Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ReinaMacCredy/maestro --skill verify-maestrogit clone --depth 1 https://github.com/ReinaMacCredy/maestroWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/reinamaccredy/maestro/verify-maestro)<a href="https://agentmods.dev/skills/reinamaccredy/maestro/verify-maestro"><img src="https://agentmods.dev/badge/skills/reinamaccredy/maestro/verify-maestro/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/reinamaccredy/maestro/verify-maestro"><img src="https://agentmods.dev/badge/skills/reinamaccredy/maestro/verify-maestro.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00896 |
| Opus 5.5 | $0.00024 | $0.00358 |
| Sonnet 5.5 | $0.00012 | $0.00179 |
| Haiku 4.5 | $0.00006 | $0.00090 |
Grade A, and why
verify-maestro scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
verify-maestro
Built from maestro recipe show verification-skill. Proves a change on an
installed runtime without touching the owner's ~/.maestro or ~/.local/bin.
Launch
scripts/journey.sh <checkout> creates /tmp/maestro-verify.XXXX with its own
home/ and an empty git repo, then runs bun <checkout>/bin/maestro.ts install
under env -i with that HOME and a PATH of the scratch shim dir, bun, and
/usr/bin:/bin. MAESTRO_SESSION_ID/MAESTRO_SESSION_PID are pinned so every
call is one session; without them each call is a new anonymous session and
work done fails with LEASE_HELD.
Doctor
maestro version must print the checkout's commit, and maestro doctor must
report healthy, source: ok <checkout>, and the shim pointing into the
scratch HOME. A missing seat token and unverified Codex hooks are expected in
the scratch HOME.
Drive
Add one block to scripts/journey.sh per journey the change touches, invoking
maestro exactly as a user types it. The script already drives:
- recipe catalog:
recipe listshows the recipe,recipe showprints it. - playbooks: 25 playbook and method recipes listed, bug-fix's steps shown,
the retired
workrecipe refused;~/maestro/PRINCIPLES.mdhas 24 sections; nine skills; the ten new agent renders; no PreToolUse hook. - brief and grant: the SessionStart
method:line routes by playbook; thedelivery grant:line appears only whilepolicy-auto-pris enabled. - bundle check: a fresh bundle's U1 skeleton is reported and exits 1.
- a policy gate:
plugin enable,work add|start|doneblocked, then passing. - reinstall: a second install keeps the repository's policy choices.
Capture
Run scripts/journey.sh <checkout> > "$(maestro topic path verify-maestro)/journey-<n>.txt".
Each step prints its command output and [exit N]; read the exit codes, not
only the text. Cite the transcript path and the checkout commit in the proof,
tagged (journey).
Clean up
The script removes its scratch root last. The transcript in the topic folder is the proof and stays.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 74 lines · 59 tokens per session scan A 274aa42c2760
verify-maestro is a skill published in the GitHub repository ReinaMacCredy/maestro (235 stars, last pushed 6d ago), licensed MIT. It adds 59 tokens to every session and 896 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
flow-next-qa
Live-app QA pass derived from the spec. Drives the running app, files P0/P1/P2 findings with evidence, emits a YES or NO qaverdict receipt.
atmos-tests
Author Atmos smoke tests, post-deployment stack checks, and integration tests using type: test, HTTP assertions, shell or script/interpreter checks, require gates, parallel dependencies, matrix cases, and lifecycle hooks. Use for test suites in Atmos configuration, not Go unit tests of Atmos itself.
modernize-test-starter
Modernize QUnit unit tests and OPA5 integration tests to the UI5 Test Starter concept. Use this skill when: The linter reports prefer-test-starter for .qunit.html or .qunit.js files Test HTML files use manual sap-ui-core.js bootstrapping instead of Test Starter's runTest.js/createSuite.js Test JS files use…
ui5-best-practices-opa5
This skill should be used in any OPA5 task - creating, modifying, extending, debugging, fixing or reviewing an integration test. Use when the user asks to "write an OPA5 test", "add an OPA5 journey", "fix the OPA5 test failure" or mentions OPA5 or its components - opaTest, page object, journey, waitFor.
hatch3r-qa-validation
E2E validation workflow producing a structured pass/fail report with evidence. Use when running QA validation, acceptance testing, verifying releases, or working on QA E2E validation issues.
eval-integration
Specialized integration evaluator for the Evaluate-Loop. Use this for evaluating tracks that integrate external services — Supabase auth/DB, Stripe payments, Gemini API, third-party APIs. Checks API contracts, auth flows, data persistence, error recovery, environment config, and end-to-end flow integrity. Dispatched…