Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/cwinvestments/memstacknpx agentmods add skills/cwinvestments/memstack/verifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cwinvestments/memstack/verify)<a href="https://agentmods.dev/skills/cwinvestments/memstack/verify"><img src="https://agentmods.dev/badge/skills/cwinvestments/memstack/verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02079 |
| Opus 5 | $0.00036 | $0.01040 |
| Sonnet 5 | $0.00014 | $0.00416 |
| Haiku 4.5 | $0.00007 | $0.00208 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
✅ Verify: Checking Work...
Run the project's checks, write a receipt, read what it says.
Activation
When this skill activates, output:
✅ Verify: running the check chain...
Then follow the protocol below.
Context Guard
| Context | Status | Priority |
|---|---|---|
| Tracked changes are finished and about to be reported done | ACTIVE, run the chain | P1 |
| User asks "does it pass", "verify this", "is this ready" | ACTIVE, run the chain | P1 |
| About to commit | ACTIVE, a receipt costs less before the commit than after | P1 |
| User is mid-task, still editing | DORMANT, a receipt for a half-finished tree ages out the moment the next edit lands | n/a |
| Read-only audit or investigation | DORMANT, nothing changed, so there is nothing to verify | n/a |
| Edits left no tracked change (new untracked files only) | DORMANT, the gate does not see untracked files and neither does the chain | n/a |
Repo where verify list detects nothing |
DORMANT, but read NOTHING_DETECTED below before concluding this | n/a |
What the CLI actually detects
scripts/verify.py detects three families and nothing else. Anything outside this list goes unchecked, so a passing receipt is not a claim that the project is sound:
| Family | Detected when | Runs |
|---|---|---|
| npm | package.json has a scripts entry named test, lint, typecheck or build |
npm run <script>, one check per script, in that order |
| pytest | pytest.ini, or pyproject.toml with a [tool.pytest] section, or a tests/ directory |
python -m pytest -q |
| ruff | ruff.toml, .ruff.toml, or pyproject.toml with a [tool.ruff] section |
ruff check . |
A detected check that cannot run becomes a SKIP carrying its reason: npm missing from PATH, node_modules absent, pytest not importable, ruff not installed. A SKIP is not a pass, because nothing ran.
Run python scripts/verify.py list to see the chain without executing it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · -38 lines · +45 tokens per session 55b336100c9b
- 3d ago First seen · 162 lines · 26 tokens per session scan A e1284357a39a
verify is a skill published in the GitHub repository cwinvestments/memstack (419 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 2,079 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
atomic-tdd
Test-first discipline. Auto-triggers on "let's implement X", "add feature Y", "fix bug Z", "write a test for", "implement", "build out", and similar pre-code-change phrases. Iron rule: failing test exists before production code. Skip only for pure docs/config changes with an explicit "skipped because:" note. Explicit…
kotlin-testing
Kotlin testing patterns with Kotest, MockK, coroutine testing, property-based testing, and Kover coverage. Follows TDD methodology with idiomatic Kotlin practices.
rust-testing
Rust testing patterns including unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD methodology.
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
verification-loop
A comprehensive verification system for Claude Code sessions. Use when verifying a Claude Code session's work before claiming it is complete.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.