Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add catcatcatstudio/cat-skills --skill fortifygit clone --depth 1 https://github.com/catcatcatstudio/cat-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catcatcatstudio/cat-skills/fortify)<a href="https://agentmods.dev/skills/catcatcatstudio/cat-skills/fortify"><img src="https://agentmods.dev/badge/skills/catcatcatstudio/cat-skills/fortify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.03833 |
| Opus 5 | $0.00045 | $0.01917 |
| Sonnet 5 | $0.00018 | $0.00767 |
| Haiku 4.5 | $0.00009 | $0.00383 |
Grade A, and why
fortify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 427 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/fortify — Testing That Proves Your Code Works
Drop into any project, detect its stack, install the professional testing ecosystem, write thorough tests, run them until green, and verify they catch real bugs. The output isn't test files — it's proof your code works.
When NOT to use this skill
- Project has comprehensive, verified test coverage already → run the tests, don't re-fortify
- You just need to run existing tests →
npm test/pytest/ whatever directly - You want to review build plans or design docs →
/architect - You want to optimize a skill's prompt quality → that's eval optimization, different thing
Quick Reference
| Mode | What happens |
|---|---|
/fortify or /fortify full |
Detect → Install → Audit → Write → Run → Verify → Report |
/fortify setup |
Detect → Install → Done |
/fortify check |
Detect → Audit → Report gaps → Done (no installs, no test writing) |
The difference from just asking Claude to "add tests": Phases 6 and 7. Tests that aren't run are fiction. Tests that don't catch bugs are theater.
Phase 1: Detect
Read the project root. Identify everything about the stack.
1a. Package Manifests
Read all of these that exist:
package.json,pnpm-lock.yaml,yarn.lock,bun.lockbpyproject.toml,setup.py,setup.cfg,Pipfile,requirements.txtCargo.toml,go.mod,Gemfile,composer.jsonbuild.gradle,pom.xml,Package.swift,mix.exs,pubspec.yaml
1b. Framework Detection
From the manifest and source files, identify:
- Language(s): TypeScript, Python, Rust, Go, Swift, etc.
- Framework(s): Next.js, React, Vue, Svelte, Express, FastAPI, Django, Rails, etc.
- Runtime: Node, Bun, Deno, CPython, etc.
- Package manager: npm, pnpm, yarn, bun, pip, poetry, cargo, etc.
- Existing test setup: Check for test config files, test directories, test scripts
1c. Domain Detection
Scan the codebase to identify what types of code exist:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 427 lines · 90 tokens per session scan A 22bb49017a59
fortify is a skill published in the GitHub repository catcatcatstudio/cat-skills (3 stars, last pushed 12d ago), licensed MIT. It adds 90 tokens to every session and 3,833 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tools-expert
This skill should be used when selecting CrewAI built-in tools, composing agent toolchains, or creating production-ready custom tools with BaseTool or @tool, including schema validation, dependency management, caching, async support, and testing.
lab:autoresearch
Self-improving loop for plugin skills. Reads program.md, proposes one mutation per iteration, evaluates against deterministic scorer, keeps improvements via git, reverts failures. Targets weakest skill+dimension. Use with /loop for overnight runs.
verify
Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.
review-testing
Review test code for quality, design, and completeness after implementing a feature or fixing a bug. Use when the user asks to "review my tests", "check my test quality", "are these tests good enough", "review testing", or after completing a feature implementation that includes tests. Also use when tests feel brittle…
completion-verification
Verifies that work is actually complete before it is claimed to be — running the checks, reading the output, and confirming the original request was satisfied rather than approximated. Use this before saying something is done, fixed, or passing; before committing or opening a pull request; and whenever a claim of…
api-testing
HTTP API testing for TypeScript (Supertest) and Python (httpx, pytest). Test REST APIs, GraphQL, request/response validation, authentication, and error handling.