Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cboone/agent-harness-plugins --skill write-manual-verification-plangit clone --depth 1 https://github.com/cboone/agent-harness-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cboone/agent-harness-plugins/write-manual-verification-plan)<a href="https://agentmods.dev/skills/cboone/agent-harness-plugins/write-manual-verification-plan"><img src="https://agentmods.dev/badge/skills/cboone/agent-harness-plugins/write-manual-verification-plan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cboone/agent-harness-plugins/write-manual-verification-plan"><img src="https://agentmods.dev/badge/skills/cboone/agent-harness-plugins/write-manual-verification-plan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.02473 |
| Opus 5.5 | $0.00021 | $0.00989 |
| Sonnet 5.5 | $0.00010 | $0.00495 |
| Haiku 4.5 | $0.00005 | $0.00247 |
Grade A, and why
write-manual-verification-plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Write Manual Verification Plan
A by-hand checklist is a record, not a message: every step says what to do and what you should see, and the checklist outlives the session that wrote it.
When to Use
Some checks can only be made by a person in front of an environment: a DAW loading a plugin, a simulator running an app, a browser rendering a page, a physical device, a printer. The list of those checks gets asked for, produced, and then fails in three ways. It does not say what success looks like, so the person running it cannot tell a pass from a fail. It does not separate "nothing happened, as intended" from "nothing was running". And it lives in scrollback, so it is rebuilt from scratch every time someone asks for it again, losing every result already reported against it.
Use this skill when:
- Someone asks what can be verified manually, what host or device verification needs, or to be walked through what to test.
- A plan or phase gate has an acceptance criterion that only a real environment can show.
- Someone asks to list or reprint the verification steps. The checklist already exists somewhere, and the job is to find it.
- Results come back as free text against step numbers.
- Someone says they are not sure what a step is looking for. That step's Expected has failed its reader, and the fix belongs in the record.
Do not prescribe a manual run for a check whose quantity has no component only the environment has. That check belongs in an automated test, however important it is. Keep a deferred row linked to its automation issue until that coverage exists; once covered, retire the row with a reference to the test. And do not use this skill to judge whether an automated instrument can fail: that is the plant-defects skill, which is the same discipline pointed at automated checks.
Core Principles
- Expected is an observation a person can check without having written the code. Name where the observation appears (the output line, the pixel, the column, the field), the value, the tolerance in the units the reader sees, and what each plausible wrong reading means. "The trace should be visible" is not an Expected. "The
implies samplevalue on thehighest peakline reads +1.0889, within ±0.002" is. - A null result has three readings. Nothing happened because the change works, because the instrument was not running, or because the conditions could not expose the defect. Every step whose success is an absence carries evidence that separates the intended result from both invalid cases in the same run.
- Nothing is worth concluding before the build is confirmed. An environment runs what is installed, not what was just built. Step 0 confirms the build under test at the start of every session. A result recorded before that confirmation stays
pending; keep it only if Step 0 confirms the same build and nothing was installed in between, otherwise mark itvoid. - The record outlives the session. Persist the checklist to the plan or the issue before presenting it, update that one record in place, and reprint from it. A checklist rebuilt from memory loses every result already recorded against it.
- Record readings, not ticks. Where Expected is a measurement, the measured value goes into the record with its date, build, and environment. Later corrections get checked against those figures, and a tick gives them nothing to check against.
- Put the step where the quantity lives. A step is by hand in principle only when what it checks passes through something only the environment has. Where it merely has not been automated yet, it is a deferral, and it links the issue that will automate it.
- Scope before splitting. State up front which steps need an exclusive resource, so a long checklist can be split across sessions without invalidating itself.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed c6e8e8cdc629
- 8d ago Changed · +1 lines · +18 tokens per session 3f4919bcce63
- 26d ago Changed · -11 lines · -195 tokens per session 99200b3d81eb
- 1mo ago First seen · 100 lines · 229 tokens per session scan A 59f23f7a306e
write-manual-verification-plan is a skill published in the GitHub repository cboone/agent-harness-plugins (2 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 2,473 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-16.
Other skills, from other repositories
walkthrough
Generate a hands-on browser walkthrough of a PR's user-facing changes to exercise before review; --publish posts the final version to the PR for QA.
test-ui
Test the BrowserOS app extension UI by starting the dev environment and visually verifying changes via CDP. Covers the new tab page (left sidebar — Home, Scheduled Tasks, Settings, etc.) and the right side panel (chat interface). Use after making UI changes to apps/app/.
browser-qa
Use to exercise the running app in a real browser — after UI changes, before ship, or when the user asks to QA the site, smoke-test a branch, or check "does it actually work". Drives affected routes headlessly via Playwright, captures console errors, failed requests, and screenshots, and produces a report with a…
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
playwright-cli
Translate natural-language browser automation requests into exact playwright-cli commands for interactive web testing and debugging. Use when requests involve opening/navigating pages, interacting with elements, capturing snapshots/screenshots/PDFs, using tabs, inspecting console/network, mocking routes, managing…
flow
Verify a code change end-to-end in the current worktree: identify what changed, run the relevant tests, get the app running, drive a browser over the affected areas, and report a verdict with screenshots. Generic across project types (Laravel/Herd, Node/bun, frontend, CLI, library). Use when the user wants to…