Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iliaal/whetstone --skill ia-verification-before-completiongit clone --depth 1 https://github.com/iliaal/whetstoneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iliaal/whetstone/ia-verification-before-completion)<a href="https://agentmods.dev/skills/iliaal/whetstone/ia-verification-before-completion"><img src="https://agentmods.dev/badge/skills/iliaal/whetstone/ia-verification-before-completion/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iliaal/whetstone/ia-verification-before-completion"><img src="https://agentmods.dev/badge/skills/iliaal/whetstone/ia-verification-before-completion.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01142 |
| Opus 5.5 | $0.00021 | $0.00457 |
| Sonnet 5.5 | $0.00010 | $0.00228 |
| Haiku 4.5 | $0.00005 | $0.00114 |
Grade A, and why
ia-verification-before-completion scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verification before completion
Make completion claims only from fresh evidence for the actual claim. Follow the user's authorized scope; repository instructions supply applicable checks, not permission to mutate, publish, or weaken a requirement.
Procedure
-
Resolve ambiguous scope before editing. Inspect the repository and state a safe assumption when one interpretation is clear. Ask only when materially different interpretations remain; do not edit the disputed scope while waiting.
-
Inspect
git status --porcelainand preserve unrelated work. Before any suite or migration runs, including a baseline, confirm its database and service targets are disposable (a dedicated test database, container, or throwaway schema; never the dev database) (proof-integrity.md, Pre-Verification Check). For dependency/framework upgrades, codegen, or migrations, capture the existing validation command set before writing and rerun it unchanged afterward. If that baseline is red, report before proceeding. Shared-module verification on a dirty tree needs an isolated base comparison. -
Identify the command that proves the claim. For ship-level claims, check the full applicable chain: build, types, lint, tests, security scan, and diff review; stop on the first failure. Read project-declared gates and run the ones that apply to this action in their required order; do not invent gates.
-
Run the proof now. Earlier output, a subagent's report, confidence, and a renamed success phrase do not replace fresh execution.
-
Read complete output and exit status, including warnings, executed/passed counts, and missing artifacts. A suite that executes nothing is not proof. Confirm the intended binary, interpreter, source revision, and entry point actually ran.
- Preserve raw evidence. Display filters can produce plausible summaries while dropping records or rewriting bytes. Use unfiltered output when parsing, patches, counts, comparisons, or reviews depend on complete records or exact bytes. A downstream
head,tail, orcatcannot restore filtered producer output.
- Preserve raw evidence. Display filters can produce plausible summaries while dropping records or rewriting bytes. Use unfiltered output when parsing, patches, counts, comparisons, or reviews depend on complete records or exact bytes. A downstream
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/change-strategies.md 11 KB
- references/claims-and-failures.md 8.0 KB
- references/isolated-verification.md 6.1 KB
- references/performance-measurement.md 2.9 KB
- references/proof-integrity.md 5.9 KB
- references/scope-and-sweeps.md 2.3 KB
- references/system-wide-test-check.md 1.9 KB
- references/verification-oracles.md 6.3 KB
- SPEC.md 4.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +1 lines c32a985785de
- 14d ago Changed · +3 lines 2eb478e14ade
- 27d ago Changed 6a4ff17a1b2d
- 1mo ago Changed · -172 lines 7a209abe1c06
- 1mo ago First seen · 214 lines · 52 tokens per session scan A f94aabaced6f
ia-verification-before-completion is a skill published in the GitHub repository iliaal/whetstone (35 stars, last pushed 2d ago), licensed MIT. It adds 52 tokens to every session and 1,142 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
cypress-debugger
Use when a Cypress end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Cypress spec, Timed-out-retrying command, unresolved selector, cy.intercept alias or request race, suite-breaking hook, retry-only flake, hydration or timing race, or a…
playwright-debugger
Use when a Playwright end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Playwright spec, TimeoutError, broken or ambiguous selector, post-deploy suite failure, retry-only flake, hydration or timing race, or a passes-locally-but-fails-in-CI split.…
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures or unexpected results — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke…
debug
Systematic bug investigation with a five-phase framework: reproduce, narrow, diagnose, fix, verify. Supports automated regression bisect via --regression flag. Produces a structured debug report with root cause analysis, regression test, and CQ/Q self-evaluations.
wicked-garden-qe-code-analyzer
Static code analysis for testability, quality, and maintainability. Reviews code structure, identifies test-coverage gaps, and flags risky areas. Use when: static analysis, code-quality metrics, testability assessment, maintainability review, coverage-gap identification. Runs on arbitrary source code, anytime — does…
freezed-production-engineering
Design, implement, review, refactor, debug, test, and migrate immutable Dart/Flutter models using Freezed, native Dart, or both. Use this skill whenever work involves @freezed/@Freezed, copyWith, value equality, sealed unions, JSON DTOs, jsonserializable, generated .freezed.dart/.g.dart files, buildrunner, Freezed…