Borrowing it
Nothing to install: this file belongs to Totoro-jam/battle-tested-patterns. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Totoro-jam/battle-tested-patterns/main/.claude/skills/verify-source/SKILL.mdgit clone --depth 1 https://github.com/Totoro-jam/battle-tested-patternsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/totoro-jam/battle-tested-patterns/verify-source)<a href="https://agentmods.dev/skills/totoro-jam/battle-tested-patterns/verify-source"><img src="https://agentmods.dev/badge/skills/totoro-jam/battle-tested-patterns/verify-source/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/totoro-jam/battle-tested-patterns/verify-source"><img src="https://agentmods.dev/badge/skills/totoro-jam/battle-tested-patterns/verify-source.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00890 |
| Opus 5.5 | $0.00012 | $0.00356 |
| Sonnet 5.5 | $0.00006 | $0.00178 |
| Haiku 4.5 | $0.00003 | $0.00089 |
Grade A, and why
verify-source scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify Source Links
You are verifying production proof links in this repository. This is the most critical quality check — every pattern's credibility depends on accurate, live source links.
Steps
1. Run automated link check
pnpm verify-links
This scans all docs/**/*.md and root README.md/README.zh-CN.md files, extracts GitHub URLs, and checks:
- HTTP status (with automatic retry on 5xx)
- Whether Production Proof links include line numbers (
#L18-L22) - Whether links use SHA permalinks vs branch names
- Whether any
#L1file-level links exist in Production Proof
Output categories:
✅ [proof]— valid Production Proof link with line numbers✅ [other]— valid non-Production-Proof link⚠️ [proof]— Production Proof link missing line numbersℹ️— branch-based link (not SHA permalink)❌— broken link (HTTP error)
For CI mode (exit 1 on broken links): pnpm verify-links -- --ci
2. Convert branch links to SHA permalinks
If the report shows branch-based links, convert them:
tsx scripts/convert-to-sha-links.ts --dry-run # preview changes
tsx scripts/convert-to-sha-links.ts # execute conversion
Authentication: prefers gh auth token (system keyring), falls back to GITHUB_TOKEN env var.
3. Verify line-range content
For links that pass HTTP checks, verify that the referenced code lines actually match the pattern:
pnpm verify-lines # Check all Production Proof links
pnpm verify-lines --pattern <name> # Check a single pattern
pnpm verify-lines --verbose # Show all results including passes
pnpm verify-lines --section all # Also check "More Production Uses" section
pnpm verify-lines --no-cache # Re-fetch everything (ignore cache)
This script performs two layers of verification:
- L1: Range validity — checks that line numbers are within file bounds
- L2: Keyword presence — checks that pattern-related keywords appear in the referenced code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 96 lines · 31 tokens per session scan A e85a511582ee
verify-source is a skill published in the GitHub repository Totoro-jam/battle-tested-patterns (343 stars, last pushed 1mo ago), licensed MIT. It adds 31 tokens to every session and 890 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golang
Idiomatic Golang design patterns — functional options, constructors, error flow and cascading, resource management and lifecycle, graceful shutdown, resilience, architecture, dependency injection, data handling, streaming, and more. Apply when explicitly choosing between architectural patterns, implementing functional…
Effective Memory
The essential habits for an AI agent with memory — session bookends, learning triggers, verification, safety, and the operational discipline that turns raw recall into compounding intelligence. Keyword-matched after installation.
go-idioms
Go idioms and patterns: stdlib conventions, explicit error wrapping (%w), small interfaces, goroutines/channels concurrency, table-driven tests, and gofumpt formatting. Use when writing, refactoring, or reviewing Go services and packages.
evm-rpc
Query EVM JSON-RPC methods for transaction debugging and endpoint triage, including ethgetTransactionReceipt and debugtraceTransaction. Use when the user asks to inspect tx status, retrieve receipts, run tracers, compare EVM vs Cosmos outcomes, or choose between EVM RPC and Comet RPC endpoints.
gh-pr-review
Review GitHub pull requests for correctness, design quality, test coverage, security, performance, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".
tailscale-serve
Troubleshoot, document, and operate Tailscale Serve for local development previews, HTTPS .ts.net URLs, MagicDNS, admin-console HTTPS certificate setup, WSL or localhost proxy targets, phone testing over a tailnet, and curl/OpenSSL diagnosis of Serve TLS failures. Use when a user says Tailscale Serve, tailscale serve…