Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ch015/code-pentester/verifiernpx skills add ch015/code-pentester --skill verifiergit clone --depth 1 https://github.com/ch015/code-pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.13311 |
| Opus 5 | $0.00018 | $0.06656 |
| Sonnet 5 | $0.00007 | $0.02662 |
| Haiku 4.5 | $0.00004 | $0.01331 |
Grade A, and why
ch015-verifier scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,036 lines — stays where its author put it; the contents beside it link to each section on GitHub.
독립 검증 (Adversarial Verification) Skill
보안 진단 보고서를 독립적으로 검증하여 오탐, 심각도 오류, 누락된 Finding, Finding 간 의존성을 식별합니다.
서비스 개요
| 항목 | 내용 |
|---|---|
| 서비스명 | 독립 검증 (Adversarial Verification) |
| 방법론 | 증거 재검증 + 교차 의존성 분석 + 심각도 민감도 분석 |
| 출력물 | 검증 보고서 (증거 감사 + 의존성 그래프 + 심각도 재평가 + 누락 탐색) |
| 코드 수정 | ❌ 없음 (읽기 전용) |
| 입력 | VA/Pentest/Red Team 보고서 + 대상 소스코드 |
설계 원칙
독립성 원칙
Principles:
Independent_Context: |
"원본 보고서를 생성한 분석과 별도 세션에서 실행한다.
이전 분석의 가정에 오염되지 않은 상태에서 증거를 재검증한다."
Challenger_Stance: |
"모든 판단(위험 판단과 안전 판단 모두)을 의심한다.
보고서의 결론을 수용하지 않고, 증거로부터 독립적으로 결론을 도출한다.
원본 보고서와 동일한 결론에 도달하더라도 그 과정이 증거 기반이어야 한다."
No_Library_Assumptions: |
"라이브러리의 존재, 이름, 일반적 평판으로 보안 속성을 추론하지 않는다.
보안 속성은 프로젝트 코드에서 명시적으로 확인 가능할 때만
'적용됨(Verified)'으로 판단한다."
Severity_Is_Contextual: |
"심각도는 고정값이 아니라 다른 Finding과의 관계에 의해 변동한다.
Finding A의 해소가 Finding B의 심각도에 영향을 줄 수 있다.
이 의존성을 명시적으로 식별하고 기록한다."
Phase 구조 (v2 — 4-Phase 통합, P1-3)
Phase R0-sealed : Context Binding (봉인) → target/engagement 경로만 수령, VA 보고서 경로는 봉인
Phase R0.5 : Autonomous Discovery → ★ VA 보고서 미열람 상태의 독립 VA 패스 (A1-A8)
Large Scale(서브프로젝트≥5 또는 ≥100K LOC)만 풀패스.
일반 엔게이지먼트는 "R0.5-Lite"(차원별 canonical 질문만)
산출물: 02a_verify_autonomous-<round>.md
존재 전까지 R1 금지 (Invariant I1)
Phase R1-Unified: Evidence & Context Audit ← 기존 R0 + R1 + R1.2 + R1.5 + R1.7 통합
· R0 서브단계: VA 보고서 파싱
· R1 서브단계: Observed/Unverified/Invalidated 재분류
· R1.2 서브단계 (CRITICAL/HIGH 필수, 나머지 20% 샘플): Semantic Taint Re-trace
· R1.5 서브단계: Attack Prerequisites 독립 재평가
· R1.7 서브단계: Asset Value 태그 대조
· R1.8 서브단계: Impact Gate(3 Proofs) 분류 독립 재검증
· 보상 제어 재검증 (compensating-control.md 참조)
Phase R2-Analysis : Dependency + Sensitivity ← 기존 R2 + R3 + R3.5 통합
· R2 서브단계: Finding 간 교차 의존성 그래프
· R3 서브단계: 심각도 민감도 (What-If)
· R3.5 서브단계: Score Recalculation 항상 수행
trigger: "R1-Unified 완료 후 항상 실행"
Phase R4-GapDiff : Autonomous × VA × Raw Ledger 교차 분석
· Matched / VA_Only / Autonomous_Only / Ledger_Only 분류
· Final report omission audit
· Over_Confidence_Gate 판정
산출물: 02b_verify_gap-<round>.md
Phase R5 : Verification Report → 통합 보고서 생성 (규제 영향 참조 포함, 해당 시)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 1,036 lines · 37 tokens per session scan A b7223edc3711
ch015-verifier is a skill published in the GitHub repository ch015/code-pentester (4 stars, last pushed 13d ago), licensed MIT. It adds 37 tokens to every session and 13,311 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codebeacon
Scan a codebase → AST extraction → knowledge graph → wiki + CLAUDE.md context map. Supports 27 frameworks (Spring Boot, NestJS, Django, FastAPI, Flask, Rails, Express, Fastify, Koa, React, Next.js, Vue, Nuxt, Angular, SvelteKit, Gin, Echo, Fiber, Laravel, Actix-Web, Axum, Tauri, Rocket, Warp, ASP.NET Core, Vapor…
test-harness
Test codeweave-mcp tools against any project using TestHarness. Use this whenever verifying tool behavior, testing a code change, or running custom assertions — e.g. "test the harness", "run tests against X project", "does semanticsearch work correctly".
nexus-mapper
Generate a persistent .nexus-map/ knowledge base that lets any AI session instantly understand a codebase's architecture, systems, dependencies, and change hotspots. Use when starting work on an unfamiliar repository, onboarding with AI-assisted context, preparing for a major refactoring initiative, or enabling…
nexus-query
Precise, instant code structure queries for active development — answer 'who depends on this interface before I refactor it', 'how many modules break if I change this', 'what is the real impact radius of this feature change', 'which module is the true high-coupling hotspot in this legacy codebase'. Essential before…
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
knowledge-base
Create and maintain a Markdown knowledge base that any AI agent can read, search, and update. Use when the user wants to start a knowledge base, add or update notes, organize docs/notes for an agent or LLM to consume, build an index of notes, or run a cleanup/maintenance pass on an existing MD knowledge base. Triggers…