Borrowing it
Nothing to install: this file belongs to jeffjjohnston/counterpoise-ledger. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jeffjjohnston/counterpoise-ledger/main/.claude/skills/verify/SKILL.mdgit clone --depth 1 https://github.com/jeffjjohnston/counterpoise-ledgerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jeffjjohnston/counterpoise-ledger/verify)<a href="https://agentmods.dev/skills/jeffjjohnston/counterpoise-ledger/verify"><img src="https://agentmods.dev/badge/skills/jeffjjohnston/counterpoise-ledger/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jeffjjohnston/counterpoise-ledger/verify"><img src="https://agentmods.dev/badge/skills/jeffjjohnston/counterpoise-ledger/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.00542 |
| Opus 5 | $0.00020 | $0.00271 |
| Sonnet 5 | $0.00008 | $0.00108 |
| Haiku 4.5 | $0.00004 | $0.00054 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maintainer setup — adapt paths for your fork. Container names are pinned by
name:indocker-compose.yml, so those are the same in every checkout.
Verifying Counterpoise changes at runtime
Launch
When the production Docker container (counterpoise-app-1) is running locally, it holds port 3000 and serves deployed code — not your working tree. Always run the dev server on another port so the two can't be confused:
PORT=3001 npm run dev # background it; ready when /login returns 200
The dev server uses the counterpoise_dev PostgreSQL database (Docker Compose must be up: docker compose up -d).
Login
Seeded dev credentials: username admin, password password (created by npm run db:seed). Log in at /login, then navigate to /b/1/transactions (seed book id is 1, "Family Finances").
Drive
- Playwright MCP tools (
mcp__plugin_playwright_playwright__browser_*) work well; load via ToolSearch first. - The transactions page redirects to a favorite account (
?accountId=N) on load. - Find target rows via
browser_evaluateovertbody tr; right-click withbrowser_click+button: "right"; the row actions menu is[role="menu"]with[role="menuitem"]children. The ⋯ overflow button isbutton[aria-label="Transaction actions"]. - Toasts auto-dismiss quickly — query for them within ~1s of the action (a
browser_evaluatethat clicks and then polls in the same call works).
Data
Pick target rows by querying the dev DB directly:
PGPASSWORD=counterpoise psql -h localhost -U counterpoise -d counterpoise_dev
Dev data is disposable seed data, but restore any rows you mutate (UPDATE back to original values) so repeat runs stay deterministic. Note: .env.production.local credentials + database counterpoise (no _dev) is the production DB — don't mutate it during verification.
Cleanup
Kill the dev server (pkill -f "next dev"), delete .playwright-mcp/ and stray screenshots from the repo root before committing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 45 lines · 41 tokens per session scan A 35fd4ad9681e
verify is a skill published in the GitHub repository jeffjjohnston/counterpoise-ledger (6 stars, last pushed 11d ago), licensed MIT. It adds 41 tokens to every session and 542 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
a11y-debugging
Uses Chrome DevTools MCP for accessibility (a11y) debugging and auditing based on web.dev guidelines. Use when testing semantic HTML, ARIA labels, focus states, keyboard navigation, tap targets, and color contrast.
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
browser-inspection-workflow
Coordinate rendered behavior and state evidence.
cross-browser-qa
Verify browser-engine compatibility.
dashboard-reporting
Use when the user needs dashboard reporting from authorized browser-accessible pages; use external browser automation for login/UI interaction and Axon for public scrape/screenshot captures or exported artifacts.
impeccable
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states.…