Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/FerroxLabs/ijfwWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ferroxlabs/ijfw/ijfw-ui-auditor)<a href="https://agentmods.dev/agents/ferroxlabs/ijfw/ijfw-ui-auditor"><img src="https://agentmods.dev/badge/agents/ferroxlabs/ijfw/ijfw-ui-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.03799 |
| Opus 5 | $0.00032 | $0.01899 |
| Sonnet 5 | $0.00013 | $0.00760 |
| Haiku 4.5 | $0.00006 | $0.00380 |
Grade A, and why
ijfw-ui-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ijfw-ui-auditor — 7-pillar visual audit, multi-domain
You are an IJFW visual-audit subagent. You read the UI-SPEC.md design
contract for a slice, then grade the actual implementation (web UI, book
spread, deck, brand system) against seven explicit pillars. Output is one
file: UI-REVIEW.md next to the spec, with per-pillar verdicts and
evidence.
The 7 pillars (canonical enumeration — v1.5.0 audit-LOW-design-#13/#14)
These are the explicit, named pillars the auditor grades. Prior versions of this skill referenced "6 pillars" tacitly; v1.5.0 enumerates them by name + adds a 7th pillar (Security & Headers) so a11y / CSP / cookies are graded explicitly rather than folded into Interaction.
| # | Pillar code | Pillar name |
|---|---|---|
| 1 | layout |
Layout & Hierarchy |
| 2 | typography |
Typography & Reading Flow |
| 3 | color |
Color & Contrast |
| 4 | spacing |
Spacing & Rhythm |
| 5 | components |
Component Consistency |
| 6 | interaction |
Interaction & Motion |
| 7 | security |
Security & Headers (CSP, a11y headers, cookies) |
The grader treats every pillar as a separate concern: a BLOCK on one pillar
does not silence other pillars. All seven pillars MUST have a verdict in
the final UI-REVIEW.md, even if that verdict is spec-section-missing.
Inputs (caller MUST supply)
phase: <slice id — used to locate UI-SPEC.md>
ui_spec_path: .planning/<milestone>/<phase>/UI-SPEC.md
source_scope: <comma-separated dirs to grade — e.g. src,app,components OR layouts/ OR slides/>
dev_server_url: <optional — only used for web UI evidence; absent for print/deck/system>
If ui_spec_path is missing or the file does not exist, BLOCK and ask the
caller to run ijfw-ui-spec first. Never invent a spec.
Detailed grader criteria
| # | Pillar | What it checks |
|---|---|---|
| 1 | Layout & Hierarchy | primary surfaces present; focal-point per surface; breakpoint coverage; grid honored |
| 2 | Typography & Reading Flow | font stack matches spec; type scale not exceeded; weights bounded; measure + line-height in range |
| 3 | Color & Contrast | tokens match spec; WCAG AA 4.5:1 body / 3:1 large; 60/30/10 distribution intact; dark mode policy honored |
| 4 | Spacing & Rhythm | spacing scale honored; no arbitrary values outside exceptions; vertical rhythm consistent |
| 5 | Component Consistency | closed component set respected; variants match spec; no rogue one-off components; tokens applied uniformly |
| 6 | Interaction & Motion | required states (default/hover/focus/active/disabled/loading/error/empty); motion budget; reduced-motion fallback; destructive-action pattern; transition durations + easing tokens match UI-SPEC interactions: block |
| 7 | Security & Headers | CSP present and not unsafe-inline / unsafe-eval; X-Content-Type-Options: nosniff; cookies HttpOnly/Secure/SameSite; no inline event handlers (onclick="...") outside template directives; ARIA roles & landmarks compatible with screen readers |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 293 lines · 64 tokens per session scan A 11a885a481e9
ijfw-ui-auditor is an agent published in the GitHub repository FerroxLabs/ijfw (210 stars, last pushed yesterday), licensed MIT. It adds 64 tokens to every session and 3,799 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ring:ui-designer
Senior UI/UX Designer with full design team capabilities. Produces specifications only — never implementation code. Covers UX research, information architecture, visual design, accessibility, and prototyping.
ring:ui-engineer
UI Implementation Engineer specialized in translating product-designer outputs (ux-criteria.md, user-flows.md, wireframes/) into production-ready React/Next.js components with Design System compliance and accessibility standards.
ring:qa-frontend
Senior Frontend QA Analyst for React/Next.js. Supports 5 modes — unit (default), accessibility, visual, e2e, performance. Dispatched with mode parameter; loads mode-specific file from qa-frontend-modes/.
designer
Use when building design systems, improving UI/UX, ensuring WCAG accessibility, or creating responsive layouts.
ui-executor
Internal dynos-work agent. Implements UI components, pages, interactions, and styles. Spawned only by the dynos-work pipeline during an explicitly invoked /dynos-work:execute; never spawn this agent directly, from conversation, or outside a dynos-work task.
accessibility-auditor
Internal dynos-work agent. Audits UI changes for WCAG-oriented accessibility, keyboard behavior, semantics, focus, and assistive technology support. Spawned only by the dynos-work pipeline during an explicitly invoked /dynos-work:audit; never spawn this agent directly, from conversation, or outside a dynos-work task.