What is contract-verify?

A contract checker for product requirements, using automated rules first and reasoning-based reviews second. It combines the results into a findings file and calculates whether the contract is ready.

Use it to verify a contract or PRD, run selected critics, reuse cached checks, and get a computed readiness result.

It catches both mechanical mistakes and gaps that require judgment, while avoiding unnecessary review work through different checking modes.

contract-verify — Skill for Claude Code by iampawan

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add iampawan/Manifest --skill contract-verify

Clone the repo

git clone --depth 1 https://github.com/iampawan/Manifest

Made for: Claude Code.

Or install manifest, the plugin that ships this one along with the rest of its 28 skills, 15 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/iampawan/manifest/contract-verify.svg)](https://agentmods.dev/skills/iampawan/manifest/contract-verify)

Your own site

<a href="https://agentmods.dev/skills/iampawan/manifest/contract-verify"><img src="https://agentmods.dev/badge/skills/iampawan/manifest/contract-verify.svg" alt="Measured on agentmods" height="20"></a>

Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,279 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00065	$0.05279
Opus 5	$0.00032	$0.02639
Sonnet 5	$0.00013	$0.01056
Haiku 4.5	$0.00006	$0.00528

Measured 7d ago against content hash 705f48f2383d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

contract-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/contract-verify/SKILL.md · 451 lines

How it starts

The opening of the file, as written. The whole thing — 451 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Contract verifier (orchestrator)

Verification runs in two layers. The deterministic layer (code) handles everything mechanically checkable — reproducible, free, no LLM variance. The judgment layer (LLM critics) handles only what genuinely needs reasoning. Readiness is computed by code, not judged.

Follow reference/CRITIC-PROTOCOL.md for severity definitions and output schema.

Inputs

A contract ID (e.g., SC-005) or path.

Process

1. Read and guard

Read .manifest/contracts/<ID>.md. If it doesn't exist or status is already promoted, refuse.

1b. Decide how much to re-run — speed comes from doing less

Most of the wall-clock is the LLM critics (the deterministic validator is <1s). So before running anything, figure out the smallest correct set of critics to run. Four modes, in priority order:

A. --force → skip all caching, run a full verify (every relevant critic, full regression scan). Use when in doubt.

B. --fast (fast-iteration mode) → run ONLY critic-edge-cases and critic-security, and tell regression to reuse (no repo scan). This is the quick draft-loop verdict. Stamp verifyMode: fast in the findings frontmatter. A --fast verify is not promotable — a full verify must run before promote (contract-promote enforces this). Tell the user: "Fast verify — ran edge-cases + security only. Run /contract verify <ID> (full) before promoting."

C. No-op cache → if not fast/force, check whether anything changed:

node <plugin-root>/scripts/validate.mjs --cache-check .manifest/contracts/<ID>.md

Exit 0 (cached): content + plugin + protocol versions unchanged. Reuse .findings.md wholesale, skip every critic, tell the user it's reused. Exit 1 (stale): go to D.

D. Incremental re-verify (the common edit→reverify case) → ask the validator which fragments changed since the last findings:

node <plugin-root>/scripts/validate.mjs --changed .manifest/contracts/<ID>.md \
  .manifest/contracts/<ID>.findings.json

Read the full file on GitHub · 451 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 451 lines · 65 tokens per session scan A 705f48f2383d

Subscribe to this mod's changes

contract-verify is a skill published in the GitHub repository iampawan/Manifest (5 stars, last pushed 4d ago), licensed MIT. It adds 65 tokens to every session and 5,279 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Testing

research-engineer

An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.

davila7/claude-code-templates · 43 tokens

tika-eval-compare

Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".

apache/tika · 50 tokens

neuron-evaluation-engineer

Create and run AI evaluations with datasets, assertions, and output drivers in Neuron AI. Use this skill whenever the user mentions evaluation, testing AI systems, creating evaluators, dataset-driven testing, assertion-based validation, or wants to measure AI system performance. Also trigger for tasks involving…

neuron-core/neuron-ai · 77 tokens

contract-verify