Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/getpapi/papi/papi-verifynpx skills add getpapi/papi --skill papi-verifygit clone --depth 1 https://github.com/getpapi/papiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.00860 |
| Opus 5 | $0.00032 | $0.00430 |
| Sonnet 5 | $0.00013 | $0.00172 |
| Haiku 4.5 | $0.00006 | $0.00086 |
Grade A, and why
papi-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PAPI Verify — Structured Cycle Health Check
Run a comprehensive verification of the current PAPI cycle state. This is the "smoke test for PAPI itself" — catches regressions and data quality issues before they reach external users.
Steps
1. Orient and capture cycle state
Run orient to get the current cycle number, task counts, and board state. Record:
- Current cycle number
- Tasks by status (Backlog, In Progress, In Review, Done)
- Any carry-forward items
2. Plan validity check
Run build_list to get all cycle tasks. For each In Cycle task, verify:
- Task has a title (not empty)
- Task has a priority assigned
- Task has a complexity/effort estimate
- Task has a BUILD HANDOFF (check if it appears in build_list output)
Report: PLAN: X/Y tasks have valid handoffs
3. Build state check
For each task status, verify consistency:
In Progress tasks:
- Check if a
feat/task-XXXbranch exists (git branch | grep feat/task-XXX) - Flag any In Progress task with no branch (orphaned status)
Done tasks (this cycle):
- Check if a build report exists (these appear in the build_list or board_view output)
- Flag any Done task without a build report
Report: BUILD: X branches found for Y In Progress tasks. Z Done tasks with reports.
4. Review coverage check
Run review_list to check:
- How many tasks are In Review
- Are there Done tasks that were never reviewed (skipped review_submit)
Report: REVIEW: X tasks pending review, Y tasks reviewed and accepted
5. Branch hygiene check
Run git branch | grep feat/task and cross-reference with board state:
- Branches for Done tasks that haven't been merged (orphaned branches)
- Branches for tasks not in this cycle (leftover from previous cycles)
- Current branch — are we on main or a feature branch?
Report: BRANCHES: X feature branches, Y orphaned, Z ready to merge
6. Data consistency check
Verify dashboard data matches MCP state:
- Run
board_viewand compare task counts with orient output - Check if cycle number in orient matches what board_view shows
- Flag any discrepancies
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 103 lines · 63 tokens per session scan A c60a60e7c5db
papi-verify is a skill published in the GitHub repository getpapi/papi (7 stars, last pushed 11d ago), licensed MIT. It adds 63 tokens to every session and 860 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sprint-plan
MUST use when user describes a multi-step feature to build, says 'let's build', 'new project', 'let's implement', or when a task clearly requires more than 3 steps and no plan exists yet. Do NOT trigger for simple additions like adding a comment, renaming a variable, or single-file changes. Produces: task breakdown…
breaking-down-work
Decomposes a goal, feature, epic, or deliverable into a structured task tree (tasks, subtasks, checklists) with dependencies in Astravue. Use when the user wants to break down, decompose, or plan out work, turn an epic or feature into tasks, "split this into tasks", scope a deliverable, or build a work breakdown…
capturing-meeting-actions
Extracts action items from meeting notes, transcripts, or a brain dump and creates them as owned, dated tasks in Astravue. Use when the user pastes meeting notes or a transcript, asks to turn notes or standup discussion into tasks, capture action items, or "make tasks out of this".
mapping-dependencies
Maps task dependencies in an Astravue project, finds the critical path and blocked work, and detects circular dependencies before any rescheduling. Use when the user asks about dependencies, blockers, what's blocking what, the critical path, or wants to understand or fix the sequencing of a project.
triaging-overdue-work
Reviews overdue and at-risk tasks in Astravue, assesses why each is slipping, and proposes reschedule, reassign, deprioritize, or close actions before applying them. Use when the user asks what's overdue, behind schedule, slipping, or at risk, wants to catch up on a project, or clean up late work.
generating-status-report
Generates executive project status reports from Astravue data including task progress, budget consumption, and project health. Use when asked for a status update, project summary, executive report, or "how is the project going?".