Borrowing it
Nothing to install: this file belongs to boardwalk-labs/boardwalk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/boardwalk-labs/boardwalk/main/.claude/skills/verify/SKILL.mdgit clone --depth 1 https://github.com/boardwalk-labs/boardwalkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boardwalk-labs/boardwalk/verify)<a href="https://agentmods.dev/skills/boardwalk-labs/boardwalk/verify"><img src="https://agentmods.dev/badge/skills/boardwalk-labs/boardwalk/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boardwalk-labs/boardwalk/verify"><img src="https://agentmods.dev/badge/skills/boardwalk-labs/boardwalk/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00894 |
| Opus 5 | $0.00022 | $0.00447 |
| Sonnet 5 | $0.00009 | $0.00179 |
| Haiku 4.5 | $0.00004 | $0.00089 |
Grade B, and why
verify scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -X POST localhost:8081/api/workflows/<slug>/runs -H 'content-type: application/json' -d '{}' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s localhost:8081/api/workflows How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verifying an engine change by running it
The surface is bin/boardwalk-server.js — the self-hosted single-node server. It runs your
LOCAL dist/ build, so it actually exercises your diff. The installed boardwalk CLI does NOT: it
only drives remote engines, so it verifies nothing about local changes.
The credential problem, and the way around it
The managed lane wants BOARDWALK_API_KEY and hits the real gateway. You usually don't have one,
and hunting for stored CLI tokens is both blocked and wrong.
Instead use a local OpenAI-compatible provider — an explicitly supported config path
({"ollama":{"base_url":"http://localhost:11434/v1"}}). Point it at a scripted endpoint you write.
This is a test double at a genuine network boundary, not a unit test: the real server, real HTTP,
real tool execution, real loop. It also lets you control prompt_tokens, which matters because
that number feeds the leaf's context calibration.
Recipe
npm run build # server runs dist/, so ALWAYS rebuild after editing src/
# 1. scripted model on :8099 speaking SSE chat-completions (see the pattern below)
node fake_model.mjs &
# 2. the real engine server, pointed at it
BOARDWALK_PORT=8081 \
BOARDWALK_DATA_DIR=$V/data \
BOARDWALK_WORKFLOWS_DIR=$V/data/workflows \
BOARDWALK_PROVIDERS='{"fake":{"base_url":"http://localhost:8099/v1","protocol":"openai"}}' \
node bin/boardwalk-server.js &
# 3. drive it — routes are /api/..., NOT /v1/...
curl -s localhost:8081/api/workflows
curl -s -X POST localhost:8081/api/workflows/<slug>/runs -H 'content-type: application/json' -d '{}'
curl -s localhost:8081/api/runs/<runId> # status, tokensIn/Out, error
The workflow file goes in $BOARDWALK_WORKFLOWS_DIR/<slug>.mjs and imports from
@boardwalk-labs/workflow. It is deployed automatically at server boot (watch the log).
Gotchas that cost time
- Routes are
/api/*./v1/*returnsNOT_FOUND(that's the hosted API's shape). - The workspace is per-run (
$DATA_DIR/runs/<id>/workspace) and the program's cwd is the workspace. Write"big.txt", not"/workspace/big.txt"—/workspaceis the hosted (fleet) convention and does not exist locally. read'soffsetis 1-based. Passingoffset: 0errors; it does not mean "start".- The stall guard is real. A scripted model that emits the identical tool call every turn trips
"stuck repeating the same tool call(s)" after 5 in a 6-turn window. Vary the arguments (e.g. a
moving
offset) or your loop dies before it gets long. - Run output is a child process — its stderr is NOT in the server log. To observe engine internals, append to a file from inside the loop (temporarily) rather than writing to stderr.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 67 lines · 44 tokens per session scan B e00563db9cac
verify is a skill published in the GitHub repository boardwalk-labs/boardwalk (10 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 44 tokens to every session and 894 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
writing-skills
Use when creating new skills, editing existing skills, or verifying skills work before deployment.
test-agent
Use when writing comprehensive test suites covering happy paths, error paths, edge cases, and integration points.
storybook-ui
Use when storybook for UI component development — stories, addons, controls, a11y testing, visual regression. Use when working with storybook ui.
agent-browser
Browser automation through the agent-browser CLI for websites, local web apps, forms, screenshots, scraping, QA, and exploratory testing. Use when Codex needs real browser interaction, visual evidence, accessibility snapshots, video recording, or browser-based checks.
convex-cron-jobs
Scheduled function patterns for background tasks including interval scheduling, cron expressions, job monitoring, retry strategies, and best practices for long-running tasks.
klimkit-tdd
Implement behavior changes with narrow red-green-refactor loops and Klimkit proof. Use when adding features, fixing bugs with clear expected behavior, changing shared contracts, or when the user asks for TDD or test-first work.