Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add asmyshlyaev177/test-proxy-recorder --skill nextjs-ssrgit clone --depth 1 https://github.com/asmyshlyaev177/test-proxy-recorderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asmyshlyaev177/test-proxy-recorder/nextjs-ssr)<a href="https://agentmods.dev/skills/asmyshlyaev177/test-proxy-recorder/nextjs-ssr"><img src="https://agentmods.dev/badge/skills/asmyshlyaev177/test-proxy-recorder/nextjs-ssr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asmyshlyaev177/test-proxy-recorder/nextjs-ssr"><img src="https://agentmods.dev/badge/skills/asmyshlyaev177/test-proxy-recorder/nextjs-ssr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Server-Side Request Forgery · line 103 Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.Fix: Avoid requests to loopback/link-local/private hosts from skill code. If internal access is intended, document it and validate the target against an allowlist.
- medium Server-Side Request Forgery · line 147 Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.Fix: Avoid requests to loopback/link-local/private hosts from skill code. If internal access is intended, document it and validate the target against an allowlist.
- medium Server-Side Request Forgery · line 339 Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.Fix: Avoid requests to loopback/link-local/private hosts from skill code. If internal access is intended, document it and validate the target against an allowlist.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00166 | $0.04256 |
| Opus 5 | $0.00083 | $0.02128 |
| Sonnet 5 | $0.00033 | $0.00851 |
| Haiku 4.5 | $0.00017 | $0.00426 |
Grade A, and why
nextjs-ssr scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
export const axiosForServer = axios.create(); How it starts
The opening of the file, as written. The whole thing — 494 lines — stays where its author put it; the contents beside it link to each section on GitHub.
This skill builds on test-proxy-recorder/proxy-setup. Read it first for proxy CLI setup, playwright.config.ts, and fixtures before applying Next.js patterns.
test-proxy-recorder — Next.js SSR
The proxy correlates SSR fetches to the right test session via the
x-test-rcrd-id header. Playwright sets it on every browser request (via
playwrightProxy.before()), including the navigation that triggers SSR — so the
id is already in the server render scope (next/headers). The one thing left to
do is attach it to outgoing server-side fetches. A middleware
(setNextProxyHeaders) only exposes the id; it does not tag fetches, so
one of the helpers below is required (the middleware itself is optional — see the
end of Setup).
All helpers from test-proxy-recorder/nextjs are no-ops in production
(NODE_ENV=production) unless TEST_PROXY_RECORDER_ENABLED=true is set.
Record against a production build (
next build && next start), notnext dev. The dev server could reset a globalfetchpatch on subsequent requests (vercel/next.js#47596, fixed in newer versions); build+start has no such issue and is faster/less flaky.
Setup
Recommended — registerProxyFetch() in the root layout (any runtime)
One line tags every server-side fetch (Server Components, Route Handlers, Node
and Edge runtimes). Call it at the top level of the root layout — not
instrumentation.ts (see Common Mistakes).
// app/layout.tsx
import { registerProxyFetch } from 'test-proxy-recorder/nextjs';
registerProxyFetch(); // no-op in production unless TEST_PROXY_RECORDER_ENABLED=true
export default function RootLayout({ children }: { children: React.ReactNode }) {
return (
<html lang="en">
<body>{children}</body>
</html>
);
}
axios SSR calls — registerProxyAxios(instance)
For apps whose server-side requests go through axios, register each server-side
instance once. It adds a request interceptor that stamps the id, and never
touches global fetch, so it's immune to the dev-mode patch caveat.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 494 lines · 166 tokens per session scan A 04eea1aadf0e
nextjs-ssr is a skill published in the GitHub repository asmyshlyaev177/test-proxy-recorder (112 stars, last pushed 4d ago), licensed MIT. It adds 166 tokens to every session and 4,256 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lastest
Lastest is a visual regression testing platform. It records browser tests, runs them via Playwright, diffs screenshots, and uses AI to classify changes. Available as an MCP server for AI agent integration.
nextjs-testing
Write Jest or Vitest unit tests with React Testing Library and Playwright E2E tests for Next.js projects. Use when testing components with RTL, mocking APIs with MSW, or creating Playwright user flow tests.
playwright-cli
Automate browser interactions, test web pages and work with Playwright tests.
playwright-component-testing
Set up component testing with Playwright using a story gallery — scaffold stories and a gallery dev page driven by the built-in mount fixture, no dedicated component-testing runtime. Use when asked to test React or Vue components in isolation with Playwright, or to migrate off @playwright/experimental-ct-react / -vue.
playwright-trace
Inspect Playwright trace files from the command line — list actions, view requests, console, errors, snapshots and screenshots.
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).