Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/totoro-jam/battle-tested-patterns/verify-sourcenpx skills add Totoro-jam/battle-tested-patterns --skill verify-sourcegit clone --depth 1 https://github.com/Totoro-jam/battle-tested-patternsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/totoro-jam/battle-tested-patterns/verify-source)<a href="https://agentmods.dev/skills/totoro-jam/battle-tested-patterns/verify-source"><img src="https://agentmods.dev/badge/skills/totoro-jam/battle-tested-patterns/verify-source.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00890 |
| Opus 5 | $0.00015 | $0.00445 |
| Sonnet 5 | $0.00006 | $0.00178 |
| Haiku 4.5 | $0.00003 | $0.00089 |
Grade A, and why
verify-source scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify Source Links
You are verifying production proof links in this repository. This is the most critical quality check — every pattern's credibility depends on accurate, live source links.
Steps
1. Run automated link check
pnpm verify-links
This scans all docs/**/*.md and root README.md/README.zh-CN.md files, extracts GitHub URLs, and checks:
- HTTP status (with automatic retry on 5xx)
- Whether Production Proof links include line numbers (
#L18-L22) - Whether links use SHA permalinks vs branch names
- Whether any
#L1file-level links exist in Production Proof
Output categories:
✅ [proof]— valid Production Proof link with line numbers✅ [other]— valid non-Production-Proof link⚠️ [proof]— Production Proof link missing line numbersℹ️— branch-based link (not SHA permalink)❌— broken link (HTTP error)
For CI mode (exit 1 on broken links): pnpm verify-links -- --ci
2. Convert branch links to SHA permalinks
If the report shows branch-based links, convert them:
tsx scripts/convert-to-sha-links.ts --dry-run # preview changes
tsx scripts/convert-to-sha-links.ts # execute conversion
Authentication: prefers gh auth token (system keyring), falls back to GITHUB_TOKEN env var.
3. Verify line-range content
For links that pass HTTP checks, verify that the referenced code lines actually match the pattern:
pnpm verify-lines # Check all Production Proof links
pnpm verify-lines --pattern <name> # Check a single pattern
pnpm verify-lines --verbose # Show all results including passes
pnpm verify-lines --section all # Also check "More Production Uses" section
pnpm verify-lines --no-cache # Re-fetch everything (ignore cache)
This script performs two layers of verification:
- L1: Range validity — checks that line numbers are within file bounds
- L2: Keyword presence — checks that pattern-related keywords appear in the referenced code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 96 lines · 31 tokens per session scan A e85a511582ee
verify-source is a skill published in the GitHub repository Totoro-jam/battle-tested-patterns (340 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 890 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golang
Idiomatic Golang design patterns — functional options, constructors, error flow and cascading, resource management and lifecycle, graceful shutdown, resilience, architecture, dependency injection, data handling, streaming, and more. Apply when explicitly choosing between architectural patterns, implementing functional…
Effective Memory
The essential habits for an AI agent with memory — session bookends, learning triggers, verification, safety, and the operational discipline that turns raw recall into compounding intelligence. Pinned, always-injected.
go-idioms
Go stdlib, error wrapping, interfaces, goroutines, table-driven tests, gofumpt.
workflow-branch-sync
Sync the current branch with the default branch via rimba or git, then resolve conflicts file by file with a per-hunk rationale and a keep-mine / keep-main / manual recommendation before staging. Push only happens after explicit confirmation — never automatic.
workflow-pr-review
Use when reviewing a remote GitHub PR — a first-pass peer review, or a followup re-check after the owner has addressed feedback. Fetches into an ephemeral worktree, runs the reviewer agent against the updated diff with a Review Decision footer instruction, deduplicates findings against existing review threads (±5-line…
workflow-address-feedback
Use when a PR owner wants to address review feedback — fetches outstanding threads and general comments, presents a per-item triage (ADDRESSED / CLARIFIED / DEFERRED), applies fixes via the Edit tool, commits via workflow-commit-and-pr, resolves review threads via GraphQL resolveReviewThread (those without a thread…