Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thiagolmoraes/leash/checknpx skills add thiagolmoraes/leash --skill checkgit clone --depth 1 https://github.com/thiagolmoraes/leashWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thiagolmoraes/leash/check)<a href="https://agentmods.dev/skills/thiagolmoraes/leash/check"><img src="https://agentmods.dev/badge/skills/thiagolmoraes/leash/check.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.00381 |
| Opus 5 | $0.00030 | $0.00191 |
| Sonnet 5 | $0.00012 | $0.00076 |
| Haiku 4.5 | $0.00006 | $0.00038 |
Grade A, and why
check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Run the local verification suite mirroring .github/workflows/ CI. All steps run on the host — no Lima VM needed.
-
Shellcheck on the scripts CI checks:
shellcheck tests/run_tests.sh agents/entrypoint.shAlso shellcheck any other
.shfile changed in the working diff. -
YAML validation on every changed/tracked YAML file:
python3 -c "import yaml,sys; yaml.safe_load(open(sys.argv[1]))" <file>At minimum:
proxy/policy.yaml,falco/rules.local.yaml,lima/agent-lab.yaml,docker-compose.ymlif changed. -
Compose validation (needs
.envpresent; copy from example if missing):[ -f .env ] || cp .env.example .env docker compose config --quietNote: if
dockeris unavailable on the host, skip and say so — CI covers it. -
Unit tests:
pytest tests/unit/ -vIf imports fail on missing deps:
pip install mitmproxy pyyaml pytestthen retry.
Report results as a short pass/fail list. If anything fails, show the exact error output and stop — do not auto-fix unless asked. Remind that make test (19-test integration suite in the VM) must still pass 19/19 before a PR.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 34 lines · 60 tokens per session scan A 9a6ab81dd946
check is a skill published in the GitHub repository thiagolmoraes/leash (5 stars, last pushed 1mo ago), licensed MIT. It adds 60 tokens to every session and 381 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ci-fix
Scan all CI builds and tests, find failures, fetch error logs, and fix the code. Prioritizes unit tests, example tests, then uno, attiny85, esp32s3, esp32c6, teensy41. Use when CI is red and you need to diagnose and repair build/test failures.
cloudflare-workers-testing
Comprehensive testing guide for Cloudflare Workers using Vitest and @cloudflare/vitest-pool-workers. Use for test setup, binding mocks (D1/KV/R2/DO), integration tests, or encountering test failures, mock errors, coverage issues.
Code Coverage Analysis
Measure and enforce test coverage with Istanbul/nyc, c8, Jest, and Vitest. Covers branch versus line coverage, per-directory thresholds, CI gates, and correctly excluding generated code from reports.
testing-validation
Use when selecting, running, or fixing WorldForge validation: pytest, coverage, ruff, generated provider docs, MkDocs strict build, package contract, CI failures, and release gates. Produces the smallest credible command set first, then escalates to full validation when public behavior changes.
qa-ci-cd-testing
当需要把测试集成到 CI/CD 流水线中、或者现有流水线的测试环节跑起来效率低不可靠时使用此技能。覆盖流水线各阶段的分层测试卡点设计（提交检查→单元测试→接口测试→UI 测试→回归测试）、工具集成策略和质量门禁配置。不要在 CI 里堆满慢的 UI 测试——而是构建测试金字塔：提交阶段跑最快的（<5min），合码阶段跑核心的（<15min），夜间跑全量的。.
wordpress-testing-qa
WordPress plugin and theme testing with PHPUnit integration tests, WPMock unit tests, PHPCS coding standards, and CI/CD workflows.