Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/bobmatnyc/claude-mpm-skillsnpx agentmods add skills/bobmatnyc/claude-mpm-skills/cypressWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/cypress)<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/cypress"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/cypress/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/cypress"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/cypress.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 42 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 121 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.01157 |
| Opus 5 | $0.00018 | $0.00579 |
| Sonnet 5 | $0.00007 | $0.00231 |
| Haiku 4.5 | $0.00004 | $0.00116 |
Grade A, and why
cypress scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cypress (E2E + Component Testing)
Overview
Cypress runs browser automation with first-class network control, time-travel debugging, and a strong local dev workflow. Use it for critical path E2E tests and for component tests when browser-level rendering matters.
Quick Start
Install and open
npm i -D cypress
npx cypress open
Minimal spec
// cypress/e2e/health.cy.ts
describe("health", () => {
it("loads", () => {
cy.visit("/");
cy.contains("Hello").should("be.visible");
});
});
Core Patterns
1) Stable selectors
Prefer data-testid (or data-cy) attributes for selectors. Avoid brittle CSS chains and text-only selectors for critical interactions.
<button data-testid="save-user">Save</button>
cy.get('[data-testid="save-user"]').click();
2) Deterministic waiting (avoid fixed sleeps)
Wait on app-visible conditions or network aliases rather than cy.wait(1000).
cy.intercept("GET", "/api/users/*").as("getUser");
cy.visit("/users/1");
cy.wait("@getUser");
cy.get('[data-testid="user-email"]').should("not.be.empty");
3) Network control with cy.intercept
Stub responses for deterministic tests and speed. Keep a small set of “real backend” smoke tests separate.
cy.intercept("GET", "/api/users/1", {
statusCode: 200,
body: { id: "1", email: "[email protected]" },
}).as("getUser");
4) Authentication strategies
Prefer cy.session to cache login for speed and stability.
// cypress/support/commands.ts
Cypress.Commands.add("login", () => {
cy.session("user", () => {
cy.request("POST", "/api/auth/login", {
email: "[email protected]",
password: "password",
});
});
});
// e2e spec
beforeEach(() => {
cy.login();
});
Component Testing
Run component tests to validate UI behavior in isolation while keeping browser rendering.
npx cypress open --component
// cypress/component/Button.cy.tsx
import React from "react";
import Button from "../../src/Button";
describe("<Button />", () => {
it("clicks", () => {
cy.mount(<Button onClick={cy.stub().as("onClick")}>Save</Button>);
cy.contains("Save").click();
cy.get("@onClick").should("have.been.calledOnce");
});
});
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 187 lines · 37 tokens per session scan A 0c37f52a2e81
cypress is a skill published in the GitHub repository bobmatnyc/claude-mpm-skills (74 stars, last pushed 1mo ago), licensed MIT. It adds 37 tokens to every session and 1,157 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cypress-expert
Expert in Cypress testing framework, custom commands, fixtures, plugins, visual testing, and component testing. Use when the user mentions testing, end-to-end tests, QA, automation, end-to-end testing, or Cypress commands, or when the task involves Cypress Framework, Test Structure, Advanced Features, or Custom…
E2E Testing Patterns
Comprehensive end-to-end testing methodologies and best practices covering architecture, test design, data management, flakiness prevention, and cross-browser strategies.
Flaky Test Doctor
Diagnose flaky test failures from Playwright reports, traces, and rerun history. Classify each failure as product, test, environment, data, or unknown with cited evidence and a proposed fix. Never auto-modifies code without opt-in.
Checkly Monitoring as Code
Teach agents to build synthetic monitoring as code with Checkly, including Playwright browser checks, API checks, alerting, and CI deploy workflows.
e2e-testing
Use when writing or stabilizing Playwright tests that drive a real browser through multi-step journeys — durable locators, web-first assertions, storageState auth, trace/retries, and flakes that only bite in CI. NOT in-process component tests (that is testing-web), NOT WCAG auditing (that is accessibility), NOT the…
End-to-End Database Testing
End-to-end database testing with test containers, data seeding, cleanup strategies, transaction isolation, and production data anonymization.