Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add chen3feng/agent-skills --skill sidecar-smoke-suite-reveals-upstream-bugsgit clone --depth 1 https://github.com/chen3feng/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chen3feng/agent-skills/sidecar-smoke-suite-reveals-upstream-bugs)<a href="https://agentmods.dev/skills/chen3feng/agent-skills/sidecar-smoke-suite-reveals-upstream-bugs"><img src="https://agentmods.dev/badge/skills/chen3feng/agent-skills/sidecar-smoke-suite-reveals-upstream-bugs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chen3feng/agent-skills/sidecar-smoke-suite-reveals-upstream-bugs"><img src="https://agentmods.dev/badge/skills/chen3feng/agent-skills/sidecar-smoke-suite-reveals-upstream-bugs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.02779 |
| Opus 5 | $0.00018 | $0.01389 |
| Sonnet 5 | $0.00007 | $0.00556 |
| Haiku 4.5 | $0.00004 | $0.00278 |
Grade A, and why
sidecar-smoke-suite-reveals-upstream-bugs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sidecar smoke suites reveal upstream bugs — handshake order matters
When to use
You maintain an upstream library / build tool / framework and a separate sidecar repository that consumes it end-to-end against real fixture projects (an integration workspace, example repo, regression harness, plugin host, ...).
You are either:
- About to add a new suite to the sidecar and it fails on a real host in a way that looks like an upstream bug — not a bug in the fixture; or
- Already triaging such a failure and asking yourself "do I work around this in the sidecar, or fix upstream?".
Signal phrases: "it works in upstream's own tests but breaks here",
"the unit tests never hit this path", "the failure only shows up
on macOS / on ubuntu-22.04 / without python on PATH".
This skill is about what to do with the discovery, not about how to paper over it. For the paper-over-then-clean-up flow, see reverse-cleanup-after-upstream-fix.
Problem
Unit tests in the upstream repo protect the functions they cover, but they rarely exercise:
- The bootstrap shell a tool emits (a
#!/bin/shwrapper, anexec python -m …launcher) — because the unit test process already haspython/sh/ the rightPATH. - Environment assumptions of the deployed artifact —
pythonvspython3, GNUsedvs BSDsed,/usr/bin/gccbeing Apple Clang. - Cross-platform skew between the CI matrix and real user
hosts — the CI runner has
pythononPATH, macOS 14 does not. - The composition of features — unit tests cover
py_libraryalone andpy_testalone; neither catches a launcher bug that only manifests when apy_testruns a real subprocess that itself runs a shell.
A sidecar repo that builds real fixtures with the real tool on a real host finds these bugs by existing. The moment you add a second language / a second platform / a second Python minor, the uncovered path light up.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 244 lines · 37 tokens per session scan A 94b5ff6579e7
sidecar-smoke-suite-reveals-upstream-bugs is a skill published in the GitHub repository chen3feng/agent-skills (5 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 37 tokens to every session and 2,779 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Flaky Test Doctor
Diagnose flaky test failures from Playwright reports, traces, and rerun history. Classify each failure as product, test, environment, data, or unknown with cited evidence and a proposed fix. Never auto-modifies code without opt-in.
Checkly Monitoring as Code
Teach agents to build synthetic monitoring as code with Checkly, including Playwright browser checks, API checks, alerting, and CI deploy workflows.
CI Test Sharding Parallelization
Teach agents to shard and parallelize Playwright, Jest, and pytest suites in CI to reduce wall-clock time while merging reports reliably.
e2e-testing
Use when writing or stabilizing Playwright tests that drive a real browser through multi-step journeys — durable locators, web-first assertions, storageState auth, trace/retries, and flakes that only bite in CI. NOT in-process component tests (that is testing-web), NOT WCAG auditing (that is accessibility), NOT the…
playwright-cli
Automate browser interactions, test web pages and work with Playwright tests.
Browser Smoke Testing
Open a local web target and verify that the main page renders and core controls respond.