Borrowing it
Nothing to install: this file belongs to anantjain-xyz/symphony-rust. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/anantjain-xyz/symphony-rust/main/.agents/skills/symphony-screenshot/SKILL.mdgit clone --depth 1 https://github.com/anantjain-xyz/symphony-rustWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anantjain-xyz/symphony-rust/symphony-screenshot)<a href="https://agentmods.dev/skills/anantjain-xyz/symphony-rust/symphony-screenshot"><img src="https://agentmods.dev/badge/skills/anantjain-xyz/symphony-rust/symphony-screenshot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anantjain-xyz/symphony-rust/symphony-screenshot"><img src="https://agentmods.dev/badge/skills/anantjain-xyz/symphony-rust/symphony-screenshot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.04287 |
| Opus 5 | $0.00026 | $0.02143 |
| Sonnet 5 | $0.00010 | $0.00857 |
| Haiku 4.5 | $0.00005 | $0.00429 |
Grade C, and why
symphony-screenshot scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
8. **Cleanup workspace artifacts**: `rm -rf .symphony/screenshots .symphony/capture.mjs .playwright-mcp` and `rm -f .symphony/screenshot-sha /tmp/symphony-shots.json` (those should not appear in `git status` afterward). Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
6. **Verify the images render** in the PR (visual confirmation by the operator, or a `curl -I "$raw_url"` returning 200 if running unattended). Do not proceed to step 7 without confirmation — the cleanup revert removes t Copies of this mod
1 near-identical copy found in the catalogue:
- symphony-screenshot — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 265 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Screenshot
The PR description is the home for proof-of-testing screenshots. They are hosted as raw GitHub blobs at the screenshot commit SHA. After the PR body is updated, create a follow-up revert commit that removes the screenshot files from the branch tip while keeping the original screenshot commit reachable in branch history.
Capture runs through a small Node script (capture.mjs) driven from the shell, not the Playwright MCP. The MCP's browser_run_code_unsafe runs in a sandbox with no process, require, or context, so it cannot read an environment variable or inject a session cookie — authenticated dev captures are impossible there. A plain Node script gets a normal process.env, so a session cookie can be injected while the secret stays in the environment and never appears in a tool call / transcript. The script also bypasses self-signed dev certs, handles SPAs that never reach network-idle, fails on unexpected HTTP statuses, and can run interactions (hover/click/…) to reach states that aren't a bare URL.
Preconditions
- A PR exists for the current branch (use the
symphony-pushskill first if not). gh auth statussucceeds against the repo's host, and plaingit pushhas credentials for that host. If relying on GitHub CLI for HTTPS git credentials, rungh auth setup-gitfirst (gh auth setup-git --hostname <host>for a non-default host).GITHUB_TOKEN/GH_TOKENalone can authenticategh pr ...commands but is not enough for thegit push origin ...andgit push --force-with-lease ...commands this workflow runs.- Playwright is installed in the repo's
node_modules.capture.mjsdoesimport { chromium } from 'playwright', resolved from the repo tree. If the repo doesn't already depend on Playwright, install it first (npm install --no-save playwright, or the repo's package manager) —npx playwrightdoes not make the bareimportresolvable for a plainnode .symphony/capture.mjs. If it can't be installed, surface a blocker rather than guessing. - For authenticated targets only (anything behind a login wall, e.g. a dev server): the session cookie value must be present in an environment variable (do not hardcode it). You pass the env var's name and the cookie's name/domain in the spec — never the value. If the var is unset, stop and surface a blocker; do not capture the auth wall.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 265 lines · 52 tokens per session scan C f5279a9c3dd7
symphony-screenshot is a skill published in the GitHub repository anantjain-xyz/symphony-rust (11 stars, last pushed 28d ago), licensed MIT. It adds 52 tokens to every session and 4,287 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.
test-warp-ui
Guides testing Warp UI features and changes using the computer use tool. Use this skill only when computer-use testing was requested (explicit request or accepted offer) and the computeruse tool is available to the agent. Covers launching Warp and verifying UI behavior.
test-electron-app
Drive the real running PostHog Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, test desktop changes against a local Django stack, snapshot the accessibility tree, inspect network requests, and screenshot only when explicitly asked. Use when…
pyats-dynamic-test
Generate and execute deterministic pyATS aetest validation scripts - interface state, OSPF neighbors, BGP paths, ping matrices, and custom compliance tests. Use when writing a network test, validating post-change state, running pass/fail checks, or building automated regression tests.
test-loop
Plan, generate, and heal an executable E2E test suite from approved acceptance criteria (web and mobile).
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…