init-verify

A temporary workflow for checking code changes in a fully running application, including visual checks in a browser.

In plain words
What is it for?
It helps instantiate the application, run its backend and frontend, check pages in a browser, capture screenshots at required sizes and themes, and clean up temporary artifacts.
Why use it?
A template project may not run by itself, so this creates a temporary working copy for realistic verification without leaving setup files behind.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fpindej/netrock/init-verify
Any agent
npx skills add fpindej/netrock --skill init-verify
Clone the repo
git clone --depth 1 https://github.com/fpindej/netrock

Made for: Claude Code, Codex.

Per session 58 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 699 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00058 $0.00699
Opus 5 $0.00029 $0.00349
Sonnet 5 $0.00012 $0.00140
Haiku 4.5 $0.00006 $0.00070

Measured 3d ago against content hash 4ebd3e4b321f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

init-verify scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

- Delete gitignored leftovers too: the instantiation's `bin`/`obj` output is invisible to the untracked listing. Remove the renamed project trees wholesale (`rm -rf src/backend/<Name>.* src/backend/tests/<Name>.*`), then
.claude/skills/init-verify/SKILL.md · 28 lines

How it starts

The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify template changes in a real running app. The template's placeholder form (MyProject) cannot run the full stack; a throwaway instantiation can. Nothing from the instantiation may leak into commits.

When polishing UI in the template, run /polish-ui step 5 (browser verification) inside this loop.

The loop

  1. Commit first: the real (pre-init, template-form) changes must be committed before anything else - the revert below destroys uncommitted work. Capture the SHA: PRE_INIT_SHA=$(git rev-parse HEAD).
  2. Snapshot Docker: note existing containers/volumes (docker ps -aq, docker volume ls -q) so cleanup removes only what this run creates.
  3. Instantiate: ./init.sh --name VerifyApp --yes --no-commit --no-build --no-aspire. Do NOT add --no-migration - the initial migration is what makes the stack actually run (it builds WebApi even with --no-build).
  4. Run: dotnet run --project src/backend/VerifyApp.AppHost in the background. The frontend serves at the base port (default http://localhost:13000); confirm with a probe, do not assume.
  5. Verify: drive the browser (Playwright), capture screenshots at all required breakpoints and both themes. Save screenshots OUTSIDE the repo (scratchpad) - the revert deletes untracked repo files.
  6. Preview fixes cheaply: small copy/style fixes can be edited directly in the instantiated tree to preview live before teardown - these edits are throwaway, the real fix is applied pre-init afterwards.
  7. Teardown:
    • Stop Aspire.
    • git reset --hard "$PRE_INIT_SHA" (the project hook blocks a bare git reset --hard - always pass the explicit target).
    • Delete untracked init artifacts: verify git ls-files --others --exclude-standard lists ONLY instantiation files, then remove them (the project hook blocks git clean - use the list + rm).
    • Delete gitignored leftovers too: the instantiation's bin/obj output is invisible to the untracked listing. Remove the renamed project trees wholesale (rm -rf src/backend/<Name>.* src/backend/tests/<Name>.*), then find src/backend -type d -empty -delete.
    • Remove the Docker containers/volumes created since the snapshot (Aspire volumes are named <name>-db-data, <name>-storage-data).
  8. Apply findings pre-init: fixes discovered during verification go into the template files (normal delegation rules), then commit. Repeat the loop if the fix needs visual confirmation.

Read the full file on GitHub · 28 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 28 lines · 58 tokens per session scan C 4ebd3e4b321f

Subscribe to this mod's changes

init-verify is a skill published in the GitHub repository fpindej/netrock (231 stars, last pushed 4d ago), licensed MIT. It adds 58 tokens to every session and 699 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.