Comet is a resumable workflow and skill platform for coding tasks, covering requirements work as well as skill creation, evaluation, and release. It supports separate Native and Classic workflows and can coordinate implementation and verification across isolated Git worktrees. The catalogue contains skills and instructions that implement Comet-related workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rpamis/comet --skill comet-verifygit clone --depth 1 https://github.com/rpamis/cometWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rpamis/comet/comet-verify)<a href="https://agentmods.dev/skills/rpamis/comet/comet-verify"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rpamis/comet/comet-verify"><img src="https://agentmods.dev/badge/skills/rpamis/comet/comet-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.04887 |
| Opus 5.5 | $0.00012 | $0.01955 |
| Sonnet 5.5 | $0.00006 | $0.00977 |
| Haiku 4.5 | $0.00003 | $0.00489 |
Grade A, and why
comet-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Comet 阶段 4：验证（Verify）
收到入口返回的 layout 后，按 comet-classic/reference/classic-layout.md 确定各逻辑根对应的目录。当前上下文已有这份协议时，无需重复加载。本文件中的 OpenSpec CLI 调用均通过适配器执行，文件路径均基于已绑定的 <classic-*> 根目录，无需先额外运行 root show。
前置条件
- 代码已提交（阶段 3 完成）
- tasks.md 全部任务已完成
步骤
0a. 设置输出语言
验证报告使用本轮入口返回的 configuration.language，不再单独查询语言字段。
0b. 入口状态验证（Entry Check）
按 comet-classic/reference/scripts.md 使用正式支持的 comet CLI，执行以下入口验证。从任意入口恢复任务时，先按 comet-classic/reference/context-recovery.md 检查恢复状态：
comet state select <change-name>
comet state check <change-name> verify --json
上一阶段 guard 已成功返回本阶段状态信息时，直接使用其中的状态与 agent.continuation 继续，不重复 select/check；恢复任务、工作区变化或外部状态变化时，才执行上述入口验证。根据入口返回的 layout、configuration、nextAction、任务信息和协作进度摘要继续。已有检查结果和集成审查仍然有效时，只补未完成的工作，不重新执行整个阶段。丢失上下文后恢复任务，需要完整记录时，使用 --recover --details --json。验证失败时，处理返回的具体原因。
若上述 select / check 输出 BLOCKED 或分支绑定 ERROR，且原因是 bound_branch 与当前分支不一致，立即按 comet-classic/reference/decision-point.md 暂停，让用户单选：切回绑定分支后重新运行入口验证，或在用户明确确认当前分支应接管该 change 后运行 comet state rebind <change-name> 并重新入口验证。不得自行切换分支，不得自行换绑。
按已记录结果继续：verify_result 已为 pass 时，进入 archive；在归档提交和最终分支处理完成前，branch_status 保持 pending。verify_result 为 pending 时，先核对已有报告和检查结果，再从未完成的检查继续。
丢失上下文后恢复任务时，按 evidence.scopes 处理：标记为 revalidated 的本地结果可以复用；标记为 rerun-required 的部分需要重新检查。已经完成且仍然有效的需求分析与审查，不重复执行。外部检查不能假定具有幂等性，也不能假定其环境一直不变。
1. 改动规模评估
执行规模评估：
comet state scale <change-name>
脚本统计任务数、增量规格数和变更文件数，只返回 light/full 建议，不修改 verify_mode。使用 --json 读取 data.recommendation、data.selected 和 data.metrics。已有验证模式时保留；尚未选择时，根据风险确定模式，再用 comet state set <change-name> verify_mode <light|full> 明确记录。满足以下任一条件时，规模评估建议 full：任务数 > 3、delta spec 能力数 > 1、变更文件数 > 8。
comet state scale 会自行从 plan 的 base-ref 解析提交基线，并在 plan 不可用时回退到状态中的 base_ref；Verify 不再重复读取 plan frontmatter 或手工拼接第二套规模评估。
验证开始前，按 comet-classic/reference/dirty-worktree.md 协议检查并处理未提交改动。verify 阶段的特殊处理：
- 未提交改动明确属于当前 change 时，将这些改动纳入本次验证；继续验证，但不在 verify 阶段修改或提交实现、测试、tasks、delta spec 或 Design Doc。纯文档编辑（comet-build 定义的中性文档集：仓库根目录的 Markdown 与
LICENSE/NOTICE/AUTHORS，以及docs/、doc/、documentation/、.github/下的 Markdown/.txt/.rst，OpenSpec 与 Superpowers 产物除外）可以在 verify 阶段正常完成——它们不是实现写入，默认不作废检查证据，也不需要verify-fail - 未提交改动只是 verify 本阶段的产物时，例如验证报告草稿，可以继续在 verify 阶段完成并记录状态
- 未提交改动表明代码已经实现、但 tasks.md 尚未勾选时，说明 build 的任务记录落后于实现；直接运行
verify-fail返回 build，核对已有结果并更新任务状态，不得询问是否接受未完成任务 - 无法确认未提交改动的归属，或改动属于其他 change 时，按 dirty-worktree 协议说明为何需要停止；不要在尚未确定归属时让用户选择“继续/忽略”
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · -2 lines 9bcc8cfe26a5
- 28d ago Changed · +4 lines fe6a00e0d92d
- 1mo ago Changed · +15 lines · +1 tokens per session 6575852e30bc
- 1mo ago Changed · -10 lines a024d6bc8b36
- 1mo ago First seen · 223 lines · 29 tokens per session scan A 73935e7a09e7
comet-verify is a skill published in the GitHub repository rpamis/comet (3,206 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 4,887 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
feature-verify
Feature verification (READ-ONLY, P0-P5). Use when: verifying feature behavior after deployment, validating API responses, diagnosing production issues, post-deploy smoke test. Not for: modifying data (use feature-dev), code review (use codex-review-fast), writing tests (use codex-test-gen), security audit (use…
test-health
Holistic test coverage measurement. Use when: assessing test health, measuring coverage trends, quantitative + qualitative test audit. Not for: running tests (use verify), reviewing test sufficiency only (use codex-test-review), generating tests (use codex-test-gen). Output: multi-dimensional dashboard with coverage…
test-review
Test coverage review via Codex exec. Use when: reviewing test sufficiency, identifying coverage gaps, test quality audit. Not for: generating tests (use codex-test-gen), code review (use codex-code-review). Output: coverage analysis + gap report.
post-dev-test
Post-development test completion. Use when: checking test coverage after feature-dev, writing missing integration/e2e tests. Not for: unit test generation (use codex-test-gen), test review (use test-review). Output: test files + coverage report.
pre-pr-audit
Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…
test-deep
Context-aware test orchestration. Use when: smart test selection, failure triage, progressive test ladder, test failure analysis. Not for: writing tests (use post-dev-test), reviewing tests (use codex-test-review), generating tests (use codex-test-gen), full manual run (use verify). Output: test results + triage…