Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nWave-ai/nWave --skill nw-dor-validationgit clone --depth 1 https://github.com/nWave-ai/nWaveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nwave-ai/nwave/nw-dor-validation)<a href="https://agentmods.dev/skills/nwave-ai/nwave/nw-dor-validation"><img src="https://agentmods.dev/badge/skills/nwave-ai/nwave/nw-dor-validation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nwave-ai/nwave/nw-dor-validation"><img src="https://agentmods.dev/badge/skills/nwave-ai/nwave/nw-dor-validation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 20 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.01083 |
| Opus 5.5 | $0.00012 | $0.00433 |
| Sonnet 5.5 | $0.00006 | $0.00217 |
| Haiku 4.5 | $0.00003 | $0.00108 |
Grade A, and why
nw-dor-validation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DoR Validation and Antipattern Detection
Definition of Ready Checklist (8 Items - Hard Gate)
All items must PASS with evidence. Each FAIL blocks handoff.
Item 1: Problem Statement Clear and Validated
Domain language (not technical), describes real user pain, testable. Pass: "Maria wastes 30 seconds typing credentials on every visit" Fail: "Users need authentication" | "Implement login feature"
Item 2: User/Persona with Specific Characteristics
Real name, specific role, clear context. Pass: "Maria Santos, returning customer (2+ orders), using trusted MacBook" Fail: "User" | "Customer" | "End user" | "Authenticated user"
Item 3: At Least 3 Domain Examples with Real Data
Min 3 examples, real names (not user123), real values, different scenarios (happy/edge/error). Pass: "Example 1: Maria on MacBook, 5 days since login, goes to dashboard" Fail: "User logs in successfully" | "Test with valid credentials"
Item 4: UAT Scenarios Cover Happy Path + Edge Cases
Given/When/Then format, 3-7 scenarios, real data, covers happy + edge. Pass: "Given Maria authenticated on 'MacBook-Home' 5 days ago..." Fail: "Test login works" | "Given a user When they login Then success"
Item 5: Acceptance Criteria Derived from UAT
Checkable (checkbox), traceable to UAT, outcome-focused (not implementation). Pass: "Sessions older than 30 days require re-authentication" Fail: "Use JWT tokens" | "System should work correctly"
Item 6: Story Right-Sized (1-3 Days, 3-7 Scenarios)
Effort estimate provided, scenario count in range, single demonstrable outcome. Pass: 2 days, 5 UAT scenarios, demoed in single session Fail: >7 scenarios | >3 days | multiple distinct outcomes
Item 7: Technical Notes Identify Constraints
Dependencies listed, risks identified, architectural considerations noted. Pass: "Requires JWT token storage, GDPR cookie consent integration" Fail: no technical notes section
Item 8: Dependencies Resolved or Tracked
Blocking deps identified, resolution status clear, escalation path. Pass: "Depends on US-041 (completed) and Auth service API (available)" Fail: "Needs some API - TBD"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 101 lines · 29 tokens per session scan A 9378bddc4ad2
nw-dor-validation is a skill published in the GitHub repository nWave-ai/nWave (620 stars, last pushed 1mo ago), licensed MIT. It adds 29 tokens to every session and 1,083 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
parallel-feature-development
Coordinate parallel feature development with file ownership strategies, conflict avoidance rules, and integration patterns for multi-agent implementation. Use this skill when decomposing a large feature into independent work streams, when two or more agents need to implement different layers of the same system…
track-management
Use this skill when creating, managing, or working with Conductor tracks - the logical work units for features, bugs, and refactors. Applies to spec.md, plan.md, and track lifecycle operations.
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
moai-workflow-worktree
Git worktree management for parallel SPEC development with isolated workspaces, automatic branch registration, and seamless MoAI-ADK integration. Use when setting up parallel development environments.
organize-task-files
Lists, pairs, deduplicates, and moves task files across the Coworker task state machine (0draft → 6git-pushed). Use when asked to organize, clean up, or audit task files.
project-execution
Executes implementation plans with progress tracking, checkpoint validation, and quality gates. Use after planning is complete and tasks are ready to implement.