Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nifrajs/nifra --skill nifra-verifygit clone --depth 1 https://github.com/nifrajs/nifraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nifrajs/nifra/nifra-verify)<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-verify"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nifrajs/nifra/nifra-verify"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/nifra-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.00883 |
| Opus 5 | $0.00047 | $0.00441 |
| Sonnet 5 | $0.00019 | $0.00177 |
| Haiku 4.5 | $0.00009 | $0.00088 |
Grade A, and why
nifra-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nifra: the gates
Nifra turns "did you do this right" into build failures. The gates exist so an agent can check its own work instead of asserting success. Run them; do not route around them.
The done-gate
nifra check --json # or the nifra_check MCP tool
nifra check typechecks the frontend/backend contract and flags drift: a hand-rolled fetch() at
this app's own API, a server-only import inside routes/, a client call whose route changed shape.
Findings carry the fix.
A failing check means the work is not done. Do not suppress a finding, widen a type, or add a cast to make it pass. If a finding is genuinely wrong for this codebase, say so explicitly to the person you are working for rather than quietly silencing it.
nifra doctor is the other half: environment and build-state problems (stale dist/, duplicate
framework install, misconfigured adapter) that make correct code behave wrongly.
Security evidence per route
$ nifra assure
✖ POST /notes (authenticated-write) is missing nifra.authenticated
A policy file classifies every route by reflection, then assure fails CI naming exactly which
evidence is absent: authentication on a write, a rate limit, CSRF, a body cap. When you add a route,
you add its evidence in the same change. When assure names a gap, add the real control - never
reclassify the route to make the requirement disappear.
Effect provenance
Routes declare the effects they perform:
app.post("/notes", { capabilities: ["db.write"] }, handler)
nifra capabilities check compares what a route declares against what its module graph can
actually reach, pinned in a lockfile. A GET that can reach a domain write is an error.
The common cause of a surprise failure is a barrel file: importing one helper from ./lib drags the
whole module graph's reach into the route. The fix is to narrow the import, not to widen the
declaration.
Deploy promotion
nifra manifest diff emits one hash-verified artifact - contracts, assurance, effects, response
sensitivity - and fails closed on a breaking contract change, lost assurance, or a newly exposed
sensitive field. Run it between environments, not just at merge.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 91 lines · 94 tokens per session scan A b8be68dcadf4
nifra-verify is a skill published in the GitHub repository nifrajs/nifra (3 stars, last pushed 7d ago), licensed MIT. It adds 94 tokens to every session and 883 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
verify
Check a completed change with the project's own Bun scripts before reporting success.
llm-as-judge-evaluation
Evaluate LLM outputs using frontier models as judges. Use for pairwise model comparison, quality scoring with custom rubrics, and automated evaluation pipelines. Covers position bias mitigation, statistical significance, and generating preference data for DPO/RLHF.
horse-integration-tests
Guide for writing automated integration tests for Horse endpoints using DUnit/DUnitX and THTTPClient.
om-module-scaffold
Build a complete standalone business app, module, or CRUD vertical slice using Open Mercato discovery, commands, APIs, ACL/setup, UI, events, search, migrations, and tests. Use for customer management, deal-pipeline changes, CRM lead capture, library/booking/rental systems, "create a module", "add CRUD entity"…
red-team-review
Unified adversarial review: v4.3 Strategic Matrix (MTA-004). 7-phase framework: Priors → Rubric → Adversarial Lenses → SWOT/TOWS → MCDA Decision Engine → Blind Spot/Kill Switch → Executive Summary. Absorbs: bias-detector.
om-troubleshooter
Diagnose and fix standalone Open Mercato bugs across scope, commands, locking, fields, generated registries, UI hydration, cache/search, bootstraps, queues, and providers. Use for "fix bug", "why does this fail", "regression", "debug", "napraw błąd", or a failing test.