Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bitmiracle-ai/dormice/verifynpx skills add BitMiracle-AI/Dormice --skill verifygit clone --depth 1 https://github.com/BitMiracle-AI/DormiceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bitmiracle-ai/dormice/verify)<a href="https://agentmods.dev/skills/bitmiracle-ai/dormice/verify"><img src="https://agentmods.dev/badge/skills/bitmiracle-ai/dormice/verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00001 | $0.00270 |
| Opus 5 | $0.00000 | $0.00135 |
| Sonnet 5 | $0.00000 | $0.00054 |
| Haiku 4.5 | $0.00000 | $0.00027 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Verify Dormice runtime behavior
- Run
pnpm buildbefore verification; the black-box surface ispackages/server/dist/main.js. - Launch an isolated fake daemon with an unused port, a temporary absolute
DORMICE_DB_PATH/DORMICE_DATA_DIR, a 64-hexDORMICE_API_TOKEN, andDORMICE_EXECUTOR=fake. - Wait for
GET /healthz, then drive native or E2B routes only over HTTP. E2B control auth isX-API-KEY: e2b_<token>; envd requests use the returnedsandboxID/envdAccessTokenasE2b-Sandbox-IdandX-Access-Token. - Connect streaming requests use one envelope: flag byte
0, four-byte big-endian JSON length, then JSON bytes. Parse responses as repeated envelopes. - Capture response status/body inline. Probe malformed input, replay/concurrency, and resource cleanup around the claimed flow.
- Stop the daemon and remove its temporary directory. Docker/gVisor process facts require the Linux test host and cannot be established with the fake executor.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 14 lines · 1 tokens per session scan A 988cb11aaab4
verify is a skill published in the GitHub repository BitMiracle-AI/Dormice (987 stars, last pushed 3d ago), licensed Apache-2.0. It adds 1 tokens to every session and 270 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debugging-output-and-previewing-html-using-ray
Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
changelog-entry
Add a new entry to CHANGELOG.yml under the current unreleased version (or create the version block if needed), then regenerate documentation. Use when the user says things like "add a changelog entry", "log this fix in the changelog", or "/changelog-entry".
project-snmp-profiles-authoring
Use when editing Netdata SNMP profile YAMLs, topology SNMP profiles, ddsnmp profile parsing, or profile-format documentation. Requires checking source MIB field accessibility, especially MAX-ACCESS not-accessible INDEX objects, before adding or changing profile symbols.
web-artifacts-builder
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.
kurtosis-ethereum
Run Ethereum multi-client devnets using Kurtosis and the ethpandaops/ethereum-package. Use for spinning up local devnets, syncing public testnets, validating cross-client interop, testing fork transitions, shadowforks, running assertoor checks, debugging CL/EL client interactions, or verifying new feature…
evolve-create
Create a reusable gene from a novel fix pattern. Only invoke manually.