agentic-kit: Skill for Claude Code

.agents/skills/ak-verify/SKILL.md

ak-verify is a skill for Claude Code, Codex from pacphi/agentic-kit. It costs 78 tokens per session (1,921 once invoked), scanned A, original, MIT.

A completion checklist for an Agentic Kit change that runs selected tests and project checks before the work is called done. It reports each check as passed, failed, or skipped.

In plain words
What is it for?
Use it before committing or handing work to review to run focused tests, type checks, linting, builds, documentation checks, and dashboard interface checks.
Why use it?
It prevents a change from being marked complete without checking the relevant test environment, code quality, documentation, build, and interface requirements.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions CLAUDE.md; mentions Claude Code; installed under .agents/ (shared by several agents).

This is pacphi/agentic-kit's own configuration. It tells Claude Code and Codex how to work on agentic-kit itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything agentic-kit configures →

Reuse

Borrowing it

Nothing to install: this file belongs to pacphi/agentic-kit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/pacphi/agentic-kit/main/.agents/skills/ak-verify/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/pacphi/agentic-kit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ak-verify

README.md
[![agentmods](https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-verify/github.svg)](https://agentmods.dev/skills/pacphi/agentic-kit/ak-verify)
Your own site
<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-verify"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-verify/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ak-verify

Your own site · 80×15
<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-verify"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 78 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,921 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00078 $0.01921
Opus 5.5 $0.00031 $0.00768
Sonnet 5.5 $0.00016 $0.00384
Haiku 4.5 $0.00008 $0.00192

Measured 23d ago against content hash 436af7ed0186, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ak-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/ak-verify/SKILL.md · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Verify before completion

When to use

Work in this repository is about to be called finished, committed or handed to review. Run this first and report from it; a claim of "done" without this list is not a claim.

Preflight

  1. git rev-parse --show-toplevel, git branch --show-current and git status --short. Note the commit under test. Run git worktree list: if this checkout is one another session uses (its branch is checked out there, or the maintainer says so), run read-only checks only and say so.
  2. Check the environment: env | grep -E '^(FORCE_COLOR|AQE_EMBEDDER_|XDG_)'. The runner deletes FORCE_COLOR itself, but not AQE_EMBEDDER_* or XDG_*, and checks outside the runner get none of that. Before any command below, unset FORCE_COLOR, unset AQE_EMBEDDER_*, and unset every relative XDG_* value. env -u takes literal names, not globs: take each name from the env | grep output and pass it as its own -u (for example env -u FORCE_COLOR -u AQE_EMBEDDER_X -u XDG_STATE_HOME <command>). An XDG value is relative when it does not start with /. Also note which keys of INHERITED_STATE_KEYS in tests/kit/helpers/home-sandbox.mjs are set (CLAUDE_FLOW_DB_PATH can point at the real Ruflo store); step 5 unsets them for anything that runs ak.
  3. In a worktree, node_modules must be a link to the main checkout's (ls -ld node_modules). If it is missing, stop and ask the maintainer to set it up; do not create it or install anything. Mark every check that needs it skipped, with that reason.

Steps

  1. Focused tests first, for the files the change touches: node scripts/run-tests.mjs focus <test files>. Add tests/kit/docs-layout.test.mjs when any Markdown or docs/ file changed; scripts/docs-layout.mjs is a module, not a command. That test is only the layout half of the docs gate: for a change to code or docs, finish with ak-docs-gate for the alignment half.
  2. Static checks, each reported on its own. In a main checkout use pnpm run typecheck, pnpm run lint, pnpm run lint:cc, pnpm run lint:md and pnpm run build. In a worktree run the same checks without pnpm: node_modules/.bin/tsc -p tsconfig.json, node_modules/.bin/eslint ., node_modules/.bin/eslint src bin --rule 'complexity: [2, 50]', node_modules/.bin/markdownlint with the globs of the lint:md script in package.json, and node scripts/build-check.mjs. For a change to docs, also run lint:links:internal (a lychee --offline script in package.json); with no lychee, it is skipped.
  3. Full unit suite for a non-trivial change: node scripts/run-tests.mjs unit (what pnpm test runs). The runner fingerprints real user state before and after. Its exit code is the failing command's own code first, otherwise 2 (unsafe temp base such as one inside a git repository or the home directory, failed run-owner or hold setup, or bad usage), 3 (real user state changed) or 4 (temporary folders left behind); each lists the paths. An exit 3 or 4 is a FAIL reported with the listed paths, not retried or cleaned up. "Concurrent writers" lines are files a live Claude Code, Ruflo or AQE session wrote during the run; they do not fail a local run (CI and AK_TRIPWIRE_STRICT=1 do fail on them). Report them as a note, and never as a pass over a nonzero exit.
  4. Dashboard or UI changes add node scripts/run-tests.mjs ui (pnpm run test:ui in a main checkout) and a screenshot of the changed view, saved under the scratchpad or a disposable folder, never in the repository. It passes when the view renders the change without errors. Needs Chrome; if it cannot launch, it is skipped.
  5. Anything that runs ak for real uses a disposable home. Create the folder outside any git repository and not directly under ~: mktemp -d "${TMPDIR:-/tmp}/ak-verify.XXXXXX" makes it (the template form is needed because macOS mktemp -d ignores TMPDIR without one), then mkdir <folder>/home. Read INHERITED_STATE_KEYS in tests/kit/helpers/home-sandbox.mjs: the keys that point a child at real per-user state, CLAUDE_FLOW_DB_PATH among them. HOME is set, not unset; pass every key in that list other than HOME as its own -u (unsetting a key that is not set is harmless). Run as env -u XDG_CONFIG_HOME -u XDG_STATE_HOME -u XDG_DATA_HOME -u XDG_CACHE_HOME -u <each other key> HOME=<folder>/home <command>. Run <command> from a folder inside the disposable folder, never from a checkout: ak writes into the project it runs in (.claude, .mcp.json, CLAUDE.md, AGENTS.md) whatever HOME is. So mkdir <folder>/proj, run git init in that subfolder and cd into it first; the disposable folder itself stays outside any repository. Only the assertion below runs from the repository root, since it reads tests/kit/helpers/home-sandbox.mjs. Before any ak write, assert HOME and every XDG path resolve under the disposable folder: from the repository root, with that same env prefix, run node --input-type=module -e "import os from 'node:os';import {INHERITED_STATE_KEYS as K} from './tests/kit/helpers/home-sandbox.mjs';console.log(os.homedir());for(const k of K)console.log(k,process.env[k]??'(unset)')". Stop if os.homedir() or HOME is outside the folder or any other key prints a value. Leave the folder for the maintainer to remove by its literal path.
  6. When a check fails, read the failure, fix the cause in code you own and rerun that check and every check after it. Never edit a test to make it pass or loosen a threshold.

Read the full file on GitHub · 99 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 23d ago First seen · 99 lines · 78 tokens per session scan A 436af7ed0186

Subscribe to this mod's changes

ak-verify is a skill published in the GitHub repository pacphi/agentic-kit (61 stars, last pushed yesterday), licensed MIT. It adds 78 tokens to every session and 1,921 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.