Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add qarium/goga --skill goga-prototype-plan-verificationgit clone --depth 1 https://github.com/qarium/gogaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qarium/goga/goga-prototype-plan-verification)<a href="https://agentmods.dev/skills/qarium/goga/goga-prototype-plan-verification"><img src="https://agentmods.dev/badge/skills/qarium/goga/goga-prototype-plan-verification/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qarium/goga/goga-prototype-plan-verification"><img src="https://agentmods.dev/badge/skills/qarium/goga/goga-prototype-plan-verification.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.00964 |
| Opus 5.5 | $0.00007 | $0.00386 |
| Sonnet 5.5 | $0.00003 | $0.00193 |
| Haiku 4.5 | $0.00002 | $0.00096 |
Grade A, and why
goga-prototype-plan-verification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
goga-prototype-plan-verification
Identity
You are responsible for verifying the created architecture plan and fixing the issues found.
Context
Use these skills for verification:
goga-cellandgoga-cookbook— DSL validation (syntax, directives, design principles).goga-codemanifest-base— base usages/annotations compliance.goga-lang-disp— language correctness (naming,locationfile names).
Use this artifact for its specific purpose:
[ARCHITECTURE_PLAN](at the path printed bygoga history path -f arch.md) — use it as the object of verification: its implementation order, per-cell CODEMANIFESTs and.usages/files, dependency map, and verification checklist, against which the DSL checks are run, failures are fixed in place, and the report is produced.
Workflow
Phase 1. Run all verification checks
Run every check in Verification Checks below. For each, record PASS/FAIL with evidence.
Phase 2. Fix failures
For each FAIL — fix the issue in the plan file and re-check.
Phase 3. Produce the report
Produce the [VERIFICATION_REPORT] (see Output Format).
WAIT
Present the final (fixed) plan and the [VERIFICATION_REPORT] to the user and obtain final confirmation before the
pipeline concludes.
- Confirmed → the pipeline is complete
- User requests changes → address the feedback, re-verify, and present again
Verification Checks
- Completeness — every type, method, property from the approved solution is present in the plan
- DSL correctness — all CODEMANIFESTs syntactically correct (keys, signatures, document structure)
- Inter-cell consistency — Imports reference existing cells, types match
- Implementation order — each cell created after all cells it depends on
- No placeholders — no TBD, TODO, or incomplete descriptions in the plan's CODEMANIFEST files
- Usage of Imports.Types — every imported type is used in the body (signatures, mutations, embeddings, annotations)
- Usage of Imports.Usages — every imported practice is mentioned in at least one annotation
- Usage of Usages — every practice declared in the
Usagesheader is mentioned in at least one annotation - Algorithms in annotations — annotations for routines and methods describe the operation algorithm if achievable
- Annotation wording — annotations do not contain technical implementation details
- Resolvability of references in annotations — every backtick reference resolves (signature variable, imported/declared type, Usages/Imports practice)
- Location restrictions — every
locationvalue is a file name with extension only, no directories, no escaping the current level - Absence of cross-imports — if cell A imports from cell B, cell B does not import from cell A
- Embedding from Imports — every embedded type (via
->) is available throughImports - Mutations from available types — base types in mutations (
Object::Target) are available (imported or declared) - Entity / Routine correctness — types with
methods/propertiesare Entities; types without are Routines and lack these sections - Base usages from configuration — each base practice is included in
Usagesof all CODEMANIFESTs and referenced in at least one annotation - Base annotations from configuration — base annotations are included in
Annotationsof all CODEMANIFESTs and contracts comply with them - Language correctness — type/method/property names comply with target-language conventions;
locationvalues have correct file names for the target language
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago First seen · 99 lines · 17 tokens per session scan A 7be22a44f109
goga-prototype-plan-verification is a skill published in the GitHub repository qarium/goga (43 stars, last pushed today), licensed BSD-3-Clause. It adds 17 tokens to every session and 964 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other skills, from other repositories
ci-troubleshoot
Diagnose failed GitHub Actions runs for pi-agent-dashboard: the 11-file workflow taxonomy, affected-test selection, the release pipeline, known failure modes, and how to read gh run logs and retrigger jobs. Use when a CI run is red, a release is stuck, a workflow won't dispatch, or you need to know which workflow does…
node-inspect-debugger
See runtime state a console.log cannot reach — set real breakpoints, step, and dump the scope chain of a paused Node/TypeScript process. Use on "set a breakpoint", "inspect runtime state", "console.log isn't enough", "step through this", "what's in this closure at runtime", "attach a debugger". Not a logging or…
performance-optimization
Measure-first performance work. Use on triggers like "it's slow", "profile this", "optimize perf", "fix the bottleneck", "improve load time / Core Web Vitals", or when a measured regression needs fixing. Enforces measure-before-optimize. Fills a perf gap not covered by existing project skills. Not a build/ship…
systematic-debugging
Root-cause a bug already in front of you, instead of guessing at fixes. Use on triggers like "root cause this", "why is this failing", "debug systematically", "this test is flaky", "it works locally but not in CI", or when a fix attempt has already failed once. Enforces a phased evidence-first process before any code…
debug-dashboard
Diagnose problems in the running pi-agent-dashboard system: server.log, /api/health, bridge WebSocket connectivity, vitest triage, known-issue FAQ entries. Routes UI/visual issues to the browser skill. Use when the server seems hung, a pi session won't connect, tests fail mysteriously, the dashboard shows a blank…
canvas-webapp
Render a React/Vite (or any bundled) web app on the pi-dashboard canvas, which loads loopback URLs in a sandboxed opaque-origin iframe. Use when a canvas(target:{kind:"url"|"server"}) target shows up blank white, an empty surface, or a /live/ 500 ECONNREFUSED. Covers why Vite dev servers and non-CORS static servers…