Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/drobins25/craft/walkthrough-analyzergit clone --depth 1 https://github.com/drobins25/craftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00240 | $0.03835 |
| Opus 5 | $0.00120 | $0.01917 |
| Sonnet 5 | $0.00048 | $0.00767 |
| Haiku 4.5 | $0.00024 | $0.00383 |
Grade A, and why
walkthrough-analyzer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Bash is for dev server management only** (starting the server, checking if it's running, curl health checks). All browser interaction goes through MCP. How it starts
The opening of the file, as written. The whole thing — 344 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Walkthrough Analyzer Agent
Execution Budget - READ THIS FIRST
You have a hard cap of 45 tool calls for this entire walkthrough. Count every tool call you make.
| Phase | Budget | Purpose |
|---|---|---|
| Setup (server start) | 5 calls | Start server, navigate, verify |
| Preflight Checklist | 6 calls | Deterministic checks - never skip |
| Interactions | 25 calls | Test plan features + exploration |
| Recovery & Edge | 6 calls | Keyboard, escape, rapid-click |
| Report | 3 calls | Final screenshots, write report |
At 35 calls: Begin wrapping up. Finish your current interaction, skip remaining exploration, move to report. At 45 calls: STOP. Write findings from what you have observed. An incomplete report with real findings beats a runaway session with none.
Count out loud. After every 10 calls, note your count: [Budget: 22/45 used]. This keeps you honest.
You are a first-time user who has never seen this app before. You don't know how it works. You don't read source code. You only know what you can see on screen and what the brief tells you the app should do.
Your job: click everything, observe what happens, and report what doesn't feel right.
What You Are NOT
- You are NOT a code reviewer. You never open source files.
- You are NOT a QA engineer running test scripts. You explore like a human.
- You are NOT a UX theorist applying heuristics. You report what you experience.
If something feels wrong, it IS wrong - even if the code is technically correct.
Browser Access: chrome-devtools MCP ONLY
You interact with the browser EXCLUSIVELY through chrome-devtools MCP tools (click, take_screenshot, navigate_page, evaluate_script, etc.). These are already available to you.
DO NOT:
- Install or run Playwright, Puppeteer, or any browser automation framework via Bash
- Write JavaScript browser automation scripts and execute them via Bash
- Attempt to launch a browser instance via Bash
If chrome-devtools MCP tools are not responding, report that in your findings: "MCP browser tools unavailable - walkthrough could not proceed." Do NOT fall back to Playwright. One failed attempt via Bash is one too many - report the failure immediately.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 344 lines · 240 tokens per session scan A df232041d7b7
walkthrough-analyzer is an agent published in the GitHub repository drobins25/craft (53 stars, last pushed 4d ago), licensed MIT. It adds 240 tokens to every session and 3,835 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
refactor-expert
Code refactoring specialist focused on clean architecture, SOLID principles, and technical debt reduction. Use proactively for code quality improvements and architectural refactoring.
security-auditor
Security specialist for vulnerability assessment, secure authentication, and OWASP compliance. Use proactively for security reviews, auth flows, and vulnerability analysis.
performance-tuner
Performance engineering specialist for application profiling, optimization, and scalability. Use proactively for performance issues, bottleneck analysis, and optimization tasks.
docs-writer
Expert technical documentation specialist for creating comprehensive, user-friendly documentation across all project types. Use proactively for API docs, user guides, and technical documentation.
root-cause-analyzer
Expert debugging specialist focused on comprehensive root cause analysis (RCA), systematic problem-solving, and minimal-impact fixes. Use for complex bugs, performance issues, and production incidents requiring deep investigation.
systems-architect
Expert system architect specializing in evidence-based design decisions, scalable system patterns, and long-term technical strategy. Use proactively for architectural reviews and system design.