Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Brad-Fullwood/bc-rig --skill bc-exploratory-testgit clone --depth 1 https://github.com/Brad-Fullwood/bc-rigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/brad-fullwood/bc-rig/bc-exploratory-test)<a href="https://agentmods.dev/skills/brad-fullwood/bc-rig/bc-exploratory-test"><img src="https://agentmods.dev/badge/skills/brad-fullwood/bc-rig/bc-exploratory-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/brad-fullwood/bc-rig/bc-exploratory-test"><img src="https://agentmods.dev/badge/skills/brad-fullwood/bc-rig/bc-exploratory-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00906 |
| Opus 5 | $0.00017 | $0.00453 |
| Sonnet 5 | $0.00007 | $0.00181 |
| Haiku 4.5 | $0.00003 | $0.00091 |
Grade A, and why
bc-exploratory-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BC exploratory testing
Drive the real clients and produce an honest handover. Use the compact referenced workflow; it is faster and materially cheaper than repeated full snapshots or guessed selectors.
Efficient protocol
- Call
browser_session { operation: "start", launchJson: "/absolute/project/.vscode/launch.json" }. Selectconfigurationonly when the project has more than one AL launch entry and the intended entry is not first. Ask the user to complete interactive sign-in in the new isolated window. - Call
browser_session { operation: "status" }; continue when it reportsauth=OK. - Start evidence with
run { operation: "start", label: "specific scope" }. - Call
browser_observein compact mode. It returns a revision and stable controls such as@b7a12f button "New". - Use
browser_actwith the ref. The action already returns semantic changes; do not immediately callbrowser_observeagain. - Use
browser_observe { mode: "query", query: "specific record or field" }for page data omitted by compact mode. Use full mode only to diagnose missing accessibility state. - For polling, pass the prior revision as
since.unchanged rev=…is a complete result—do not request the same state again.
Refs should replace selector trial-and-error. If a ref is stale, observe once and use the new ref. Exact accessible names are available when a ref is unavailable. Raw CSS/Playwright selectors are intentionally not part of the MCP API.
Test loop
- Enumerate the extension-owned pages, fields, actions, and MobileNAV surfaces. Navigate with
browser_act { action: "navigate", url }, observe compact controls, and query specific data. - Exercise every web surface. Rendering alone is observation, not verification: click actions and
fill fields through refs. Capture
browser_screenshotonly when visual evidence adds value. - Probe at least an empty/invalid required field, an action in a blocked state, and a boundary value.
Tool failures are automatically recorded when a run is active; add contextual judgement with
run { operation: "step", ... }when needed. - Exercise MobileNAV when the extension has a mobile surface:
mobile_act { action: "connect", file }imports an.mnlcconfiguration. Do not hand-fill it.- The user completes Microsoft sign-in interactively when required.
mobile_observereturns compact@m…refs. Tap/type throughmobile_actrefs.- After MFA, tap the referenced Login control again to complete MobileNAV's own login.
- Decline an optional PIN unless the test specifically covers it.
- Confirm the company header/module menu before claiming the app is connected.
- Finish with
run { operation: "finish" }, then runbc-rig handover --run latest. Read the Not covered section and close meaningful gaps before delivery.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 66 lines · 34 tokens per session scan A dd94854142a8
bc-exploratory-test is a skill published in the GitHub repository Brad-Fullwood/bc-rig (0 stars, last pushed 1mo ago), licensed MIT. It adds 34 tokens to every session and 906 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
lastest
Lastest is a visual regression testing platform. It records browser tests, runs them via Playwright, diffs screenshots, and uses AI to classify changes. Available as an MCP server for AI agent integration.
playwright-cli
Automate browser interactions, test web pages and work with Playwright tests.
playwright-component-testing
Set up component testing with Playwright using a story gallery — scaffold stories and a gallery dev page driven by the built-in mount fixture, no dedicated component-testing runtime. Use when asked to test React or Vue components in isolation with Playwright, or to migrate off @playwright/experimental-ct-react / -vue.
android-ui-journey-testing
XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.
solopi-ai
A command-line framework for testing Android apps and devices with SoloPi, including on-device or cloud AI decision models. It manages devices, test cases, recorded interactions, replays, performance history, and evidence.
mobile-automation
Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.