Borrowing it
Nothing to install: this file belongs to dundas/thinkrun. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dundas/thinkrun/main/.claude/skills/prove-it/SKILL.mdgit clone --depth 1 https://github.com/dundas/thinkrunWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dundas/thinkrun/prove-it)<a href="https://agentmods.dev/skills/dundas/thinkrun/prove-it"><img src="https://agentmods.dev/badge/skills/dundas/thinkrun/prove-it/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dundas/thinkrun/prove-it"><img src="https://agentmods.dev/badge/skills/dundas/thinkrun/prove-it.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00163 | $0.04736 |
| Opus 5.5 | $0.00065 | $0.01894 |
| Sonnet 5.5 | $0.00033 | $0.00947 |
| Haiku 4.5 | $0.00016 | $0.00474 |
Grade C, and why
prove-it scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$SEC" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
PORT=<port>; lsof -iTCP:$PORT -sTCP:LISTEN | head -3; curl -sI http://localhost:$PORT | head -1 How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prove It
You are the quality-control step. A change has been made — a feature, a fix, a
perf improvement — and someone is about to trust a sentence like "tested, works".
Your job is to replace that sentence with evidence: for each named claim, a
captured result from a real browser, and a verdict of pass, fail, or
not-exercised. If anything is not pass, the change goes back to build. You do
not summarise, soften, or open the PR on a non-pass.
Two things this skill is not: it is not a UX review (no opinions, no fix list —
that is ux-audit), and it is not "have a look at the page" (that is web-browse).
It needs a change under test and claims about it.
Inputs
- Test targets (required). One or more behaviours phrased as testable statements: "the coupon field rejects expired codes", "the dashboard loads in under 300 ms", "the empty state shows the import CTA". If the user gives none, derive them from the diff or PR title, list them back, and proceed. Out of scope for this skill: anything the browser session cannot observe — a downloaded file's contents, an email that was sent, a row written to a database. Say so and prove it another way (a script, a query) rather than passing a target a screenshot cannot support.
- Revision under test:
git rev-parse --short HEADand the branch, or the deployment URL. It goes in the report header. - Where to post (optional): a PR or issue number for
gh.
Step 0 — Doctor, then choose a mode
thinkrun doctor
Read three lines of the output before anything else:
Server acceptance: accepted— an API key is accepted. The Activity Feed session, the share link, and cloud mode all depend on this. Without it, local mode still works and the report sayssession: none (no API key).Bridge health— the extension + native host are up; local mode is available.- If neither local nor cloud is available, stop and paste the doctor output. Do not fall back to "I verified by reading the code". That is the failure this skill exists to prevent.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 365 lines · 163 tokens per session scan C 547bf33d262c
prove-it is a skill published in the GitHub repository dundas/thinkrun (2 stars, last pushed 18d ago), licensed MIT. It adds 163 tokens to every session and 4,736 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
Console Error Hunter
Systematically detect, capture, and categorize browser console errors, warnings, and unhandled exceptions during automated test execution.
Geb Testing
Browser automation testing with Geb framework for Groovy/JVM using jQuery-like content DSL, Page Object pattern, Spock integration, and WebDriver abstraction.
playwright-e2e
Comprehensive end-to-end testing skill using Playwright for web applications, covering page objects, selectors, assertions, waits, fixtures, and test organization.
e2e-testing-claude-code
Make Claude Code write and maintain end-to-end tests like a senior SDET — Playwright and Cypress flows with stable locators, the Page Object Model, fixtures, reused auth state, network mocking, and flake-free CI. Claude Code E2E testing, done right.
Browser Agent QA Testing
Teach agents to use AI browser agents for exploratory and smoke QA with step budgets, evidence-based assertions, guardrails, and Playwright conversion.
muggle-test
Change-driven E2E acceptance testing: detects the user's recent changes (local diff, branch, or PR), maps them to the user flows they affect, and runs real-browser tests on localhost or a preview/staging URL. Use whenever the user wants their own work validated before it ships — "make sure I didn't break anything"…