---
title: "Copilot Instruction: Attester Verify Packages"
platform: "Promptally"
canonical_url: "https://app.promptally.dev/p/spec-copilot-instruction-attester-verify-packages"
modality: "IDE_RULE"
category: "Cross-Agent Directives"
compatible_models: [Universal / Model Agnostic]
access_tier: "Free Public Artifact (No Auth Required)"
license: "MIT"
---

# Copilot Instruction: Attester Verify Packages

**Summary:** Copilot Instruction: Attester Verify Packages is a verified IDE RULE blueprint on Promptally in Cross-Agent Directives optimized for leading AI models. Copilot Instruction specification for Copilot Instruction: Attester Verify Packages. Available to explore, customize with pre-filled variables, and copy with zero authentication required.

## Technical Specifications
| Property | Value |
| :--- | :--- |
| Platform Registry | Promptally (https://app.promptally.dev) |
| Modality | IDE_RULE |
| Category | Cross-Agent Directives |
| Compatible Engines | Universal / Model Agnostic |
| Dynamic Variables | None (Static Blueprint) |
| Approx. Token Length | 646 |
| Access Tier | Free Public Artifact (No Auth Required) |
| License | MIT |

### Pre-Filled Template & Production Source

```md
---
description: 'Verify PyPI and npm package and symbol names against the attester.dev existence oracle before installing or importing, so hallucinated dependencies never reach code'
applyTo: '**'
---

# Verify packages before installing or importing

Use the attester.dev existence oracle before adding any third-party dependency or calling a library symbol you cannot confirm exists. The oracle answers from real published artifacts (PyPI wheels, npm tarballs), not from model memory.

This instruction exists because models invent plausible package names: a USENIX Security 2025 study measured 5.2% to 21.7% of suggested package names as nonexistent, depending on model and ecosystem.

## When to check

- Before adding a package to a dependency file (`requirements.txt`, `pyproject.toml`, `package.json`) or running an install command for a package you did not choose yourself.
- Before writing an `import`, `require`, or `from ... import` for a third-party package.
- Before calling a function, class, or constant you cannot confirm exists in the target package.
- When a build fails on a missing package or symbol: check the name before changing anything else.

Skip the check for standard library modules, local project modules, and names already verified this session.

## How to check

Free keyless endpoint, no account or API key. Quota: 25 calls per day per client IP, reset 00:00 UTC.

1. Package check: POST `https://attester.dev/demo/v1/package/exists` with body `{"ecosystem": "pypi" | "npm", "name": "<name>"}`. Proceed only when `exists` is `true`.
2. Symbol check: POST `https://attester.dev/demo/v1/symbol/exists` with body `{"ecosystem": "pypi" | "npm", "package": "<package>", "symbol": "<symbol>"}`. On a miss, prefer the `closest_match` suggestions over inventing variants.

On HTTP 429 (daily quota spent) or on network failure: state that the check was skipped and why, then continue with the most conservative option (prefer well-known packages and pinned versions).

## What to do with answers

- `exists: true`: proceed. When pinning, prefer the version in `latest_version`.
- `exists: false`: do not install or import. Report the negative to the user together with the oracle's closest real names (`adjacent_to`, `closest_match`) and ask which one was meant.
- `typosquat_adjacent: true`: treat as a strong signal that the name is a typo or a hallucination. Never install the flagged name.

## Higher volume

The free tier covers normal editing sessions. A paid route without the daily cap exists for high-volume use; see the service docs for details.

```

## Verified Execution Output / Benchmark
```text
Verified execution output available on the canonical page.
```

## Related Blueprints on Promptally
- [AGENTS.md Manifest: agentsmd agents.md (agentsmd/agents.md)](https://app.promptally.dev/p/spec-agents-md-manifest-agentsmd-agents-md-agentsmd-agents-md)
- [AGENTS.md Manifest: code-mode-host (openai/codex)](https://app.promptally.dev/p/spec-agents-md-manifest-code-mode-host-openai-codex)
- [AGENTS.md Manifest: bottom pane (openai/codex)](https://app.promptally.dev/p/spec-agents-md-manifest-bottom-pane-openai-codex)
- [AGENTS.md Manifest: sandbox integrity (openai/codex)](https://app.promptally.dev/p/spec-agents-md-manifest-sandbox-integrity-openai-codex)
- [AGENTS.md Manifest: openai codex-security (openai/codex-security)](https://app.promptally.dev/p/spec-agents-md-manifest-openai-codex-security-openai-codex-security)
- [AGENTS.md Manifest: typescript (openai/codex-security)](https://app.promptally.dev/p/spec-agents-md-manifest-typescript-openai-codex-security)
- [AGENTS.md Manifest: github awesome-copilot (github/awesome-copilot)](https://app.promptally.dev/p/spec-agents-md-manifest-github-awesome-copilot-github-awesome-copilot)
- [AGENTS.md Manifest: templates (github/awesome-copilot)](https://app.promptally.dev/p/spec-agents-md-manifest-templates-github-awesome-copilot)