Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nxtg-ai/forge-plugin --skill verify-governancegit clone --depth 1 https://github.com/nxtg-ai/forge-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nxtg-ai/forge-plugin/verify-governance)<a href="https://agentmods.dev/skills/nxtg-ai/forge-plugin/verify-governance"><img src="https://agentmods.dev/badge/skills/nxtg-ai/forge-plugin/verify-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nxtg-ai/forge-plugin/verify-governance"><img src="https://agentmods.dev/badge/skills/nxtg-ai/forge-plugin/verify-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02666 |
| Opus 5.5 | $0.00038 | $0.01066 |
| Sonnet 5.5 | $0.00019 | $0.00533 |
| Haiku 4.5 | $0.00009 | $0.00267 |
Grade A, and why
verify-governance scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Read, Grep, Glob, Bash(grep:*), Bash(jq:*), Bash(git:*), Bash(cat:*), Bash(curl:*) How it starts
The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify Governance Skill
Adjudicates a governance concern by reading the actual source, comparing it to what was flagged, and returning an evidence-backed verdict: JUSTIFIED (proceed) or REVERT.
This is the manual/adjudication front end for the same concern class the governance-verifier
agent handles automatically. Use this skill for a quick in-session ruling; delegate to the
agent when the concern needs its own isolated context.
When to Use
- A Forge advisory hook printed a warning during an Edit/Write (
GOVERNANCE: N violation(s)). - You changed a test assertion and need to prove it matches the implementation.
- You suspect a change drifted outside the current directive scope.
- The user asks "is this justified?" / "should I revert this?".
What the hooks actually emit (ground truth)
hooks/scripts/governance-check.sh is a PostToolUse (Edit/Write) advisory hook — it
always exits 0 and never blocks. It only runs on source paths (*/src/*, .ts/.tsx/.js/.jsx/.py/.rs/.go),
skips test files (*.test.*, *.spec.*, *__tests__*), and flags four categories:
| Tag | Rule | Message fragment |
|---|---|---|
[ANY] |
as any cast in production code |
N 'as any' cast(s) at line(s): ... |
[API] |
unwrapErr() call |
use .error property |
[LOG] |
uncommented console.log |
use structured logger |
[URL] |
hardcoded localhost:PORT |
use env config |
It also appends a WARN entry (category: code-quality, severity: medium) to
.claude/governance.json sentinelLog via append_sentinel_log. That is the entire blast
radius — there is no blocking, no test-mismatch detector, and no scope detector in this hook.
Test-mismatch and scope concerns are your judgment call or the agent's, grounded in the steps below.
Procedure
Step 1 — Identify the concern
Read back the exact hook line or user claim. Pin down:
- File + line(s) named in the flag.
- Concern class:
code-quality(the four tags above),test-mismatch, orscope-creep. - The specific assertion (e.g. "test expects
undefined, code returnsnull").
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +14 lines 78366e66ca81
- 1mo ago First seen · 194 lines · 94 tokens per session scan A c8f1f8d1ac32
verify-governance is a skill published in the GitHub repository nxtg-ai/forge-plugin (6 stars, last pushed 4d ago), licensed MIT. It adds 94 tokens to every session and 2,666 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ork-assess
Assess a code change, design, architecture, workflow, or competing options against explicit criteria and evidence. Use when a request asks to assess, rate, compare, identify trade-offs, evaluate readiness, or decide whether an approach is good enough. Do not use for a full pull-request review or to implement a chosen…
crap-analyzer
Use to produce a risk-based refactor + test plan for recently-changed code on a diff/branch/PR by computing CRAP (complexity × untested) on changed methods. Multi-language — TypeScript, JavaScript, Python, Java, Kotlin, Go, Ruby, C#, Rust, PHP — auto-discovers how the repo generates coverage. Triggers …
reviewer-architect-adversarial
Adversarial plan review — structural validation and assumption attack on grill artifacts before implementation begins.
review-loop
Two-mode review loop — single reviewer per epic, three reviewers for full branch.
code-quality-review
Reviews code and plans against the project's coding rules.
reviewer-handoff
Structured review summary format with verdict logic and coverage scoring.