply The Economist style guide to written content. Use when editing markdown, HTML, documentation, or any written text that needs professional editing for clarity, precision, and brevity. Detects weasel words, fillers, passive voice, and style issues.

TAJD/economist-style-guide-plugin · 54 tokens

configure

Set up the telegram-topics channel — save the bot token and forum group id, then run a preflight check. Use when the user pastes a Telegram bot token, asks to configure telegram-topics, asks "how do I set this up", or wants to check channel status.

2naive/claude-telegram-topics · 60 tokens

allowlist

Put this plugin on the Claude Code channels allowlist (managed settings) so --channels delivers inbound messages — one command, one admin prompt. Use when preflight reports NOT ALLOWLISTED, when Telegram messages never arrive in sessions although the send tools work, or when the user asks to set up the channels…

2naive/claude-telegram-topics · 70 tokens

access

Manage who may drive telegram-topics sessions — view and edit the user allowlist. Use when the user asks to allow or remove a Telegram user, check who's allowed, or lock the channel down.

2naive/claude-telegram-topics · 42 tokens

spotify

Control Spotify on macOS. Use for playing music, controlling playback, and getting track information.

rbouschery/marketplace · 21 tokens