Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bobbyjohnstx/tinycode/verifynpx skills add bobbyjohnstx/tinycode --skill verifygit clone --depth 1 https://github.com/bobbyjohnstx/tinycodeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.00645 |
| Opus 5 | $0.00019 | $0.00322 |
| Sonnet 5 | $0.00008 | $0.00129 |
| Haiku 4.5 | $0.00004 | $0.00064 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify
Use this skill when the user wants concrete evidence that a recent change works — not a guess, not a summary, but proven output.
When to Use
Use this skill when:
- The user says "verify", "confirm it works", "check before I push", "validate this PR", or "does this actually work"
- An implementation, fix, or refactor just finished and a completion check is needed before claiming done
- The user wants proof of correct behavior, not an explanation of why it should work
When Not to Use
- The task is to write new test coverage from scratch — use the
test-engineeragent or TDD workflow - The goal is to diagnose why something fails — use
trace(competing hypotheses) ordebug(single root cause) - The task is to fix a defect — verify reports status, it does not edit code
- A broad multi-surface QA sweep is needed — use
ultraqa - The change was just made and is obviously broken — fix it first, then verify
Examples
Good: "Verify the auth refactor still logs users in correctly" → Runs existing auth tests, checks build, reports VERIFIED with evidence.
Bad: "The login test is failing, fix it" → That is a fix task. Fix the code first, then invoke verify.
Bad: "Why is the login test failing?"
→ That is diagnosis. Use debug or trace.
Goal
Turn vague "it should work" claims into concrete evidence.
Workflow
- Identify the exact behavior that must be proven.
- Prefer existing tests first.
- If coverage is missing, run the narrowest direct verification commands available.
- If direct automation is not enough, describe the manual validation steps and gather concrete observable evidence.
- Report only what was actually verified.
Verification order
- Existing tests
- Typecheck / build
- Narrow direct command checks
- Manual or interactive validation
Rules
- Do not say a change is complete without evidence.
- If a check fails, include the failure clearly.
- If no realistic verification path exists, say that explicitly instead of bluffing.
- Prefer concise evidence summaries over noisy logs.
- Do not modify source code to make verification pass — report the failure instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 69 lines · 39 tokens per session scan A d2807cdf7ad1
verify is a skill published in the GitHub repository bobbyjohnstx/tinycode (11 stars, last pushed 4d ago), licensed MIT. It adds 39 tokens to every session and 645 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
system-prompts
Write system prompts, tool docs, and agent definitions. Project tag conventions + RFC 2119 keywords + dense compression. Use when authoring or editing any prompt the model reads.
tool-prompt-optimization
Optimize the description prompts an AI agent reads to learn its built-in tools (the .md files under prompts/tools/). Two halves: (1) measure how much of a prompt is already inferable from the tool's JSON parameter schema + name, to prune redundancy with evidence; (2) house authoring rules for what belongs in a tool…
agent-browser
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
archon-cli
Drive Archon through its CLI: run AI workflows on a repo, manage those runs (inspect, approve, reject, cancel, resume), set up Archon or change its config, author new workflows, and improve workflow prompts. Use when the user says "use archon", "run archon", "archon workflow", "fix issue #N with archon", "have archon…
semantic-compression
Re-encode verbose prose into a dense telegraphic register — punctuation as connectives, label frames, verbless assertions — without losing normativity or precision. Use when compressing system prompts, tool/function descriptions, skill bodies, or agent instructions; reducing token count or context bloat; making…
greet
A greeting skill for testing.