Borrowing it
Nothing to install: this file belongs to LedgerHQ/ledger-live. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/LedgerHQ/ledger-live/develop/.agents/skills/validate-changes/SKILL.mdgit clone --depth 1 https://github.com/LedgerHQ/ledger-liveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ledgerhq/ledger-live/validate-changes)<a href="https://agentmods.dev/skills/ledgerhq/ledger-live/validate-changes"><img src="https://agentmods.dev/badge/skills/ledgerhq/ledger-live/validate-changes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ledgerhq/ledger-live/validate-changes"><img src="https://agentmods.dev/badge/skills/ledgerhq/ledger-live/validate-changes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.01140 |
| Opus 5.5 | $0.00042 | $0.00456 |
| Sonnet 5.5 | $0.00021 | $0.00228 |
| Haiku 4.5 | $0.00011 | $0.00114 |
Grade A, and why
validate-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate Changes
Run every step from the repository root, in order, and fix what a step reports before the next one. A step that fails is fixed in the code, never by skipping a test, disabling a rule or adding an exception.
Compare against the point where the branch left develop, so the affected scope is the branch's
own work, uncommitted files included:
BASE=$(git merge-base origin/develop HEAD)
1. Format
Formatting is oxfmt, with the single repository config support/fmt/oxfmt.config.mts. Format
the changed and new files; the config already skips Markdown and the generated trees:
{ git diff --name-only --diff-filter=d "$BASE"; git ls-files --others --exclude-standard; } \
| xargs -r pnpm exec oxfmt --no-error-on-unmatched-pattern
The pre-commit hook (hk.pkl) runs oxfmt on staged sources too, so a commit never lands
unformatted, but formatting first keeps the next steps' diffs clean.
2. Lint
pnpm nx affected -t lint --base="$BASE"
Apply the automatic fixes of one project with pnpm nx run <project>:lint:fix, then rerun lint.
3. Typecheck
pnpm nx affected -t typecheck --base="$BASE"
An import error from another workspace package usually means its build is stale: see the
rebuild-to-fix-lib-import-errors skill.
4. Test
pnpm nx affected -t test --base="$BASE" --exclude=ledger-live-desktop
The desktop test target also runs Playwright end-to-end tests. When the desktop app is affected,
run its whole Jest suite instead: a change in a workspace dependency can break a desktop test
without touching a desktop file.
pnpm desktop test:jest
While iterating on app files, --findRelatedTests runs only the suites that import them. Paths are
relative to the app; a path passed without the flag filters test file names and finds no suite for a
source file.
pnpm desktop test:jest --findRelatedTests src/path/to/changed.ts
pnpm mobile test:jest --findRelatedTests src/path/to/changed.ts
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 121 lines · 106 tokens per session scan A 18e5b1f7d6b6
validate-changes is a skill published in the GitHub repository LedgerHQ/ledger-live (624 stars, last pushed yesterday), licensed MIT. It adds 106 tokens to every session and 1,140 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
Other skills, from other repositories
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
release-safety
Release safety rules. INVOKE WHEN: yarn release, npm publish, release canary, release packages, publishing, skip checks, skip tests. NEVER skip checks or tests without explicit permission.
ship
Pre-release gate. Run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.
safe-extraction
Apply when extracting code from a large monolith file into submodules. Covers barrel re-exports, internals DI seam proxy patterns, CI invariant allowlist updates, and cross-file test verification. Prevents CI failures, broken imports, and test regressions from code extraction.