Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/helixdevelopment/code/media-validatornpx skills add HelixDevelopment/code --skill media-validatorgit clone --depth 1 https://github.com/HelixDevelopment/codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.00567 |
| Opus 5 | $0.00010 | $0.00283 |
| Sonnet 5 | $0.00004 | $0.00113 |
| Haiku 4.5 | $0.00002 | $0.00057 |
Grade A, and why
media-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are validating a captured media artifact for a HelixCode user.
Artifact under validation: {{ARG.path}}
The governing rule is that a recording is evidence ONLY if its CONTENT has been read and checked. Duration, file size and mere existence prove nothing: a long recording of an empty terminal is worth less than a short one that shows the feature working. Apply this discipline:
-
STATE THE EXPECTATION FIRST. Before inspecting the artifact, write down what content SHOULD appear in it — the expected output lines, test verdicts, API responses or UI text. A validation with no stated expectation cannot fail honestly, and so cannot pass honestly either.
-
EXTRACT THE ACTUAL CONTENT. Read what the artifact really contains — OCR or frame extraction for video and images, transcription for audio, direct text parsing for terminal captures and logs.
-
COMPARE, AND SAY WHICH PATTERNS MATCHED. Report each expected pattern as found or not found. Never summarise as "looks correct" without naming the evidence that made it correct.
-
SCAN FOR FALSE-SUCCESS CONTENT. Treat empty output, an error banner, an unstarted process, a spinner, or text that merely claims success without showing it as a FAIL, not a pass.
-
RETURN A VERDICT: PASS or FAIL, plus the artifact path, plus the matched and unmatched patterns. On FAIL, pinpoint where — the frame, timestamp or line.
-
IF THE ARTIFACT IS MISSING OR UNREADABLE, say so plainly and return neither PASS nor FAIL — an absent artifact is an absent result, never a pass.
The executable validator that performs OCR and pattern matching lives at
constitution/skills/media-validator/media-validator.sh; the full skill
contract is documented alongside it. Use that script rather than re-implementing
extraction by hand when it is available on this machine.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 45 lines · 21 tokens per session scan A 85a067b5473c
media-validator is a skill published in the GitHub repository HelixDevelopment/code (2 stars, last pushed 4d ago), licensed MIT. It adds 21 tokens to every session and 567 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
browser-recording
Record a browser flow as a video/GIF for evidence — animations, transitions, and multi-step interactions that a still screenshot cannot prove. Drives the project's own Playwright through a bundled runner, then converts to mp4 + GIF via ffmpeg. Use when the user asks to record a demo, capture a GIF or video of the UI…
image-authoring
Author images and diagrams as code — SVG, Pillow, Excalidraw, mermaid. Load when asked to draw, illustrate, or make an image, icon, logo, poster, or diagram.
rn-device-control
This skill should be used when the user asks to "control the simulator", "take a screenshot", "boot the emulator", "install the app", "read UI hierarchy", "manage device state", "open a deep link", "grant permissions", "stream native logs", "disable animations", "change device locale", or needs guidance on xcrun…
rn-best-practices
This skill should be used when writing or reviewing React Native / Expo code — before writing list rendering, animations, data fetching, component APIs, navigation, or image/media UI — and when asked to "review best practices", "check performance", "optimize renders", "review list rendering", "check animation…
inspect-weshop-canvas
Read, generate for, edit, and operate the current WeShop for DeepSeek Harness canvas. Use whenever the user asks about canvas materials/results or asks the agent to generate, upscale, transform, reverse-prompt, or locally edit an image for the canvas. All generated outputs must be published automatically with…
emil-design-eng
This skill encodes Emil Kowalski's philosophy on UI polish, component design, animation decisions, and the invisible details that make software feel great.