Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/drpwchen/openevidence-toolsnpx agentmods add skills/drpwchen/openevidence-tools/oe-verifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/drpwchen/openevidence-tools/oe-verify)<a href="https://agentmods.dev/skills/drpwchen/openevidence-tools/oe-verify"><img src="https://agentmods.dev/badge/skills/drpwchen/openevidence-tools/oe-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/drpwchen/openevidence-tools/oe-verify"><img src="https://agentmods.dev/badge/skills/drpwchen/openevidence-tools/oe-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 234 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Data Exfiltration · line 101 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.05975 |
| Opus 5 | $0.00041 | $0.02988 |
| Sonnet 5 | $0.00016 | $0.01195 |
| Haiku 4.5 | $0.00008 | $0.00598 |
Grade A, and why
oe-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 478 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/oe-verify — OpenEvidence Citation Verification
Derived from audit-oe-skill, MIT © 2026 Hsieh-Ting Lin. The
originROT-1 decode, the corpus→risk tiers, the transitive-citation framing and trace-back stage, the parallel-per-citation + single-cross-citation agent architecture, and the CRITICAL/WARNING/NOTE severity ladder all originate there. See NOTICE for the full licence text.
Why This Skill Exists
OpenEvidence uses RAG (vector search + LLM synthesis) to answer clinical questions. Its structural weaknesses cannot be fixed by improving the prompt:
- Transitive citation — OE retrieves a chunk of a review's full text in which the review
quotes another trial's number, then credits that number to the review. The claim is real;
the attribution is wrong. The
origincorpus field (Step 0) tells us exactly when to suspect this, which is why provenance drives the whole Layer 1 flow. - Secondary source confusion — embedding search treats review-article claims the same as primary findings
- Impact-score ranking bias — older high-IF positive results rank above newer negative ones
- Selective presentation — synthesis picks supporting evidence, not a balanced view. Layer 2 (external anchor: what did OE omit) and Layer 3 (do OE's own citations contradict each other?) exist for this.
This skill independently verifies OE output before you absorb it.
Transport
OE calls run through the openevidence MCP server (see the server README in this repo),
which executes them as page-context fetch() inside your logged-in openevidence.com tab
via a local browser bridge. If OE tools fail: check the bridge daemon is up (default
http://127.0.0.1:10086) and openevidence.com is logged in in your normal browser.
Input Modes
| Mode | Trigger | Behavior |
|---|---|---|
| Question | /oe-verify {question} |
Call ask_openevidence(question, preserve_citations=True), then verify |
| In-context | /oe-verify (no args) |
Verify the most recent OE response in this conversation |
| Auto-trigger | From a note-writing workflow | Receives OE response + question, runs verification silently |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 478 lines · 82 tokens per session scan A 0e7f1f528c2b
oe-verify is a skill published in the GitHub repository drpwchen/openevidence-tools (7 stars, last pushed 6d ago), licensed MIT. It adds 82 tokens to every session and 5,975 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ma-manuscript-quarto
Draft and render a meta-analysis manuscript with Quarto using an IMRaD structure and embedded figures/tables. Use when preparing the final paper from analysis outputs.
ma-end-to-end
End-to-end AI-assisted meta-analysis pipeline orchestration from TOPIC.txt to final manuscript and reviewer responses. Use when the user provides a topic and wants the full meta-analysis workflow, tracking, and final paper.
ma-data-extraction
Define extraction schema, extract study data from full texts, and store it in a structured database for meta-analysis. Use when moving from full-text collection to statistical analysis.
ma-fulltext-management
Collect and manage full-text PDFs for included studies, track provenance, and prepare documents for extraction. Use when moving from screening to data extraction.
ma-screening-quality
Perform title and abstract screening, apply inclusion and exclusion criteria, and assess study quality or risk of bias. Use when selecting eligible studies for meta-analysis.
ma-search-bibliography
Conduct literature searches for meta-analysis using Python with uv, query PubMed and other databases, deduplicate results, and store round-based bibliographies with notes. Use when building or updating the evidence corpus.