Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Bilal140202/the-lord-of-the-skillsnpx agentmods add skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunter)<a href="https://agentmods.dev/skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunter"><img src="https://agentmods.dev/badge/skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunter"><img src="https://agentmods.dev/badge/skills/bilal140202/the-lord-of-the-skills/codeshux__mockhunter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.04825 |
| Opus 5.5 | $0.00036 | $0.01930 |
| Sonnet 5.5 | $0.00018 | $0.00965 |
| Haiku 4.5 | $0.00009 | $0.00483 |
Grade A, and why
CodeShuX__mockhunter scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- A Supabase HTTP endpoint with service role key (use `curl`) Copies of this mod
1 near-identical copy found in the catalogue:
- mockhunter — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 413 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MockHunter — Live Page Reality Check
Audit a web page in five phases. For every value visible on screen, classify its source as one of: REAL / MOCK / LLM / HARDCODED / BROKEN / UNKNOWN.
Output: a markdown report the user can read in two minutes.
Philosophy: A rendered value is not verified until you've traced it to its source. "It looks like a number" is not evidence that a number was computed.
Quickstart
User invokes /mockhunter:mockhunter. Skill collects inputs, runs all five phases, writes mockhunter-report.md to the current directory.
If the user provides only a URL, ask the smart questions (Phase 1). If the user provides full config upfront, skip directly to Phase 2.
Inputs
Collect these in Phase 1. Required unless marked optional.
| Input | Required | Default |
|---|---|---|
| Target URL | Yes | — |
| Auth mode | Yes | skip (one of: public, localhost, form, skip) |
| Auth credentials | If form |
— |
| Has database? | Yes | N |
| DB connection (string OR shell command) | If has DB | — |
| Stack hint (optional) | No | autodetect from URL |
| Suspicions (optional) | No | — |
| Money page (optional) | No | target URL |
Auto-detect stack from URL pattern when not provided:
*.lovable.app→ Lovable*.bolt.new,*.stackblitz.io→ Bolt*.v0.app,*.v0.dev→ v0*.replit.app,*.repl.co→ Replitaistudio.google.com/*→ Google AI Studio- everything else → Custom
The Five Phases
Phase 1 — Setup & Smart Questions
- Greet the user in one line: "MockHunter — I'll audit a page and tell you what's real, what's mocked, and what's broken."
- Ask for the target URL if not supplied.
- Ask up to 5 smart questions, picked from this pool based on context:
- "What is this page supposed to do for the user?" (frames audit)
- "Which numbers, badges, or sections do you most suspect are mocked?" (focuses scrutiny)
- "Do you have a way to query the database directly? If yes, paste the command (e.g.,
psql ...,docker exec ..., Supabase SQL link)." (enables deep trace) - "What stack is this built with?" (skip if auto-detected)
- "Are any sections intentionally AI-generated content (so I don't false-flag them)?"
- Ask about auth mode if URL looks like it might require login (presence of
/login,/auth,/dashboardin path; or stack hint suggests authenticated app). - Confirm the audit plan with one short summary, then proceed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 413 lines · 90 tokens per session scan A f252668a24ed
CodeShuX__mockhunter is a skill published in the GitHub repository Bilal140202/the-lord-of-the-skills (6 stars, last pushed 1mo ago), licensed MIT. It adds 90 tokens to every session and 4,825 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
tool-calling-tutor
Use when a tool-calling agent does not call a tool, sends wrong arguments, loops without stopping, or needs a function schema. Guides a four-branch diagnosis and five-step schema repair. Do not use for framework-specific, MCP-server, or production-observability questions.
apify-blocked-scrape-triage
Diagnose and recover a scrape that is blocked, throttled, or served empty or partial content, in cost order, before paying for a heavier Actor. Use when a run returns 0 items, when a site answers 403, 429 or a challenge page, when the HTML comes back empty or truncated, when a request fails with no response at all…
ainb-fleet:daemon
Long-running watcher that scans every claude session every 5s and auto-sends continue to any session whose recent tmux pane buffer matches a known API-error regex (ratelimited, overloadederror, internalservererror, requesttimeout, sockethangup, fetchfailed, ECONNRESET). Use this when you want unattended recovery from…
flywheel
Development flywheel - autonomous cycle of run, observe, fix, verify. Use for continuous development with browser automation.
browser-actionability-debug
Diagnose browser UI tests or real browser checks where an element appears visible but cannot be clicked, copied, hovered, or focused. Use for Playwright/Chrome/browser automation failures involving overlays, splash screens, opacity transitions, pointer-events, elementFromPoint mismatches, clipboard assertions, or…
javascript-sandbox
Best practices for using the clodex built-in JavaScript sandbox for browser debugging, fetched-data processing, attachments, and mini-app orchestration within its bundled capability boundary.