Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ohswedd/praxis/runtime-verificationnpx skills add Ohswedd/praxis --skill runtime-verificationgit clone --depth 1 https://github.com/Ohswedd/praxisWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00157 | $0.01692 |
| Opus 5 | $0.00078 | $0.00846 |
| Sonnet 5 | $0.00031 | $0.00338 |
| Haiku 4.5 | $0.00016 | $0.00169 |
Grade A, and why
runtime-verification scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| An HTTP route or API | A request against a locally running server (`curl`, `httpie`, the project's client) | How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Runtime Verification
A green unit suite proves that a function returns what its test expects. It does not prove that the page renders, the route answers, the button submits, the migration applies, or the command exits zero. That gap is where a change passes every check and is still broken for the person who has to use it, and it is why "the tests pass" is the single most common true-but-useless sentence in a handover.
The rule: if a change alters something a person or another system interacts with, run that thing and observe the result before you call the work done.
Step 1: Decide what "running it" means here
Derive it from the project, never from habit. The question is always the same: what is the smallest real execution that would fail if this change were wrong?
| The change touches | Run |
|---|---|
| A page, component, or style | The app in a browser, on the route that renders it |
| An HTTP route or API | A request against a locally running server (curl, httpie, the project's client) |
| A CLI command or flag | The command itself, including its failure path and its --help |
| A background job, queue, or cron | The job, against a real (local) queue or a fake with the same contract |
| A migration or schema change | The migration forward, then backward, against a scratch database |
| A build, bundler, or CI change | The build, and check the artifact it produced |
| A library with no runnable surface | The test suite is the runtime check; say so rather than inventing one |
Step 2: Use the harness the project already has
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/config.py" status reports the
end-to-end harness praxis detected, and report.py runs it for you:
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/report.py" record \
--runtime "npm run e2e" --runtime-timeout 900 --verticals "..."
report.py executes the command and records the real exit code, exactly as it
does for the test suite. When the change touches user-facing files and the
project has a harness, the run is required and the report is not green without
it (gate.require_runtime).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 131 lines · 157 tokens per session scan A 3a78a01afdb2
runtime-verification is a skill published in the GitHub repository Ohswedd/praxis (1 stars, last pushed 1mo ago), licensed MIT. It adds 157 tokens to every session and 1,692 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
seo
Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine optimization".
core-web-vitals
Optimize Core Web Vitals (LCP, INP, CLS) for better page experience using field and lab evidence. Use when asked to "improve Core Web Vitals", "fix LCP", "reduce CLS", "optimize INP", "page experience optimization", or "fix layout shifts".
release
Cut a sim-use release end-to-end. Use when the user runs /release or asks to "ship a release", "publish a version", "cut a release", or "release to homebrew". Drives scripts/local-release.sh; never reimplement its build/sign/tarball logic.
agent-desktop-ffi
C-ABI bindings over agent-desktop's PlatformAdapter. Consumers (Python ctypes, Swift, Node ffi-napi, Go cgo, C++, Ruby fiddle) link libagentdesktopffi.{dylib,so,dll} and call ad functions directly instead of spawning the CLI binary per call. The canonical observe-act workflow is: adinit → adadaptercreate[withsession]…
Accessibility Auditor
Comprehensive WCAG 2.1 AA compliance testing combining automated axe-core scans with manual keyboard navigation, screen reader compatibility, and focus management verification.
GitHub Hub
Your intelligent GitHub command center -- start here. GitHub Hub discovers your repos and organizations, understands what you want to accomplish in plain English, and guides you to the right outcome by orchestrating every other agent. No commands to memorize. Just talk.