Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/itmisx/deepx-code/verification-before-completionnpx skills add itmisx/deepx-code --skill verification-before-completiongit clone --depth 1 https://github.com/itmisx/deepx-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.00732 |
| Opus 5 | $0.00030 | $0.00366 |
| Sonnet 5 | $0.00012 | $0.00146 |
| Haiku 4.5 | $0.00006 | $0.00073 |
Grade A, and why
verification-before-completion scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. **真探活**:用前台 `Bash` 跑 `curl -s localhost:<port>`(或对应健康检查),**读响应内容**,确认是预期的,而不是看见进程起来了就说"完成"。 What it actually says
完成前验证
移植自 superpowers(MIT)。这是刚性 skill。
铁律:没有刚跑出来的验证证据,不许声称完成。
闸门流程
在说出任何状态结论之前,按顺序走完五步:
- 想清楚:用哪条命令能验证这件事?
- 用
Bash完整、重新跑一遍(不是翻旧输出)。 - 读完整输出和退出码。
- 确认输出确实支撑你要说的结论。
- 此时才能说结论,并附上证据。
禁止的偷懒
- 用"应该好了"代替真的跑测试。
- 验证前就先表达满意/松口气。
- 不独立确认,直接信子 agent 的汇报。
- 部分验证后外推全部(只跑了一个用例就说"都过了")。
- 任何"暗示成功但没真跑验证"的措辞。
红旗——停
- 有信心但拿不出证据。
- 累了,想"就这一次直接说完成吧"。
- "这么小的改动肯定没问题"。
违反这条规则的字面,就是违反它的精神——换个说法绕过去不算例外。
验证常驻服务 / web 应用
服务器、watch、daemon 这类永不退出的进程,不能用前台 Bash 跑(会一直阻塞到超时,还甩出孤儿进程)。正确套路:
- 后台启动:
Bash传run_in_background: true,拿到句柄 id(形如 bash_1)。 - 等就绪再探活:服务不会立刻起来。用
BashOutput(id)读输出,确认监听成功(或日志出现 ready);别一启动就探,太早会连接被拒、误判成"坏了"。 - 真探活:用前台
Bash跑curl -s localhost:<port>(或对应健康检查),读响应内容,确认是预期的,而不是看见进程起来了就说"完成"。 - 收尾:
KillBash(id)结束,释放端口。验证完不 kill 会留下孤儿、占住端口。
"服务起来了" ≠ "应用好使了"。没经过第 3 步拿到真实响应,就不算验证过。
适用范围
提交前、提 PR 前、宣布任务完成前,以及任何关于工作状态的正面陈述。
为什么:假的完成声明会摧毁信任,逼得别人花时间复查、返工、纠偏——比一开始就老实验证贵得多。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 54 lines · 60 tokens per session scan A 3b0059a3249c
verification-before-completion is a skill published in the GitHub repository itmisx/deepx-code (383 stars, last pushed 7d ago), licensed MIT. It adds 60 tokens to every session and 732 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ai-style
当任务是用中文撰写或改写面向读者的文案（产品发布稿、公众号文章、邮件、README 等）， 或用户反馈文字「AI 味太重」「不像人写的」时，加载本 Skill。.
writing
将共享历史中的已验证事实和计算结果整理成符合受众、格式与长度约束的成稿。.
data_analysis
基于已确认数据执行可审计的数学计算和描述统计。.
pr-comments
Use when the user asks to review pull request comments, or when the /pr-comments command runs — fetch and analyze PR review comments on the current branch and summarize actionable items.
review
Use when asked to review a codebase or a change, or when the /review command runs — assess design, correctness, maintainability, and test coverage with actionable feedback.
dsh-doc-site-sync
Use when publishing, updating, moving, or removing DeepSeek Harness documentation website pages; editing website/docs.ts mappings or navigation; diagnosing a page missing from the VitePress site; fixing projected documentation links; or running the docs:dev, docs:check, and doc-sync workflow after website-content…