Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hmj1026/dhpk --skill dhpk-feature-verifygit clone --depth 1 https://github.com/hmj1026/dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hmj1026/dhpk/dhpk-feature-verify)<a href="https://agentmods.dev/skills/hmj1026/dhpk/dhpk-feature-verify"><img src="https://agentmods.dev/badge/skills/hmj1026/dhpk/dhpk-feature-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hmj1026/dhpk/dhpk-feature-verify"><img src="https://agentmods.dev/badge/skills/hmj1026/dhpk/dhpk-feature-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01509 |
| Opus 5 | $0.00050 | $0.00754 |
| Sonnet 5 | $0.00020 | $0.00302 |
| Haiku 4.5 | $0.00010 | $0.00151 |
Grade A, and why
dhpk-feature-verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`Bash` is permitted only for read-only curl and observation queries reviewed against the safety rules. Missing endpoint allowlist means P3 is skipped. How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Feature Verify — Runtime-First API Verification
Verify deployed behavior with read-only runtime evidence:
Primary-model analysis → optional independent reviewer → integrated verdict
Use this for post-deploy checks, smoke tests, and production diagnosis. For
local tests use the repository verification route; for changes use
flow-guide in feature mode; for code review use
change-verdict.
When NOT to Use
- The requested action changes application data, configuration, or deployment state.
- The task is to implement or modify a feature; use
flow-guidein feature mode. - The task is a code, security, or test review rather than runtime behavior verification.
- There is no read-only endpoint, observation path, or approved test environment that can produce evidence for the requested claim.
Required References
Read these at the indicated phase:
- P0/P3: safety-rules.md and environments.md
- P1/P2/P4/P5: blackbox-testing.md
- P0/P2/P5: verification-playbook.md
- Report: output-template.md
Bash is permitted only for read-only curl and observation queries reviewed against the safety rules. Missing endpoint allowlist means P3 is skipped.
P0 — Scope and Safety
- Select
--env, defaulting to test, and load its configuration. - Run
scripts/health-probe.sh <health-url>(3 attempts, 2-second timeout). - Compare local HEAD with the deployed version and warn on mismatch.
- Confirm every planned operation is read-only.
- Determine L4/L3/L2-API/L2-OBS/L1 using the playbook matrix.
API unreachable with logs gives L2-OBS; without logs gives L1. At L1 skip P3/P4. --level L2 remains an alias for L2-API.
P1 — Diff-Lite Scope
Follow blackbox-testing.md § P1. Map git diff main...HEAD --name-only to affected endpoints, dependency chains, active triggers, and passive targets. This phase scopes behavior; it does not judge code quality. If no diff exists, build scope from the user's feature description.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 126 lines · 100 tokens per session scan A 5c9aaf36848e
dhpk-feature-verify is a skill published in the GitHub repository hmj1026/dhpk (2 stars, last pushed today), licensed MIT. It adds 100 tokens to every session and 1,509 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
generator-apply-fixes
Internal Auto-Harness generator skill for QA fix cycles. Use only inside the Generator subagent when it is addressing named defects from QA or retest.
verify
Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.
functions-development
Build serverless Go or Python functions for Falcon Foundry apps. TRIGGER when user asks to "create a function", "write a serverless function", "build backend logic", runs foundry functions create, or needs help with FDK handler patterns, function testing, or collection integration from functions. Also TRIGGER when…
fix-bug
Diagnoses and fixes bugs using a test-first workflow (reproduce, diagnose, fix). Use this skill whenever the user reports a bug, describes unexpected behavior, or asks to investigate or fix a defect. Even if the user says "something's broken", "this isn't working", "fix this bug", or "why does X happen", load this…
cypress-debugger
Use when a Cypress end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Cypress spec, Timed-out-retrying command, unresolved selector, cy.intercept alias or request race, suite-breaking hook, retry-only flake, hydration or timing race, or a…
playwright-debugger
Use when a Playwright end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Playwright spec, TimeoutError, broken or ambiguous selector, post-deploy suite failure, retry-only flake, hydration or timing race, or a passes-locally-but-fails-in-CI split.…