Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yonatangross/orchestkit --skill ork-verifygit clone --depth 1 https://github.com/yonatangross/orchestkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yonatangross/orchestkit/ork-verify)<a href="https://agentmods.dev/skills/yonatangross/orchestkit/ork-verify"><img src="https://agentmods.dev/badge/skills/yonatangross/orchestkit/ork-verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.00275 |
| Opus 5 | $0.00032 | $0.00138 |
| Sonnet 5 | $0.00013 | $0.00055 |
| Haiku 4.5 | $0.00006 | $0.00028 |
Grade A, and why
ork-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Ork Verify
Write the evidence contract first: target, required checks, environment, success condition, and budget. Read the repository instructions for canonical commands and run the narrowest relevant checks before broad suites.
Report each command and its summary exactly. When a check depends on a third-party command or API surface, confirm its current flags and semantics with the context7 MCP server (resolve-library-id, then query-docs); a flag you only remember is a gap, not evidence. A passing test or check proves only the path it executed; verify that every required signal actually ran. Treat missing logs, unavailable external services, and skipped gates as unknown, not as success.
For material changes, use a separate ork_verifier role when installed (or a fresh Codex reviewer) with the original task and final artifacts, not the implementer's reasoning. Return a binary verdict—PASS, FAIL, or BLOCKED—with evidence, gaps, and the next action. Do not change source files or tests.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 13 lines · 65 tokens per session scan A bbd613341002
ork-verify is a skill published in the GitHub repository yonatangross/orchestkit (229 stars, last pushed today), licensed MIT. It adds 65 tokens to every session and 275 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review
Enter the Review phase of CocoBrew. Aggregates findings from Code Quality Advisor, CocoCupper intelligence, spec compliance check, and decision coverage gate. Produces review.md with decision points. Requires developer approval before $ship can proceed.
pn-best-of-n
Run 2–3 competing implementations of the same spec in isolated worktrees, eliminate failures via objective gates, then judge survivors with a separate premium-tier pass. Use for ambiguous algorithm/API/refactor choices with strong tests — not auth/security paths.
review-prs
Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…
code-review
Perform a structured code review of changes, checking for correctness, style, tests, and potential issues.
implement-universal
Harness-agnostic version of /implement. Drives a single workshop ticket through the SWE→Tester loop in ONE conversation, with the role prompts bundled as agents/software-engineer.md and agents/tester.md instead of being launched as subagents. Resolves the ticket from implementyourself/tasks/, creates an…
mantis-plan
Formulates a targeted defensive security reviewing plan based on the active threat model and historical learnings. Use when starting a security review campaign to map the codebase boundaries and generate a roadmap (workspace/plan.json). Don't use for executing code reviews, writing test scripts, or patching code.