Borrowing it
Nothing to install: this file belongs to maxgfr/conforme. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/maxgfr/conforme/main/.agents/skills/verify-providers/SKILL.mdgit clone --depth 1 https://github.com/maxgfr/conformeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/maxgfr/conforme/verify-providers)<a href="https://agentmods.dev/skills/maxgfr/conforme/verify-providers"><img src="https://agentmods.dev/badge/skills/maxgfr/conforme/verify-providers/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/maxgfr/conforme/verify-providers"><img src="https://agentmods.dev/badge/skills/maxgfr/conforme/verify-providers.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.04218 |
| Opus 5.5 | $0.00018 | $0.01687 |
| Sonnet 5.5 | $0.00009 | $0.00844 |
| Haiku 4.5 | $0.00004 | $0.00422 |
Grade A, and why
verify-providers scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
while read -r u; do printf '%s %s\n' "$(curl -sS -o /dev/null -w '%{http_code}' -A 'Mozilla/5.0' --max-time 60 -L "$u")" "$u"; done < urls.txt | sort | grep -v '^200' How it starts
The opening of the file, as written. The whole thing — 329 lines — stays where its author put it; the contents beside it link to each section on GitHub.
conforme duplicates one source config into every tool and switches a project from one tool to another. This audit proves that each tool, as it ships today, loads what conforme writes for it.
The ground truth is online. A fact counts only with a proof URL: a vendor
page, changelog entry or source file opened during this run, with a short
quote (or file:line for source). This repository's docs/providers/, the
adapter code, earlier audits and memory are the claims under test, never
evidence. A claim no fetched page backs is unconfirmed: list it, never fix
on it.
The audit is exhaustive when every registered adapter has a fact sheet in which every line carries a proof URL, every drift is merged with a regression test, and every copy of every skill matches its source.
Work in a worktree. Run the full gate before touching anything so a failure later is attributable to the audit:
cargo test && cargo clippy --all-targets -- -D warnings && cargo fmt -- --check && cargo run --release -- check
1. Inventory the adapters
The registry is the source of truth, never a list written in this file:
grep -n 'Box::new' src/adapters/mod.rs
git log -1 --format='%as %s' --grep='verify-providers\|match upstream' # date of the last audit
Done when: one audit row exists per registered adapter, the date of the last
audit is known, and the adapter count matches README.md ("Supported tools
(N)" and "to N-1 others"), src/cli.rs (long_about) and CLAUDE.md
(project overview and Skills section).
2. Find what changed upstream
Start from the web, not from docs/providers/: the first question is what
moved since the last audit. For each adapter:
- Search.
WebSearch(modestandard;extendedwhen results are thin, old or the tool is niche) for the product name with "changelog", "release", "renamed", "deprecated" and the current month. A rename, a fork, a shutdown or a new major version shows up here first. - Changelog. Open the release notes (vendor page, or
gh release list -R <owner>/<repo>andgh release view) and read every entry since the last audit for config paths, frontmatter keys, MCP keys, instruction files, reserved names, trust rules. - New pages. Find the docs pages the provider doc does not list yet.
scripts/uncited_pages.sh . <scratch dir>reads every vendor's docs index (llms.txtorsitemap.xml) and lists the on-topic pages no provider doc cites; a search restricted to the vendor's domain (allowed_domains) covers what an index misses. Keep a page only if it documents a format conforme reads or writes, or a CLI command that shows what the tool loads, and only after opening it; add it to the provider doc's official docs.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · -2 lines 0b83201b7461
- 11d ago Changed · +3 lines 212e3d29c747
- 18d ago Changed · +115 lines · -4 tokens per session 0525e5f72c1c
- 25d ago Changed · +13 lines d35ed30e3f00
- 27d ago Changed · +28 lines ea8346ddce47
- 1mo ago Changed · +105 lines · +30 tokens per session 0b6d0f6059f3
- 1mo ago Changed · +3 lines 8550c563c739
- 1mo ago First seen · 64 lines · 18 tokens per session scan A 315a6c819b80
verify-providers is a skill published in the GitHub repository maxgfr/conforme (5 stars, last pushed 6d ago), licensed MIT. It adds 44 tokens to every session and 4,218 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
project-spine
Use when the user mentions AGENTS.md, CLAUDE.md, copilot-instructions, Cursor rules, project brief, context for coding agents, agency kickoff, onboarding a new project, or asks "how do I set up Project Spine". This is the orientation skill — reach for it FIRST when the user's intent involves Project Spine, then chain…
project-spine-kickoff
Use when the user wants to set up Project Spine for a new project — phrases like "new client project", "kickoff", "create AGENTS.md from scratch", "generate agent instructions for this repo", "set up project context". Runs spine init → edits brief → spine compile → reviews outputs. For stale files use…
project-spine-drift
Use when the user mentions drift, says AGENTS.md / CLAUDE.md / copilot-instructions / Cursor rules are "stale" or "out of date", asks about CI catching docs drift, or says "check if my spine is still current". Runs spine drift check, interprets each drift category, and guides resolution. For initial setup use…
project-spine-rationale
Use when the user wants to review, polish, or share the generated Project Spine rationale file locally. Phrases like "show the project rationale", "send the client a project summary", "review rationale.md", or "make the client-facing overview safer".
project-spine-template
Use when the user wants to apply a bundled, user-local, or project-local template to a new project, or save the current project as a reusable template. Phrases like "use our agency starter", "save this as a template for future clients", "apply the shared saas-marketing starter".
project-spine-workspace
Use when the user asks about Project Spine hosted workspaces, team sync, shared workspace templates, invites, or commands such as spine login, spine workspace, spine publish, or spine drift check --push.