Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jinzhongjia/decky-music --skill pending-verify-issuegit clone --depth 1 https://github.com/jinzhongjia/decky-musicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jinzhongjia/decky-music/pending-verify-issue)<a href="https://agentmods.dev/skills/jinzhongjia/decky-music/pending-verify-issue"><img src="https://agentmods.dev/badge/skills/jinzhongjia/decky-music/pending-verify-issue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jinzhongjia/decky-music/pending-verify-issue"><img src="https://agentmods.dev/badge/skills/jinzhongjia/decky-music/pending-verify-issue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.00784 |
| Opus 5 | $0.00039 | $0.00392 |
| Sonnet 5 | $0.00015 | $0.00157 |
| Haiku 4.5 | $0.00008 | $0.00078 |
Grade A, and why
pending-verify-issue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
待验证登记(pending-verify issue)
AGENTS.md 要求运行时/UI 行为在真机 gamescope 会话验收。部署未获授权或用户明确要求
先提交时,不得把改动描述成已完成或已验证;创建 issue 记录剩余验收。真机操作见
decky-dev skill。
何时用
仅在以下两点同时成立时使用:
- 改动影响 player 出声、UI 视觉/文案/布局/手柄焦点、异常纵深或日志内容。
- 当前无法完成真机验收:未获重新部署授权,或用户要求先提交/推送。
纯文档、无运行时表现的内部重构、或已经完成真机验收时,不要创建。
怎么做
- 确认代码已提交,取得 commit 短 hash。
- 用下面模板创建 issue;清单只保留本次改动涉及的
AGENTS.md验收项。 - 回复 issue 链接,明确写“已提交,真机验证待做”,不要写成已验收。
- 验证后勾完清单、附真机截图并关闭 issue。UI 视觉变更还要更新
docs/ui-design/assets/device-screenshots/,并提示重新渲染展示图。
模板
gh issue create --title "待验证:<一句话说清验的是什么>(真机)" --body "$(cat <<'EOF'
关联提交:<shorthash> `<commit subject>`
## 背景
<改了什么、为什么、修复前后的行为差异。已过的检查(单测/tsc/lint)也写上,并点明"未在真机验证"。>
## 待验证(真机 / gamescope 会话)
<按需保留,删掉不相关项>
- [ ] 复现触发条件:<怎么制造这个场景>
- [ ] player 出声正常 / `ldd` 只动态依赖 libasound(涉及音频时)
- [ ] 目标 UI 出现预期表现(中/英各看一次)
- [ ] 注错误 / 杀后端 / 畸形数据 / 断网:Steam UI 不崩不冻,手柄焦点正常
- [ ] 日志符合预期,且不含任何敏感信息(URL/cookie/凭证)
- [ ] 恢复正常态后行为回归
## 复现办法
<制造该场景的具体步骤>
## 验收标准
上述全部勾选;UI 变更附真机截图。验证完关闭本 issue。
EOF
)"
红线
- issue body 同样遵守日志红线:不写任何 URL(限时 token)/ cookie / 凭证。
- 在验证真正做完前,别在提交信息、PR、回话里把改动写成"已验证/已验收"。
- issue 只是"欠条",不是替代验证。能当场验就当场验,别为了省事而开 issue 拖着。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 61 lines · 77 tokens per session scan A 419a255046a0
pending-verify-issue is a skill published in the GitHub repository jinzhongjia/decky-music (119 stars, last pushed 8d ago), licensed MIT. It adds 77 tokens to every session and 784 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scaffold-dotnet-test-project
MUST USE when an existing .NET test project was excluded from a .slnf/CI solution filter, disappeared from .sln/.slnx discovery, or lost its production ProjectReference; also for requests to set up, create, reuse, add, register, include, or repair a test project. Handles "tests pass directly but CI discovers zero"…
cy-execute-task
Implement and verify an existing CompozyOS spec task, then update its tracking. Excludes review remediation.
team-qa
Orchestrate the QA team through a full testing cycle. Coordinates qa-lead (strategy + test plan) and qa-tester (test case writing + bug reporting) to produce a complete QA package for a sprint or feature. Covers: test plan generation, test case writing, smoke check gate, manual QA execution, and sign-off report.
gh-issue
Size-audit, write, and split BanyanDB issues that somebody else or an automated TDD workflow can implement. Use whenever the user asks to file or revise an issue, decide whether an issue is too large, make an issue TDD-ready, turn a design into tickets, or split an umbrella into executable leaves. Do not draft or file…
implement-feature
Implement an approved feature plan with fresh-context slices, TDD, evidence, and PR-ready output.
conductor-implement
Execute tasks from a track's implementation plan following TDD workflow.