Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add automateyournetwork/netclaw --skill browser-viz-verifygit clone --depth 1 https://github.com/automateyournetwork/netclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/automateyournetwork/netclaw/browser-viz-verify)<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/browser-viz-verify"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/browser-viz-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/browser-viz-verify"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/browser-viz-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 21 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.01396 |
| Opus 5 | $0.00042 | $0.00698 |
| Sonnet 5 | $0.00017 | $0.00279 |
| Haiku 4.5 | $0.00008 | $0.00140 |
Grade A, and why
browser-viz-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser Visualization Verify Skill
Purpose
NetClaw ships several skills that generate browser-based visualization outputs — threejs-network-viz, canvas-network-viz, drawio-diagram, uml-diagram, markmap-viz. Until now, confirming that a generated file actually rendered correctly (no blank canvas, no JavaScript errors, no broken layout) required a human to manually open it in a browser. This skill closes that gap: it opens the file itself in a controlled, headless Chrome session, takes a screenshot, reads the console for errors, and optionally runs a Lighthouse audit — then reports a clear verdict.
This skill never navigates to a remote URL and never touches the persistent authenticated browser profile used by browser-gui-inspect. It only ever opens local file:// paths. See specs/048-chrome-devtools-browser-inspection/ for the full spec, research, and design behind this skill.
MCP Server
This skill uses tools provided by the chrome-devtools-mcp server (official Chrome DevTools team package, chrome-devtools-mcp on npm), spawned locally via npx -y chrome-devtools-mcp@latest over stdio transport. See mcp-servers/chrome-devtools-mcp/README.md.
Environment Variables
None. chrome-devtools-mcp takes all configuration as CLI flags, not env vars. This skill always runs headless against a local file — it never needs --headless=false or the persistent profile's authenticated sessions.
Workflow: Verify a Generated Visualization (P1 — MVP)
Input:
file_path(required) — absolute path to the generated visualization HTML filerun_audit(optional, defaultfalse) — whether to also run a Lighthouse audit
Step 1: Confirm the file exists
Before opening a browser session, verify file_path exists on disk. If it does not, stop and return:
verdict: "file_not_found"
Do not attempt to open a browser session for a path that doesn't exist.
Step 2: Open the file in a headless session
Tool: new_page
Args: { "url": "file://<file_path>" }
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 130 lines · 84 tokens per session scan A bcc295af052d
browser-viz-verify is a skill published in the GitHub repository automateyournetwork/netclaw (652 stars, last pushed 3d ago), licensed Apache-2.0. It adds 84 tokens to every session and 1,396 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
naive-user
Drive the live app as an uninformed first-time user. Hover, click, and type in a real browser, observe what actually happens, and report the gaps (bugs, broken expectations, UX surprises, accessibility issues) before deploy. Source-blind: forms expectations from the screen plus web conventions, never from source.…
argus
Argus AI-powered QA harness — Chrome DevTools MCP reference for browser automation, accessibility, performance, security, and debugging.
actionbook-web-test
Run browser-based web tests against websites using Actionbook CLI. Activate when the user wants to test a website workflow, run smoke tests, verify a user flow, check if a web application works, run regression tests, or validate browser-based interactions. Supports test definition, execution, assertion, reporting, and…
BrowserBash Browser Automation
BrowserBash is a vendor-independent, natural-language browser automation CLI. Drive a real browser from plain-English objectives or committable Markdown tests, run on local Chrome, CDP/Playwright MCP, Browserbase, LambdaTest, or BrowserStack, and stream NDJSON results with CI exit codes — using free local Ollama…
Geb Testing
Browser automation testing with Geb framework for Groovy/JVM using jQuery-like content DSL, Page Object pattern, Spock integration, and WebDriver abstraction.
playwright-cli
Use this whenever the user asks to browse, navigate, click, fill a form, scrape, take a screenshot, or otherwise interact with a web page. SLICC drives the browser through the playwright-cli shell command (also aliased as playwright and puppeteer). Read this BEFORE running any browser automation: every tab-operating…