runtime-verify

A code-checking workflow that verifies a change by running the real application and observing its user-facing behavior. It uses the interface where the change is meant to work, rather than calling code directly.

In plain words
What is it for?
Use it to verify command-line tools, terminal interfaces, servers, APIs, and graphical applications after code changes. It also helps identify the full set of changes that need checking.
Why use it?
It avoids treating passing tests or type checks as proof that users can use the changed feature. You get evidence from the application actually running the affected path.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/subhansh-dev/agent-maxxing/runtime-verify
Any agent
npx skills add subhansh-dev/agent-maxxing --skill runtime-verify
Clone the repo
git clone --depth 1 https://github.com/subhansh-dev/agent-maxxing

Made for: Claude Code, Codex.

Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 883 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00027 $0.00883
Opus 5 $0.00014 $0.00441
Sonnet 5 $0.00005 $0.00177
Haiku 4.5 $0.00003 $0.00088

Measured yesterday against content hash be9f274f1799, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

runtime-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

engineering/runtime-verify/SKILL.md · 96 lines

How it starts

The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Runtime Verify — Run It, Don't Test It

Extracted from Claude Code's bundled verify skill.

Verification is runtime observation. Build the app, run it, drive it to where the changed code executes, and capture what you see. That capture is your evidence. Nothing else is.

Don't run tests. Don't typecheck. Running them proves you can run CI — not that the change works.

Don't import-and-call. import { foo } from './src/...' then console.log(foo(x)) is a unit test you wrote. The app never ran. Go to the real interface.

Find the change

Establish the full range of what changed:

git log --oneline @{u}..              # count commits
git diff @{u}.. --stat                # full range
git diff origin/HEAD... --stat        # no upstream
git diff HEAD --stat                  # uncommitted

The diff is ground truth. Any description is a claim about it. Read both. If they disagree, that's a finding.

Surface

The surface is where a user meets the change. That's where you observe.

Change reaches Surface You
CLI / TUI terminal type the command, capture the output
Server / API socket send the request, capture the response
GUI pixels drive it, screenshot
Library package boundary sample code through the public export
Prompt / agent config the agent run the agent, capture its behavior

Internal function? Not a surface. Something in the repo calls it and that caller ends at one of the rows above. Follow it there.

Drive it

Smallest path that makes the changed code execute:

  • Changed a flag? Run with it.
  • Changed a handler? Hit that route.
  • Changed error handling? Trigger the error.
  • Changed an internal function? Find the CLI command / request / render that reaches it.

The verdict is table stakes. Your observations are the signal. A PASS with three sharp "hey, I noticed..." lines is worth more than a bare PASS.

End-to-end, through the real interface. Pieces passing in isolation doesn't mean the flow works. If users click buttons, test by clicking buttons.

Read the full file on GitHub · 96 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 96 lines · 27 tokens per session scan A be9f274f1799

Subscribe to this mod's changes

runtime-verify is a skill published in the GitHub repository subhansh-dev/agent-maxxing (2 stars, last pushed 1mo ago), licensed MIT. It adds 27 tokens to every session and 883 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.