Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-verifygit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-verify)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-verify"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-verify"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00550 |
| Opus 5.5 | $0.00022 | $0.00220 |
| Sonnet 5.5 | $0.00011 | $0.00110 |
| Haiku 4.5 | $0.00006 | $0.00055 |
Grade A, and why
x-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
x-verify · Gate ①
输入
task 的 dev-checklist.md、归属 spec.md 和 dev-report*.md fenced verify 块。req2 按 Requirement 限定验收 Scenario；req3 直接按 Scenario 限定范围。引擎复跑命令、比较 exit/输出并检查当前 task 的证据覆盖。
流程
- 运行
python3 tools/xdev.py verify <task-dir> --json。 - exit 0：输出
pass N / manual M回执，不写报告。 - exit 1：读取 fail 的
output_tail与 uncovered，必要时用--only <id>复跑一个块；写reports/verify/verify-report-<timestamp>.md，将完整 failure 清单交 x-fix。 - exit 2：按错误来源分诊，不递增 fix-counter。
- dev-report 的 verify 块格式、id 冲突、
cwd路径问题 → 退回 x-dev。 dev-checklist.md缺失或表头不可解析 → 退回对应 x-req2/x-req3。- req2 Scenario 缺父 Requirement 或验证标记 → 退回 x-spec2。
- req3 Scenario 缺测试层、名称重名或 checklist 回指悬空 → 退回 x-spec3/x-req3。 这两类是 task / spec 产物的问题，退给 x-dev 无从下手。
- dev-report 的 verify 块格式、id 冲突、
约束
- 只报告命令与覆盖事实；代码质量由 x-qa-gate 处理。
- fail 时跑完全部 auto 块后一次交付完整清单。
- req3 的 unit/smoke Scenario 必须由 auto 块覆盖；e2e Scenario 必须由 auto 或 manual 块声明。
reports/.fix-counter、三轮上限和 x-fix 批量修复协议保持现有定义。
回执
🛡️ Gate① verify ✅ · pass N · manual M 待人工
🛡️ Gate① verify ❌ · fail N · uncovered M → x-fix
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines e59ac0ba49b0
- 2mo ago First seen · 33 lines · 55 tokens per session scan A 868a5b2eae3e
x-verify is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 17d ago), licensed MIT. It adds 55 tokens to every session and 550 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-audit
Audit test suites for T1-T4 violations using AST analysis, mock detection, and multi-stage synthesis. Invoke when user asks to audit tests, check test quality, find mock violations, review test effectiveness, or inspect test suites for over-mocking. Triggers automatic rewrites when quality gates fail.
holdout-validation
Cross-reference agent self-review claims and evidence-bundle entries against actual file state using hidden holdout scenarios, producing P1/P2/P3 findings mapped to visible acceptance criteria only. Checks that every expected value in the tests has the source the bundle claims and that every risk-map row has a…
review
Holistic review of all changes — correctness, consistency, style, test coverage. Runs tests, checks console, verifies integration. Returns pass/fail report.
pocket-planning
Converts a pocket-grinding spec into a TDD-structured execution plan of full Pocket Packets. Use when pocket-grinding handoff arrives (spec path + acceptance criteria). Trigger on "create plan", "build plan", "pocket-planning", or when pocket-grinding skill invokes this. Outputs tasks ready to dispatch via…
validate-plan
Validate implementation plans against DRY, YAGNI, TDD principles and best practices. Use when reviewing plans from pocket-planning or another planning workflow to identify gaps, anti-patterns, and improvement opportunities before execution.
coding-standards
Quality gates, prohibited patterns, verification discipline, and self-audit rules for all code generation and review sessions.