Verification guidance for the `setup.mjs` command-line helper, including tests in a no-network sandbox.

Testing configuration commands, token input through a FIFO, live token smoke tests, and expected behavior when network access is blocked.

It shows how to check the helper's real command interface and avoid misleading results from tests that wait on stdin or network access.

verify — Skill for Claude Code and Cursor by ztemerbekov

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/ztemerbekov/a1-yandex-kit-skills

agentmods

npx agentmods add skills/ztemerbekov/a1-yandex-kit-skills/verify

Made for: Claude Code, Cursor.

Or install a1-yandex-kit-skills, the plugin that ships this one along with the rest of its 12 skills, 2 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/ztemerbekov/a1-yandex-kit-skills/verify/github.svg)](https://agentmods.dev/skills/ztemerbekov/a1-yandex-kit-skills/verify)

Your own site

<a href="https://agentmods.dev/skills/ztemerbekov/a1-yandex-kit-skills/verify"><img src="https://agentmods.dev/badge/skills/ztemerbekov/a1-yandex-kit-skills/verify/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/ztemerbekov/a1-yandex-kit-skills/verify"><img src="https://agentmods.dev/badge/skills/ztemerbekov/a1-yandex-kit-skills/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 489 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00033	$0.00489
Opus 5	$0.00016	$0.00244
Sonnet 5	$0.00007	$0.00098
Haiku 4.5	$0.00003	$0.00049

Measured 12d ago against content hash d50be0d82f82, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade B, and why

verify scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

node .../setup.mjs configure --client cursor --config "$TMP/mcp.json" --token-stdin --json < "$TMP/pipe" &

.claude/skills/verify/SKILL.md · 47 lines

What it actually says

Verifying the setup helper CLI

The surface is node skills/a1-yandex-kit-setup/scripts/setup.mjs <command>. No build step — plain Node 20+, no dependencies.

Recipes that work

stdin protocol (no-EOF regression): feed the token through a FIFO and keep the write end open; the helper must exit on its own:
```
mkfifo "$TMP/pipe"
node .../setup.mjs configure --client cursor --config "$TMP/mcp.json" --token-stdin --json < "$TMP/pipe" &
exec 3>"$TMP/pipe"; printf 'token\n' >&3; wait $!   # exits ~0.3s
```
Do not time (printf ...; sleep N) | node ... — the pipeline waits for the sleep, not the helper.
Live smoke without a real token: printf 'bad\n' | node .../setup.mjs smoke-token --token-stdin --json runs real npx + mcp-yandex-kit@latest + the real API and must return SMOKE_AUTH in ~3s. Read-only, safe.
No-network sandbox (the Codex scenario, macOS):
```
printf 'bad\n' | sandbox-exec -p '(version 1)(allow default)(deny network*)' \
  node .../setup.mjs smoke-token --token-stdin --json
```
Must return NETWORK_UNAVAILABLE in <1s. sandbox-exec is deprecated but works; the Claude Bash sandbox itself has network, so it can't provide this.
Orphan check after any smoke: pgrep -fl mcp-yandex-kit → empty.

Gotchas

A verifiable happy path needs a valid YANDEX_KIT_TOKEN; without one the furthest observable live state is SMOKE_AUTH (which still proves probe, spawn, handshake, get_store and cleanup).
configure needs no network at all — only npx --version locally.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 47 lines · 33 tokens per session scan B d50be0d82f82

Subscribe to this mod's changes

verify is a skill published in the GitHub repository ztemerbekov/a1-yandex-kit-skills (2 stars, last pushed 3d ago), licensed MIT. It adds 33 tokens to every session and 489 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

E-commerce Testing codex cursor kimi mcp yandex-kit

run-production-master

Build all workspaces, run tests, lint, and validate the install manifests for the production-master thin-client monorepo. Use before opening a PR or when verifying a local checkout is healthy. Triggers on "build and test", "run the checks", "validate manifests", "verify the repo".

ProductionMasterAI/production-master · 65 tokens

nft-standards

Implement NFT standards (ERC-721, ERC-1155) with proper metadata handling, minting strategies, and marketplace integration. Use when creating NFT contracts, building NFT marketplaces, or implementing digital asset systems.

wshobson/agents · 48 tokens

workflow-patterns

Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.

wshobson/agents · 35 tokens

skillshare-implement-feature

Implement a feature from a spec file or description using TDD workflow. Use this skill whenever the user asks to: add a new CLI command, implement a feature from a spec, build new functionality, add a flag, create a new internal package, or write Go code for skillshare. This skill enforces test-first development…

runkids/skillshare · 114 tokens