check-post

A checker for blog posts that verifies their frontmatter, which is the metadata at the top of a post, and their placement in the project.

In plain words
What is it for?
Use it to check changed blog posts, validate their metadata, detect outdated Quarto files, and re-render them when needed.
Why use it?
It catches missing or invalid post information and warns when a source file has not been rendered into the version used by the website.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/posit-dev/open-source-website/check-post
Any agent
npx skills add posit-dev/open-source-website --skill check-post
Clone the repo
git clone --depth 1 https://github.com/posit-dev/open-source-website

Made for: Claude Code, Codex.

Per session 10 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 943 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00010 $0.00943
Opus 5 $0.00005 $0.00472
Sonnet 5 $0.00002 $0.00189
Haiku 4.5 $0.00001 $0.00094

Measured 2d ago against content hash f193e9d1bf32, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

check-post scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/check-post/SKILL.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Run the blog post validation script and help the user fix any issues found.

Step 1: Identify the post

If the user provided a path in their request, use that. Otherwise, look for blog posts changed on the current branch:

git diff --name-only --diff-filter=d origin/main...HEAD -- 'content/blog/**/index.md' 'content/blog/**/index.qmd'

If no changed posts are found, ask the user which post to check.

Step 2: Check for unrendered .qmd files

For each post directory found, check if an index.qmd exists. If it does, check whether index.md also exists and is newer than index.qmd:

# For each post directory
if [ -f index.qmd ] && { [ ! -f index.md ] || [ index.qmd -nt index.md ]; }; then
  echo "index.qmd has not been rendered to index.md (or is out of date)"
fi

If any .qmd files need rendering, warn the user and always offer to re-render — even if there is no computational environment setup. To render:

quarto render <path>/index.qmd

.qmd posts may need to render through a specific environment — check the post folder for a pyproject.toml, renv.lock, or similar, and use whatever tool the author set up. See the "Setting up an environment" section of content/blog/_authoring-guide.md for context.

Do not proceed with validation until index.md exists and is up to date for all posts.

Step 3: Run validation

The validation script reads index.md files (not .qmd):

uv run scripts/validate-blog-posts.py <paths to index.md>

Step 4: Report results

If all checks pass, say so and stop.

If there are issues, summarize them clearly grouped by severity:

  • Errors need fixing before the post can be published.
  • Warnings are worth reviewing but won't block publishing — and some are reasonable to leave alone (see below).

For each error, explain what's wrong and suggest a concrete fix. For example:

  • Missing topics → suggest values from data/topics.yaml that fit the post content
  • Unknown software → check if there's a close match in content/software/. If there isn't one, offer to create a new software page using scripts/create-new-software.py.
  • Unknown people → check if there's a close match in content/people/. If there isn't one, offer to create a new people page.
  • Missing source on a ported post → suggest setting it to match ported_from
  • categories present → replace with topics

Read the full file on GitHub · 88 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 88 lines · 10 tokens per session scan A f193e9d1bf32

Subscribe to this mod's changes

check-post is a skill published in the GitHub repository posit-dev/open-source-website (50 stars, last pushed 3d ago), licensed MIT. It adds 10 tokens to every session and 943 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

agent-host-chat-contributions

Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.

microsoft/vscode · 56 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens