Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vscarpenter/gsd-task-manager/skill-snapshotnpx skills add vscarpenter/gsd-task-manager --skill skill-snapshotgit clone --depth 1 https://github.com/vscarpenter/gsd-task-managerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vscarpenter/gsd-task-manager/skill-snapshot)<a href="https://agentmods.dev/skills/vscarpenter/gsd-task-manager/skill-snapshot"><img src="https://agentmods.dev/badge/skills/vscarpenter/gsd-task-manager/skill-snapshot.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02335 |
| Opus 5 | $0.00000 | $0.01167 |
| Sonnet 5 | $0.00000 | $0.00467 |
| Haiku 4.5 | $0.00000 | $0.00233 |
Grade A, and why
verify-frontend-change scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
verify-frontend-change
Confirm a frontend change does what it's supposed to in the running app, not just in your head. The output is a PASS/FAIL verdict backed by evidence — never a confident guess.
This skill exists because two traps in this codebase silently turn verification into theater:
- The service worker serves stale JS chunks. You edit
border-l-4→border, reload, and still see the old UI. Your screenshot "confirms" code that isn't running. - Data surfaces render empty on a fresh load. The dashboard and matrix have nothing to show until tasks exist. A screenshot of an empty dashboard "confirms" a layout you never actually saw.
Either trap produces a false PASS — the most dangerous outcome, because it ends the investigation with the wrong answer. Everything below is built to make PASS mean something.
When to use
Use this after editing any .tsx/.jsx under components/ or app/, or any change that affects what the user sees or does — the matrix, capture bar, edit drawer, dashboard, settings, task cards. Reach for it before pushing or opening a PR on UI work.
Don't use it for backend/sync-only logic (lib/sync/**), pure data transforms with unit-test coverage, or styling-only token tweaks already covered by inkwell-retrofit — those have better-fit verification.
Default dimensions
Verify these two by default — they catch the most regressions per unit of effort:
- Functional behavior — does the change do what the acceptance criteria say? The "did it actually work" check.
- Console & network errors — runtime errors, failed requests, and React warnings a screenshot can't show.
Accessibility and visual/Inkwell fidelity are opt-in escalations (see below), not part of every run. Add them when the change is a11y-sensitive (new interactive element, focus flow) or visually significant (new layout, color, spacing) — or when asked.
The flow
1. Scope the change
Identify which surface(s) changed and what "correct" means. Pull the acceptance criteria from the task/spec/PR if they exist; if they don't, state in one line what behavior you're about to confirm. Pick the verification altitude — a one-line copy fix needs a glance; a new interaction needs the full loop.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 134 lines · 0 tokens per session scan A a47300bc048a
verify-frontend-change is a skill published in the GitHub repository vscarpenter/gsd-task-manager (25 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,335 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scrape-batch
Extract many known URLs in one polite, rate-limited pass. Use when the user hands over a list of links, a set of search hits to read in full, or asks to "scrape these pages" / "pull the content from all of them". Drives extract(action="batch"), which fans out with per-domain rate limiting and returns partial results…
blazemeter-recorders
Comprehensive guide for BlazeMeter Recorders, including Chrome Extension and Proxy Recorder. Use when working with recorders for (1) Recording tests with Chrome Extension, (2) Creating and using Proxy Recorder, (3) Configuring browsers and devices for proxy recording, (4) Setting port ranges for proxy recorder, or any…
verify
Build/launch/drive recipe for verifying Counterpoise UI changes end-to-end against the local dev server. Use when a code change needs runtime verification in the real app (not just tests).
glim
Live data for AI agents - Twitter/X search, Reddit posts and comments, semantic web search, clean page extraction, GitHub repos/code/PRs, Amazon products, YouTube transcripts, public Telegram channels, AI-text detection. One hosted MCP server at glim.sh/mcp. Sign in with OAuth and a prepaid balance, or pay per call…
signed-in-browser
Drive the browser the user is already signed into, instead of a cold automation profile. Use when a task lives behind a login — a dashboard, an admin console, an internal tool, a ticket queue, a bank or billing page, webmail, a social account — or when a scripted login is failing on SSO, MFA, CAPTCHA or bot detection.…
post-to-hacker-news
Submit to Hacker News, including Show HN, by driving a signed-in browser. Use when launching a product, tool or MCP server, or when a submission needs its customary author comment. Covers the title rules, when a Show HN is allowed, the url-or-text choice, and how to tell a real submission from a silent failure.