agentmods.dev

foundation: Skill for Cursor

.cursor/skills/verify-foundation/SKILL.md

verify-foundation is a skill for Cursor from dgraziosi/foundation. It costs 68 tokens per session (5,573 once invoked), scanned C, original, MIT.

A scripted verification guide for Foundation Viewer, the human-facing window into one life graph. It explains how to launch the viewer, check mapped screens, capture evidence, and clean up.

In plain words
What is it for?
It helps verify the home screen, collections, detail pages, search, unlocking, and journal writing in a local Foundation setup.
Why use it?
It makes behavior checks repeatable after changes and clarifies boundaries such as what the viewer writes and what data must not be placed in the repository.

Skill for Cursor

Written for Cursor: installed under .cursor/.

This is dgraziosi/foundation's own configuration. It tells Cursor how to work on foundation itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything foundation configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is ./scripts/foundation-init.sh.

not rated 1repo changed today C scan 68 tokens original MIT
View source ↗ dgraziosi/foundation
Reuse

Borrowing it

Nothing to install: this file belongs to dgraziosi/foundation. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/dgraziosi/foundation/main/.cursor/skills/verify-foundation/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/dgraziosi/foundation

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verify-foundation

README.md
[![agentmods](https://agentmods.dev/badge/skills/dgraziosi/foundation/verify-foundation/github.svg)](https://agentmods.dev/skills/dgraziosi/foundation/verify-foundation)
Your own site
<a href="https://agentmods.dev/skills/dgraziosi/foundation/verify-foundation"><img src="https://agentmods.dev/badge/skills/dgraziosi/foundation/verify-foundation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for verify-foundation

Your own site · 80×15
<a href="https://agentmods.dev/skills/dgraziosi/foundation/verify-foundation"><img src="https://agentmods.dev/badge/skills/dgraziosi/foundation/verify-foundation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,573 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00068 $0.05573
Opus 5.5 $0.00027 $0.02229
Sonnet 5.5 $0.00014 $0.01115
Haiku 4.5 $0.00007 $0.00557

Measured today against content hash f519b66f1ca8, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

verify-foundation scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

The scan reads SKILL.md. This mod also ships 8 executable files (scripts/verify-edit-any-node.sh, scripts/verify-export-import-45.sh, scripts/verify-foundation.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

Cleanup may `rm -rf` only `/tmp/foundation-verify-<run-id>` when the recorded data dir is that folder or its `data/` child. A `VERIFY_DATA_DIR` that is a direct child of `/tmp` is that run root. Its parent is `/tmp` and

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsS http://127.0.0.1:8787/health
.cursor/skills/verify-foundation/SKILL.md · 301 lines

How it starts

The opening of the file, as written. The whole thing — 301 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify Foundation (Viewer)

Foundation is a life graph that models the user so bots can help with life goals. Viewer is the human UI — a window on one vault. Journal keeps a writing page. Other live records edit title, status, and declared fields. It is not a personal-knowledge-management app and not harness chat-memory.

This skill is for the next agent, read cold. The person using a clone is the user. Stay on product. No live vault contents, no staff names, no personal data.

pstack's generic generator writes .cursor/skills/verify-*. This repo's product recipes stay under .agents/skills/. Do not copy vault-health, Dream, or other product folders here.

Product words

  • graph — live records (nodes) and edges
  • ontology — types and how they connect
  • MCP — how a bot talks to the graph (http://127.0.0.1:8787/mcp)
  • Viewer — the human window (http://127.0.0.1:8788/view). Same CAS and soft-delete as MCP.
  • vault — one instance (FOUNDATION_DATA + host Postgres)
  • record — the node
  • user — the human who runs this vault on this machine

Do not write a live personal vault into git. Do not reintroduce Compose as install. Host programs: Postgres 16 on PATH (initdb, pg_ctl, psql) plus the app (pnpm start). The package name for Postgres is unknown in this repo — do not guess an installer.

Journal write is on this branch. Home always offers Today, even at journal count 0. Today (or /view/journal/today) creates today's journal if none is live, then the page autosaves title and body. An empty title shows Keep a title. Unlock title is Unlock. The field is the vault key. The error is That key did not unlock. Other live records edit title, status, and declared fields on detail. Activity and Trash use the same if-match and restore family.

Launch

Official start on the machine that runs a vault (from the clone root):

./scripts/foundation-init.sh

Init copies .env when it is missing, mints the door keys and a published database password into .env (mode 600), mkdir the data folder, then keep-up. Do not commit .env. Keep-up also mints missing, published, or short keys if you start that way. Empty first-day folder at FOUNDATION_DATA (default ./data) may init.

Read the full file on GitHub · 301 lines

Files

What ships with it

21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · -1 lines f519b66f1ca8
  2. yesterday Changed 961dea4e5400
  3. 3d ago Changed · +2 lines e172a8a59f67
  4. 7d ago Changed cb82266a2406
  5. 19d ago Changed · +2 lines a259299c852a
  6. 22d ago Changed · -3 lines 7df9b7af82fe
  7. 1mo ago Changed · +1 lines ed8a4aa12462
  8. 1mo ago Changed · +2 lines b434dd3f557c
  9. 1mo ago Changed aa89d79c3933
  10. 1mo ago First seen · 298 lines · 68 tokens per session scan C 8308ce6189fe

Subscribe to this mod's changes

verify-foundation is a skill published in the GitHub repository dgraziosi/foundation (1 stars, last pushed today), licensed MIT. It adds 68 tokens to every session and 5,573 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

DebuggingE2E testingTesting
Related

verify-foundation compared with skills from other repositories

verify-foundation next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
verify-foundationdgraziosi/foundationSkill1todayMITC68Cursor
reproduce-buggoogleapis/mcp-toolboxSkill17kyesterdayApache-2.0A130Claude Code, Codex
verify-omnigentomnigent-ai/omnigentSkill11ktodayApache-2.0A100Claude Code, Codex
testing-blocksadobe/skillsSkill319yesterdayApache-2.0A61Claude Code
reality-verificationtzachbon/smart-ralphSkill56710d agoMITA81Claude Code
test-electron-appPostHog/posthogSkill41ktodaynoneA112Claude Code
webapp-qaPrismer-AI/PrismerCloudSkill1.4k15d agoMITA29Claude Code, Codex