Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/anastasiyaw/codex-claude-code-config/control-uinpx skills add AnastasiyaW/codex-claude-code-config --skill control-uigit clone --depth 1 https://github.com/AnastasiyaW/codex-claude-code-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anastasiyaw/codex-claude-code-config/control-ui)<a href="https://agentmods.dev/skills/anastasiyaw/codex-claude-code-config/control-ui"><img src="https://agentmods.dev/badge/skills/anastasiyaw/codex-claude-code-config/control-ui.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.00643 |
| Opus 5 | $0.00036 | $0.00321 |
| Sonnet 5 | $0.00015 | $0.00129 |
| Haiku 4.5 | $0.00007 | $0.00064 |
Grade A, and why
control-ui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Control UI
Verify UI behavior at the real browser or Electron boundary. Reuse the project's Playwright, Cypress, browser, or Electron harness before creating a probe. Keep the data local and disposable.
Workflow
- Read the project's documented start command and identify the local URL or debug port.
- Discover existing browser tests and stable app markers.
- Select the target page by a positive root marker, role, label, or stable
data-*attribute, not tab order or coordinates. - Capture the initial DOM/accessibility snapshot, screenshot, console state, or network baseline relevant to the claim.
- Perform one structural action: click, type, keypress, drag, scroll, navigate, or resize.
- Capture the new state and assert the expected change.
- Clean up the dev server, debug session, temporary profile, and artifacts.
Use verify-this for before/after claims. Use raw CDP only when higher-level
APIs cannot provide the required CPU, heap, trace, network, or rendering signal.
Do not install Playwright just for a one-off probe when an existing browser tool
or dependency is available.
Evidence and privacy
Screenshots, traces, network bodies, and heap snapshots may contain private code or user data. Keep them outside public Git unless they are explicitly sanitized and approved. A public report should contain the command, revision, safe metric, and artifact hash or private location, not the payload.
Gotchas
- A screenshot without an assertion proves that rendering occurred, not that the workflow is correct.
- Coordinates and stale locators are fragile after navigation or layout change; select from the latest structure.
- A successful page load does not prove console, network, accessibility, or keyboard behavior.
- A visual diff can be caused by viewport, font, locale, or reduced-motion differences; record those inputs before interpreting it.
Troubleshooting
| Symptom | Likely cause | Action |
|---|---|---|
| Wrong tab or window | Selector relied on tab order | Enumerate pages and choose a positive app marker |
| Click changes nothing | Stale locator or wrong state | Capture a fresh snapshot and wait for the state marker |
| Screenshot differs only on one machine | Fonts, viewport, scale, or locale drift | Pin the test inputs and classify as INCONCLUSIVE until comparable |
| Browser remains after the run | Cleanup path missed an exception | Use a bounded cleanup step and verify the process/profile is gone |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 62 lines · 73 tokens per session scan A 6956e8831c77
control-ui is a skill published in the GitHub repository AnastasiyaW/codex-claude-code-config (147 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 643 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
e2e-testing
Playwright E2E testing patterns, Page Object Model, configuration, CI/CD integration, artifact management, and flaky test strategies. Use when writing Playwright tests, structuring page objects, or fixing flaky E2E runs in CI.
dogfood
Exploratory QA of web apps: find bugs, evidence, reports.
playwright-pom-discovery
Use when building or extending a Page Object Model (POM) for the Opik E2E suite (under testsendtoend/e2e/pom/) and you need to choose stable selectors against the live UI. Walks through seeding required state, exploring the running page with the Playwright MCP (accessibility snapshot + data-testid enumeration)…
search-params
URL search param and hash state management. Use when adding or modifying URL search params, working with useSearchParams, setSearchParams, useSearchParamState, or navigate() with query strings or hash fragments, or fixing browser back/forward button issues.
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.