verification-loop

verification-loop is a skill for Claude Code, Codex from mshadmanrahman/pm-pilot. It costs 18 tokens per session (633 once invoked), scanned A, original, MIT.

A pre-commit quality-check workflow that detects a project’s tools and runs checks for code style, types, tests, security, and coverage.

In plain words
What is it for?
Use it after implementation or when preparing a commit or pull request in JavaScript, Python, Go, or Rust projects.
Why use it?
It catches common problems before code is committed or submitted in a pull request.

Skill for Claude CodeCodex

Part of the pm-dev plugin — 4 skills, 4 commands, 3 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mshadmanrahman/pm-pilot/verification-loop
Any agent
npx skills add mshadmanrahman/pm-pilot --skill verification-loop
Clone the repo
git clone --depth 1 https://github.com/mshadmanrahman/pm-pilot

Made for: Claude Code, Codex.

Or install pm-dev, the plugin that ships this one along with the rest of its 4 skills, 4 commands, 3 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verification-loop

README.md
[![agentmods](https://agentmods.dev/badge/skills/mshadmanrahman/pm-pilot/verification-loop.svg)](https://agentmods.dev/skills/mshadmanrahman/pm-pilot/verification-loop)
Your own site
<a href="https://agentmods.dev/skills/mshadmanrahman/pm-pilot/verification-loop"><img src="https://agentmods.dev/badge/skills/mshadmanrahman/pm-pilot/verification-loop.svg" alt="Measured on agentmods" height="20"></a>
Per session 18 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 633 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00018 $0.00633
Opus 5 $0.00009 $0.00316
Sonnet 5 $0.00004 $0.00127
Haiku 4.5 $0.00002 $0.00063

Measured 4d ago against content hash 817704b196f5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

verification-loop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/pm-dev/skills/verification-loop/SKILL.md · 96 lines

How it starts

The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verification Loop

Run all quality gates before committing or creating a PR.

When to Use

  • Before any git commit
  • Before creating a pull request
  • After completing implementation (before marking done)
  • When asked to "verify" or "check everything"

Procedure

Step 1: Detect Project Type

Identify available tools from project files:

  • package.json: npm/yarn scripts (lint, typecheck, test)
  • pyproject.toml / setup.py: Python tooling (ruff, mypy, pytest)
  • go.mod: Go tooling (golangci-lint, go vet, go test)
  • Cargo.toml: Rust tooling (clippy, cargo test)

Step 2: Run Quality Gates

Execute in order (stop on CRITICAL):

Gate Command (detect per project) Severity
Lint eslint, ruff, golangci-lint HIGH
Type Check tsc --noEmit, mypy, go vet HIGH
Tests jest, pytest, go test CRITICAL
Security npm audit, pip-audit, cargo audit CRITICAL
Coverage jest --coverage, pytest --cov HIGH

Step 3: Report Results

Verification: {project name}

  Lint:       PASS | FAIL ({count} issues)
  Types:      PASS | FAIL ({count} errors)
  Tests:      PASS | FAIL ({pass}/{total})
  Security:   PASS | FAIL ({count} vulnerabilities)
  Coverage:   {percent}% (target: 80%)

Verdict: READY TO COMMIT | BLOCKED ({reason})

Step 4: Actionable Fixes

For each failure, provide:

{gate} FAIL:
  {file}:{line} - {error message}
  Fix: {specific suggestion}

Blocking Rules

  • CRITICAL failures block commit (tests failing, known vulnerabilities)
  • HIGH failures: warn but allow commit with acknowledgment
  • MEDIUM/LOW: report only, do not block

Output Format

Verification: lead-scoring-simulator

  Lint:       PASS
  Types:      PASS
  Tests:      PASS (24/24)
  Security:   PASS
  Coverage:   87% (target: 80%)

Verdict: READY TO COMMIT

Rules

  • Always run tests with verbose output
  • Kill any hung processes after 120s timeout
  • If a gate tool is not installed, skip it with a warning
  • Never auto-fix lint issues without showing what changed
  • Clean up test artifacts after run

Read the full file on GitHub · 96 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 96 lines · 18 tokens per session scan A 817704b196f5

Subscribe to this mod's changes

verification-loop is a skill published in the GitHub repository mshadmanrahman/pm-pilot (19 stars, last pushed 14d ago), licensed MIT. It adds 18 tokens to every session and 633 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

feature-spec

Creates a complete product feature specification with acceptance criteria, scope, dependencies, and risks. Delegates to the Prometeo (PM) agent.

davepoon/buildwithclaude · 32 tokens

gmgn-dev-score

Decide whether a token creator's NEXT launch is safe to buy. Scores a dev address 0-100 on two separate axes — CONDUCT (will he dump on you at open) and POWER (has he ever actually built anything big) — from his full launch history and every trade he made in his own coins, then returns a buy / don't-buy call with a…

GMGNAI/gmgn-skills · 529 tokens

decided-import

Reformat ONE existing document (a decision, requirement, design, roadmap, or prompt) into ONE valid RAC (requirements-as-code) artifact, with a mandatory human-review step before any file is written and decided validate as the deterministic close. Use when a user wants to add or import a single existing decision or…

asdecided/core · 98 tokens

orch

AI agent orchestrator — manage teams of AI agents that work on your codebase in parallel. Use when the user wants to: run multiple agents, coordinate AI work, deploy agent teams, manage tasks/goals/agents, check orchestrator status, or mentions 'orch', 'orchestry', 'agents team', 'agent orchestration'.

oxgeneral/ORCH · 71 tokens

image

Extract text from images using a vision LLM.

axoviq-ai/synthadoc · 11 tokens

pipefy-relations

Use this skill when the user wants to link pipes, tables, or cards across workflows — creating or managing pipe relations, table relations, or card relations. Covers 8 MCP tools.

pipefy/ai-toolkit · 42 tokens