Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fubits1/svelte-skills --skill validategit clone --depth 1 https://github.com/fubits1/svelte-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fubits1/svelte-skills/validate)<a href="https://agentmods.dev/skills/fubits1/svelte-skills/validate"><img src="https://agentmods.dev/badge/skills/fubits1/svelte-skills/validate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fubits1/svelte-skills/validate"><img src="https://agentmods.dev/badge/skills/fubits1/svelte-skills/validate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.02134 |
| Opus 5.5 | $0.00015 | $0.00854 |
| Sonnet 5.5 | $0.00007 | $0.00427 |
| Haiku 4.5 | $0.00004 | $0.00213 |
Grade B, and why
validate scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
- **NEVER trust subagent claims.** After EVERY subagent completes, run `git diff` to see what actually changed. Subagents can claim "done, no changes needed" while having silently modified files, or claim "fixed" while h How it starts
The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validation
- Browser FIRST. Before running any CLI validation, verify your changes work in the browser via Playwright. Navigate to affected pages, confirm the feature works, take screenshots. Broken code that passes lint is still broken. Browser is the source of truth. Exception: the per-file story loop in
frontend:validate-filereproduces withpnpm test:storyfirst and checks the browser once the story test passes - Browser verification: see
frontend:playwrightskill for all rules on screenshots, critical examination,browser_evaluatemeasurements, and visual debugging. NEVER ask the user to check their browser: that is YOUR job - FLAKY SUITES NEED MULTIPLE RUNS. Storybook/browser/e2e/
mswtests are flaky on a single run. Before declaring green, run 3x in a row from a clean state: kill the test server port, deletenode_modules/.viteandnode_modules/.cache/storybook, then run. ALL three must pass. One green run is meaningless - SETUP TIME VARIANCE IS A FLAKE FLAG. If the same suite shows setup time varying by >30% between runs (e.g. 100s vs 200s), the runs are not equivalent: one of them is silently skipping imports. Do not trust either count until you understand why
- MATCH THE USER'S RUN CONDITIONS. When the user reports a failing run, reproduce their EXACT state before claiming a fix worked: same branch, same lockfile, same cache state. If you cannot reproduce their failure, say so out loud: do not paper over it with your own green output from a different cache state
Test Files N passed (N)≠ verification. Always cross-check the test count against the expected total. A run that "passes 85/85" test files but only executes 147 of 192 tests has silently skipped 45 tests, about 23% of the suite- Before declaring done/fixed: run
pnpm validatewhenpackage.jsonhas it. TheSETUP.mdtemplate (repo root, not shipped with the plugin) runstest:unitandlint:summaryconcurrently, thentest:storybook;lint:summarycovers knip, svelte-check, oxlint, eslint and stylelint, andpnpm validate:buildbelow adds the builds. Must exit 0, and its lint table must show no failure: the templatelint-summary.tsexits 0 even when a lint task fails. A CSS-only change: see the exception underpnpm validate:buildbelow - Run
pnpm test:unit(vitest) after every change.pnpm test, where a project defines it, can also launch Playwright e2e tests (with thesv add playwrightconfig, Playwright'swebServerbuilds and previews the app first; in another config, itswebServersetting decides whether a server must already run): usepnpm test:unitfor quick feedback - Test in the correct mode: dev changes to
pnpm dev, notpnpm build - Exit code 0 or it's not verified. Crashes ≠ passes
- Crashed baseline ≠ valid baseline. Incomplete runs have meaningless timing
- Timed-out command = failed verification. Task is NOT done
- Single-file success ≠ full-run success. Always run the full command
- Get a baseline BEFORE making config changes, then compare
- Never declare "done" when error counts drop. Compare rule-by-rule
- Unit tests prove nothing about component APIs: verify in browser (see
frontend:playwrightskill) pnpm test:unitexercisesmswhandlers only where a test sends a request throughmsw: a browser test that mounts a component that fetches, with the worker started (e.g. in a setup file), or a node test withsetupServerlistening. Handlers and fixtures that only stories use, and Storybook rendering, need the storybook project and a browser check (svelte-5:msw,svelte-5:storybook-vitest)- When fixing a bug found via browser interaction: reproduce the exact user flow via Playwright BEFORE declaring done
- Never declare "done" when verification failed or was skipped
- Show proof, not summaries
- VALIDATE AFTER EVERY SINGLE FILE EDIT. Not after a batch. Edit one file, run checks, confirm 0 errors, then move to next file. NEVER batch edits across multiple files without validating between them
pnpm lint:file <file>: run this on every edited file. It runs eslint + knip, oxlint for JS and TS files, plus svelte-check (with--tsgoby default) when the list holds a.sveltefile, ortsgo --noEmitwhen it holds a TypeScript file (.ts,.tsx,.mts,.cts) and no.sveltefile (a list with neither gets no type check), with the type-check and knip output filtered to the listed files. Without tsgo installed, its tsgo step still reports✓, and so does its svelte-check step unlessSVELTE_CHECK_FLAGSdrops--tsgo, so install every tool first (SETUP.md; other false-green cases:frontend:validate-file, type-check caveats).svelte,.svelte.ts,.svelte.jsfiles: ALWAYS run the Svelte autofixer (mcp__plugin_svelte_svelte__svelte-autofixer) after editing to validate Svelte 5 correctness, except on a.sveltefile not yet migrated (pure Svelte 4:export let,$:,<slot />, no runes;frontend:validate-filestory loop, step 5).pnpm lint:filedoes not run it: the template'slint-file.tshas no autofixer step- CI workflow changes: simulate the CI environment locally before pushing. Run commands with
CI=true GITHUB_ACTIONS=trueto catch tools that auto-detect CI and change behavior (e.g. oxlint switches to--format=github). NEVER push a CI "fix" without local CI simulation first - GitHub Actions workflow files: ALWAYS run
pnpx [email protected] <file>after editing any.ymlor.yamlworkflow file in.github/workflows/. Exit code 0 or it's not valid. Check the path withtest -f <file>first: for a path that matches no file, and for a directory, node-actionlint prints nothing and still exits 0 - Use
pnpm validate:buildas the final verification: runs validation and build tasks concurrently. See SETUP.md for how to configure this script. One command, everything checked. Exception: a CSS-only change needs no build: verify it visually via Playwright, plus lint, vitest and svelte-check - Run the TEST TYPE you changed. If you modified Playwright tests, run
pnpm test:e2e(where the project defines it, assv add playwrightdoes; otherwise not covered here). If you modified vitest tests, runpnpm test:unit. If you modified stories, runpnpm test:storybook. TheSETUP.mdtemplate'spnpm validateruns no Playwright e2e. Changed tests must actually execute and pass - LINT TEST FILES:
pnpm lint:tests. One command, runs 4 linters: oxlint and eslint on the test files matchingTEST_GLOBS(src/**/*.test.tsandtests/**/*.test.tsby default), knip and svelte-check (with--tsgoby default) on whatknip.tests.jsoncandtsconfig.tests.jsoncover. Lint a*.e2e.tstest fromsv add playwright, a*.spec.tstest, or a test file outside theTEST_GLOBSpatterns withpnpm lint:file. Without tsgo (with the default--tsgoflag) or withouttsconfig.tests.json, its svelte-check step reports✓; a missingknip.tests.jsoncfails its knip step; when no file matchesTEST_GLOBSit lints nothing and exits 0 (SETUP.md). Must exit 0. Do NOT run individual linters: you WILL forget one - One problem at a time. Fix ONE problem, verify it passes, then move to the next. Never batch unrelated changes: changing two things at once makes it impossible to tell which change broke what
- Capture expensive test output. When running Playwright or e2e tests, pipe to
tee /tmp/test-output.log. If output is already in context, READ IT: never rerun. NEVER run the same expensive command twice in a row just to grep differently - Final checklist before declaring done: Browser verified? Linted?
pnpm validate:buildexit 0 with no failure in its lint table (or, for a CSS-only change, the exception above)? Each edited workflow file passedtest -fand then exited 0 underpnpx [email protected]? - NEVER trust subagent claims. After EVERY subagent completes, run
git diffto see what actually changed. Subagents can claim "done, no changes needed" while having silently modified files, or claim "fixed" while having broken something. Never tell the user "I didn't change that" without checking git first
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · -1 lines 61a86618c259
- 2mo ago First seen · 42 lines · 37 tokens per session scan B 0643be98d1a8
validate is a skill published in the GitHub repository fubits1/svelte-skills (10 stars, last pushed 12d ago), licensed MIT. It adds 37 tokens to every session and 2,134 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
validate compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| validatefubits1/svelte-skills | Skill | 10 | 12d ago | MIT | B | 37 | Claude Code |
| imagegenopenai/codex | Skill | 133k | yesterday | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 103 | Claude Code |