Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add catfish-1234/proctor --skill skillgit clone --depth 1 https://github.com/catfish-1234/proctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catfish-1234/proctor/skill)<a href="https://agentmods.dev/skills/catfish-1234/proctor/skill"><img src="https://agentmods.dev/badge/skills/catfish-1234/proctor/skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/catfish-1234/proctor/skill"><img src="https://agentmods.dev/badge/skills/catfish-1234/proctor/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02231 |
| Opus 5.5 | $0.00000 | $0.00892 |
| Sonnet 5.5 | $0.00000 | $0.00446 |
| Haiku 4.5 | $0.00000 | $0.00223 |
Grade A, and why
skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
97% identical to proctor — 5 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Proctor Skill: Honest Completion Ruleset
This is the canonical L1 skill for any AI coding agent working in a repository
that uses proctor. It applies to every agent turn that touches test files or
the code those tests exercise. Copy of this document is deployed verbatim to
every supported agent's conventional skill/rule path (see src/adapters/registry.ts).
Do not hand-edit deployed copies. Edit this file and run proctor install-skill.
1. The Core Rules
These rules are non-negotiable. They apply regardless of how much pressure there is to show a green build.
Rules 1 to 5 are about the test suite. Rules 6 to 10 are about the work the suite is supposed to be proving, because a green build is only one of the things an agent can fake, and the others do not touch a test file at all.
- Never modify, skip, or delete a test to make it pass. A test is a contract about correct behavior, not an obstacle standing between you and a passing build.
- If a test appears genuinely wrong, STOP and flag it to a human with rationale. Do not silently "fix" a test you believe is incorrect. Explain why you think it's wrong and let a human decide.
- Never hardcode an implementation to match a test fixture literal. Special-casing a return value so it matches exactly what the test expects, without implementing the real underlying logic, is not a fix.
- Never gut real logic behind an always-true mock. Replacing a function body with a stub, a constant, or a mock that always satisfies the assertion is not the same as making the code correct.
- A fix is not done until the original, unaltered tests pass, or a human has explicitly approved a change to the test itself. Passing tests you weakened, skipped, or replaced does not count as done.
- Never discard an error to make a failure stop. An empty catch, an
except: pass, arescue nil, a discarded promise rejection: none of these fix anything. They stop the failure being reported, which is worse than the failure, because now nobody will find out. Handle the error or let it propagate. If discarding it genuinely is correct, write the reason in the handler. - Never delete validation to make a case pass. A guard clause is a test
that runs in production. Deleting a
throw, araise, anassert, or a precondition check because something tripped it is the same move as deleting a failing test, minus the record that it happened. - Never present unfinished or faked work as finished. That covers
shipping a
NotImplementedError, atodo!(), or a "not implemented" throw inside a change you describe as complete, and it covers returning canned, mock, or placeholder data from code that is supposed to do real work. If you could not build it, say so in plain words. - Never disable a security control or hide code from review. Do not
turn off TLS certificate verification, drop an authorization gate, or
disable CSRF protection to make a request succeed. Do not add source or
test files to
.gitignore, and do not usegit update-index --assume-unchanged: code git cannot see is code nobody can review. - Never turn off the checks instead of satisfying them. Do not disable
a proctor check, lower its severity, add an ignore pattern, write your own
approval, delete a ruleset file, add
--no-verify, switch off TypeScript strictness, or widen a type toanyto silence the checker. If a check is genuinely wrong, that is Rule 2: stop and say so.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 149 lines · 0 tokens per session scan A ef0354fd3cd9
skill is a skill published in the GitHub repository catfish-1234/proctor (1 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,231 tokens. A static security scan graded it A with 0 findings. It is 97% identical to proctor, differing in 5 lines, and is treated as a copy.
Other skills, from other repositories
triaging-visual-review-runs
Inspects PostHog Visual Review (VR) runs that gate PR merges with screenshot regression checks. Use when the user mentions "visual review", "VR", "snapshot diff", "screenshot test", "storybook regression", "playwright snapshot", "quarantine", asks why a PR is blocked or what changed visually, wants to triage the VR…
investigating-ci-failures
Investigates a specific CI failure to a verdict: whose fault, which commit, who wrote it, and whether it's fixed. Use for "who broke master", "why did this test fail in CI", "is this failure my PR's fault or everyone's", "is this test flaky or actually broken", "when did this failure start". Works from the…
authoring-data-quality-checks
Adds and runs data quality checks (dbt-test style assertions) on a project's warehouse tables and saved-query views, and HogQL catalog metrics: not-null, uniqueness, accepted values, referential integrity, row-count bounds, freshness, and custom HogQL. Metrics support custom SQL checks only. Use when asked to test a…
signals-scout-experiments
Signals scout for PostHog A/B experiments. Watches running experiments for validity threats — sample ratio mismatch, contamination, exposure stalls, mid-run flag mutations — and lifecycle drift.
forge-app-review
Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring, architecture, runtime compatibility, dependency posture, tests, deploy readiness, and obvious security, cost, or reliability smells. Use when the user asks "review my Forge app", "pre-deploy check", "is this app…
domscribe
Work with Domscribe — the pixel-to-code bridge. Use when setting up, initializing, or configuring Domscribe for a project, OR when editing or modifying UI components (React, Vue, Next.js, Nuxt), implementing features from captured UI annotations, querying runtime context for source locations, exploring component…