vhk: Skill for Claude Code

.agents/skills/vhk-auto/SKILL.md

vhk-auto is a skill for Claude Code, Codex from byh3071-cpu/vhk. It costs 25 tokens per session (2,766 once invoked), scanned A, original, MIT.

An autopilot workflow for taking one active VHK Goal through implementation and verification without publishing or merging changes. It follows strict stop conditions and uses VHK's deterministic verification result to decide whether work may continue.

In plain words
What is it for?
Use it to start an autonomous goal run, implement and verify the goal, append the required development log, stop on critical defects or repeated verification failures, and create a commit only when the rules allow it.
Why use it?
It gives a repeatable way to complete a small development cycle while limiting risky automation. It prevents automatic issue creation, pushing, pull requests, merges, and publishing.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is byh3071-cpu/vhk's own configuration. It tells Claude Code and Codex how to work on vhk itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything vhk configures →

Reuse

Borrowing it

Nothing to install: this file belongs to byh3071-cpu/vhk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/byh3071-cpu/vhk/main/.agents/skills/vhk-auto/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/byh3071-cpu/vhk

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for vhk-auto

README.md
[![agentmods](https://agentmods.dev/badge/skills/byh3071-cpu/vhk/vhk-auto/github.svg)](https://agentmods.dev/skills/byh3071-cpu/vhk/vhk-auto)
Your own site
<a href="https://agentmods.dev/skills/byh3071-cpu/vhk/vhk-auto"><img src="https://agentmods.dev/badge/skills/byh3071-cpu/vhk/vhk-auto/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for vhk-auto

Your own site · 80×15
<a href="https://agentmods.dev/skills/byh3071-cpu/vhk/vhk-auto"><img src="https://agentmods.dev/badge/skills/byh3071-cpu/vhk/vhk-auto.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 25 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,766 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00025 $0.02766
Opus 5 $0.00013 $0.01383
Sonnet 5 $0.00005 $0.00553
Haiku 4.5 $0.00003 $0.00277

Measured 11d ago against content hash 6fef987dad87, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

vhk-auto scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/vhk-auto/SKILL.md · 107 lines

How it starts

The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.

VHK Autopilot (1단계 MVP)

VHK로 개발 중인 프로젝트에서 active goal 카드 1개를 사람 개입 없이 한 바퀴 돌리고, 끝나면 멈춰서 핵심만 보고한다. 위험한 건 하지 않는다 — 외부 발송·이슈 등록·코드 집행은 2단계 vhk auto 명령 영역이다.

🔒 불변조건 (절대 어기지 마라)

  • INV-1 진행 허가 = vhk verify green(결정론)에만. 적대리뷰(LLM)는 "중단 트리거"로만 — "진행해도 된다"는 긍정 판정 금지.
  • INV-2 외부 발송 0. gh issue create 호출 금지. 문제는 채팅 보고 + 이슈 초안 텍스트까지만.
  • INV-3 집행 코드 0. dedupe·rate-limit·이슈 jsonl 영속 금지. (dev log append 는 허용·필수 — INV-5)
  • INV-4 자동 합·불 입력 = vhk verify.vhk/reports/latest.json + 각 명령 exit code 만. vhk review·vhk mission check 는 exit code 만 신뢰하고 stdout 텍스트는 파싱하지 말 것 (텍스트는 적대 판단의 신호로만 읽는다).
  • INV-5 commit 전 docs/devlog/<오늘날짜>-autopilot.md 에 1줄 append 필수. 안 하면 check-records 훅(exit 2)이 막는다. src 실코드 커밋에 [skip-record] 우회 금지. 이 경로는 비추적이라 git add 하지 않는다(공개 경계 — ADR-008·ADR-010).
  • INV-6 critical 결함 발견 또는 vhk verify 연속 2회 red 시 .vhk/HARD_STOP 파일 생성하고 종료. 매 시작(0번)에 .vhk/HARD_STOP 존재를 먼저 확인한다.
  • INV-7 commit 만 자동. push·PR·머지·publish 는 절대 자동 금지.
  • INV-8 적대리뷰는 현재 호스트에 맞는 독립 리뷰 어댑터를 정확히 1개 사용한다. 리뷰 어댑터를 읽고, 지원되는 어댑터가 없거나 실행·인증·판정에 실패하면 합격으로 간주하지 말고 중단 사유를 보고한다.
  • INV-9 루프 시작 시 vhk autonomy-log --event start로 runId를 발급받아 루프 내내 유지하고, 종결 분기에서 결과에 맞는 이벤트로 반드시 종결 기록한다(이슈 #373 자율성완주율 계측 — 시작만 있고 종결이 없으면 완주율 분모/분자가 둘 다 부정확해진다).
  • INV-10 합격 종결 전에 vhk receipt 를 반드시 실행한다. 완주 판정은 같은 커밋 SHA 의 receipt 를 요구하는데(isVerifiedComplete), vhk verify 는 그 원장을 쓰지 않는다. 빠지면 런이 기록돼도 verified=false 로 떨어져 관찰 게이트의 유효 실행에 들어가지 않고, 자기 보고 격차로 잡혀 권한 승급까지 영구 차단된다. 커밋 직후에 불러야 SHA 가 일치한다.
  • INV-11 자동 commit은 다른 writer가 없는 격리된 작업 브랜치에서만 한다. 병렬 에이전트·사람 편집 세션이 같은 worktree를 쓸 수 있으면 시작하지 말고 각자 별도 worktree를 사용한다. 시작 전에 git -c core.quotepath=false status --porcelain=v1 -z --untracked-files=all의 출력이 비어 있어야 하고 git branch --show-current가 비어 있거나 main·master이면 시작하지 않는다. 기존 변경을 stage·stash·reset·삭제해 기준선을 만들지 않는다. commit 직전 다시 상태를 읽어 현재 브랜치와 Goal 범위를 다시 확인하며, 보호 브랜치이거나 범위 밖 경로가 하나라도 있으면 vhk save를 호출하지 않고 blocked로 끝낸다. vhk verify도 증거 원장을 경로 한정 commit할 수 있으므로 매 verify 직전에 같은 브랜치 검사를 한다. 이 검사를 생략할 수 없다.

Read the full file on GitHub · 107 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 107 lines · 25 tokens per session scan A 6fef987dad87

Subscribe to this mod's changes

vhk-auto is a skill published in the GitHub repository byh3071-cpu/vhk (12 stars, last pushed today), licensed MIT. It adds 25 tokens to every session and 2,766 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.