Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add objectstack-ai/objectstack --skill verifygit clone --depth 1 https://github.com/objectstack-ai/objectstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/objectstack-ai/objectstack/verify)<a href="https://agentmods.dev/skills/objectstack-ai/objectstack/verify"><img src="https://agentmods.dev/badge/skills/objectstack-ai/objectstack/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/objectstack-ai/objectstack/verify"><img src="https://agentmods.dev/badge/skills/objectstack-ai/objectstack/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00548 |
| Opus 5.5 | $0.00011 | $0.00219 |
| Sonnet 5.5 | $0.00006 | $0.00110 |
| Haiku 4.5 | $0.00003 | $0.00055 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Verifying metadata-admin designer changes (no backend needed)
The console ships a dev-only gallery that renders every registered metadata
designer (packages/app-shell/src/views/metadata-admin/previews/*) with
representative sample drafts, in edit mode, with zero backend:
cd apps/console && pnpm exec vite --port <free-port> --strictPort
# open http://localhost:<free-port>/preview-gallery.html
# isolate one designer: /preview-gallery.html?only=flow (or ?only=dashboard, page, …)
Sample drafts live in apps/console/src/preview-samples.ts (keyed by metadata
type: flow, workflow, object, …). Server-driven affordances (e.g. the
flow palette's GET /api/v1/automation/actions) fail fetch and fall back to
their hardcoded defaults — that IS the offline path, not an error.
Driving it headlessly
The chrome-devtools MCP may lack a Chrome binary in remote sessions. Use the
repo's own Playwright instead — the pre-installed executable is the stable
alias /opt/pw-browsers/chromium. ⛔ Never copy the versioned
chromium-NNNN/chrome-linux/chrome spelling out of a probe: the alias is what
survives an image bump, and a dead versioned path reads as "no browser here"
when the browser is in fact present.
import { chromium } from '@playwright/test';
const browser = await chromium.launch({ executablePath: '/opt/pw-browsers/chromium' });
Gotcha: a driver script must live inside the repo (e.g.
node_modules/.drive.mjs — ignored by git) so Node resolves
@playwright/test; a script in /tmp won't resolve workspace deps.
Useful selectors: cmdk internals are addressable via [cmdk-item],
[cmdk-group-heading], [cmdk-empty], [cmdk-item][data-selected="true"];
flow canvas node cards match .group.absolute.
Cleanup: kill only the vite server you started (kill $(lsof -ti tcp:<port>)).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 51 lines · 28 tokens per session scan A 97c3545bb9d7
verify is a skill published in the GitHub repository objectstack-ai/objectstack (76 stars, last pushed today), licensed Apache-2.0. It adds 28 tokens to every session and 548 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other skills, from other repositories
next-cache-components-optimizer
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route and entry point at a time; the shipped test then guards…
next-partial-prefetching-optimizer
Optimize what selected Next.js client navigations include before the click under Partial Prefetching. Use after Cache Components and Partial Prefetching are adopted when the user wants selected URL-specific UI to be instant, wants reusable content to wait for navigation, or needs to choose between default, viewport…
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).
verify-bug
Post-merge UAT verification workflow. Walks JIRA reproduce steps, performs comparative audits (Before/After), attaches evidence to JIRA, and transitions status on PASS.
verify-work
Verify feature, bug, UI, API, mobile, security, or deployment work against acceptance criteria.
test-loop
Plan, generate, and heal an executable E2E test suite from approved acceptance criteria (web and mobile).