Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/5uck1ess/devkit/screenshotnpx skills add 5uck1ess/devkit --skill screenshotgit clone --depth 1 https://github.com/5uck1ess/devkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.01031 |
| Opus 5 | $0.00030 | $0.00515 |
| Sonnet 5 | $0.00012 | $0.00206 |
| Haiku 4.5 | $0.00006 | $0.00103 |
Grade A, and why
screenshot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web Page Screenshot
Capture screenshots and PDFs of web pages using Playwright.
Step 1: Verify Playwright
Run npx playwright --version. If it fails, stop and tell the user: Playwright required — install with: npx playwright install chromium. Do not attempt workarounds.
Step 2: Parse and Validate
Extract from the user's request:
- URL — required; validated below
- Output path — default
./screenshot-{timestamp}.pngin cwd - Capture mode — viewport (default), full-page, element selector
- Device / viewport — optional emulation or custom size
- Format — PNG (default) or PDF
Validate the URL (see Rules for the full list): only http(s), no private/reserved IPs or cloud metadata, no @. On rejection, report the exact reason and stop — never silently skip in a batch.
Step 3: Execute
Choose the command that matches the capture mode. Always quote the URL and output path.
Viewport screenshot:
npx playwright screenshot "{url}" "{output}"
Full-page screenshot:
npx playwright screenshot --full-page "{url}" "{output}"
Custom viewport (format is W,H with no spaces, e.g. 1280,800):
npx playwright screenshot --viewport-size=1280,800 "{url}" "{output}"
Device emulation:
npx playwright screenshot --device="{device}" "{url}" "{output}"
PDF output:
npx playwright pdf "{url}" "{output}.pdf"
Element selector (Playwright CLI doesn't expose this directly, so write a script file and pass args via process.argv — never interpolate user strings into node -e):
cat > /tmp/devkit-shot-element.mjs <<'EOF'
import { chromium } from 'playwright';
const [, , url, selector, output] = process.argv;
if (!url || !selector || !output) {
console.error('usage: node devkit-shot-element.mjs <url> <selector> <output>');
process.exit(2);
}
const browser = await chromium.launch();
try {
const page = await browser.newPage();
await page.goto(url, { waitUntil: 'networkidle', timeout: 30000 });
await page.locator(selector).screenshot({ path: output });
console.log(output);
} catch (err) {
console.error('screenshot failed:', err.message);
process.exit(1);
} finally {
try { await browser.close(); } catch (e) { /* suppress close errors */ }
}
EOF
node /tmp/devkit-shot-element.mjs "$URL" "$SELECTOR" "$OUTPUT"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 106 lines · 59 tokens per session scan A 298616fe4519
screenshot is a skill published in the GitHub repository 5uck1ess/devkit (5 stars, last pushed 13d ago), licensed MIT. It adds 59 tokens to every session and 1,031 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dynamic-workflows
Ultracode / Max-Parallel mode — dynamic workflows fan work out across tens–hundreds of adversarially-verified parallel subagents for large, decomposable jobs (codebase-wide audits, big migrations, cross-checked research). Opt-in; higher token spend.
cost-efficiency
Smart Routing — the DEFAULT CCGodMode routing policy. Risk-based, minimal-agent paths that preserve required safety gates for the changed scope.
agent-teams
Experimental Agent Teams orchestration — run CCGodMode agents as parallel teammates with SharedTaskList coordination (requires CLAUDECODEEXPERIMENTALAGENTTEAMS=1).
quality-gates
Parallel quality gate orchestration — @validator and @tester run simultaneously after @builder, with mandatory decision matrix for pass/fail routing.
sprint-planning
Plan-first orchestration (ADR-004): comprehensive PLAN.md, sprint files with write-scope ownership, preflight checks, serialized integration, and the release sprint. Use for any non-trivial or multi-part request BEFORE dispatching agents.
workflows
CCGodMode Full-Gates workflow definitions — used for high-risk work and when Smart Routing escalates. Default routing is Smart Routing (skills/cost-efficiency/).