Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CopilotKit/aimock --skill write-fixturesgit clone --depth 1 https://github.com/CopilotKit/aimockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/copilotkit/aimock/write-fixtures)<a href="https://agentmods.dev/skills/copilotkit/aimock/write-fixtures"><img src="https://agentmods.dev/badge/skills/copilotkit/aimock/write-fixtures/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/copilotkit/aimock/write-fixtures"><img src="https://agentmods.dev/badge/skills/copilotkit/aimock/write-fixtures.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 48 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Prompt Injection · line 132 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Tool Misuse · line 658 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Memory Poisoning · line 22 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 24 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 25 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 28 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 29 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 30 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 31 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 32 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 34 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 35 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 36 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 37 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 40 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Memory Poisoning · line 41 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Prompt Injection · line 22 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 24 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 25 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.15592 |
| Opus 5.5 | $0.00019 | $0.06237 |
| Sonnet 5.5 | $0.00010 | $0.03118 |
| Haiku 4.5 | $0.00005 | $0.01559 |
Grade C, and why
write-fixtures scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- prettier-ignore --> How it starts
The opening of the file, as written. The whole thing — 1,041 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Writing aimock Test Fixtures
What aimock Is
aimock is a zero-dependency mock infrastructure for AI apps. Fixture-driven. Multi-provider (OpenAI, Anthropic, Gemini, Gemini Interactions, AWS Bedrock, Azure OpenAI, Vertex AI, Ollama, Cohere, OpenRouter). Multimedia endpoints (image generation, text-to-speech, audio transcription, video generation). MCP, A2A, AG-UI, and vector DB mocking. Runs a real HTTP server on a real port — works across processes, unlike MSW-style interceptors. WebSocket support for OpenAI Responses/Realtime and Gemini Live APIs. Record-and-replay for all endpoints including multimedia. Chaos testing and Prometheus metrics.
Core Mental Model
- Fixtures = match criteria + response
- First-match-wins — order matters
- All providers share one fixture pool (provider adapters normalize to
ChatCompletionRequest) - Fixtures are live — mutations after
start()take effect immediately - Sequential responses are supported via
sequenceIndex(match count tracked per fixture)
Match Field Reference
| Field | Type | Matches Against |
|---|---|---|
userMessage |
string |
Substring of last role: "user" message text |
userMessage |
RegExp |
Pattern test on last role: "user" message text |
systemMessage |
string |
Substring of the concatenated text of every role: "system" message in the request. Use to gate a fixture on host-supplied context (persona, agent-context entries) so changes to that context cause the fixture to fall through instead of returning a stale baked response |
systemMessage |
string[] |
Array of substrings — ALL must be present in the joined system text (AND semantics). Use when the gate must combine multiple non-adjacent tokens whose serialisation order isn't stable |
systemMessage |
RegExp |
Pattern test on the concatenated system-message text |
inputText |
string |
Substring of embedding input text (concatenated if multiple inputs) |
inputText |
RegExp |
Pattern test on embedding input text |
embeddingRequest |
{ operation, input, dimensions? } |
Exact operation (/api/embed, /api/embeddings or /v1/embeddings), input shape and requested dimensions. Recordings set it alongside inputText and model so batches and widths stay distinct; omit it for broad embedding fixtures |
toolName |
string |
Exact match on any tool in request's tools[] array (by function.name). On the OpenAI Responses API, with responsesTools: "extended", this also includes tools inside a namespace tool, custom tools (by name, in req.customTools), and tools in an additional_tools or tool_search_output input item; by default only top-level function tools, as in 1.44.0. Other Responses tool types (web_search, mcp, ...) are not visible |
toolNamespace |
string |
Exact OpenAI Responses tool namespace; needs responsesTools: "extended" (ignored otherwise). Alone: any offered tool sits in it. With toolName: one offered tool must carry both (Codex routes by this exact pair). No default namespace is assumed. Chat Completions passes request tools through, so a client-sent top-level namespace there also matches. With "extended" (aimock validate --responses-tools extended), aimock validate and --validate-on-load warn about a file fixture with toolNamespace and an endpoint other than "chat". A Responses namespace tool with an empty or missing name is dropped. Codex names an MCP server's namespace mcp__<server> (no trailing __). aimock-pytest needs aimock 1.45.0+, its default pin from 0.7.0 |
toolCallId |
string |
Exact match on tool_call_id of last role: "tool" message |
toolResultContains |
string |
Substring of the last tool message's text content, gated on that message being the request's LAST message (same rule as toolCallId). Discriminates resume paths that share a tool_call_id and differ only inside the tool-result payload (e.g. approve {"chosen_time": …} vs cancel {"cancelled": true}) |
model |
string |
Exact match on req.model |
model |
RegExp |
Pattern test on req.model |
responseFormat |
string |
Exact match on req.response_format.type ("json_object", "json_schema") |
sequenceIndex |
number |
Matches only when this fixture's match count equals the given index (0-based) |
turnIndex |
number |
Stateless conversation-depth matching. Counts role: "assistant" messages in the request; matches when that count equals the value. turnIndex: 0 = first turn (no prior assistant messages). Use instead of sequenceIndex for shared/deployed instances where stateful counters break under concurrency |
hasToolResult |
boolean |
Stateless tool-message presence matching, scoped to the CURRENT turn (messages after the last role: "user" message). true matches when a role: "tool" message appears after the last user message; false matches when none does. (If the request has no user message, the whole conversation is scanned.) Provider-consistent across all aimock handlers (OpenAI, Claude, Gemini, Bedrock, Ollama, Cohere) |
endpoint |
string |
Restrict to endpoint type: "chat", "image", "speech", "transcription", "video", "embedding" |
predicate |
(req: ChatCompletionRequest) => boolean |
Custom function — full access to request |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +32 lines a711ab3d8f01
- 6d ago Changed · +8 lines 6c4e566af9af
- 14d ago Changed · +1 lines 3017eec29f15
- 16d ago Changed · +1 lines a5abe7ba72a5
- 17d ago Changed · +157 lines 70e10edf4312
- 1mo ago First seen · 842 lines · 48 tokens per session scan C db712b41365e
write-fixtures is a skill published in the GitHub repository CopilotKit/aimock (988 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 15,592 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
credit-note-fixer
Fix the tiny credit-note formatting bug and rerun the exact targeted test command.
langbot-testing
Test LangBot WebUI and core product flows with an automated browser and backend logs. Use when validating the configured LangBot frontend, pipeline Debug Chat, model provider setup and test buttons, bot and knowledge-base UI flows, or troubleshooting failed LangBot end-to-end tests.
ax-agent-optimize
This skill helps an LLM generate correct AxAgent tuning and evaluation code using @ax-llm/ax. Use when the user asks about agent.optimize(...), judgeOptions, eval datasets, optimization targets, saved optimizedProgram artifacts, or agent optimization guidance.
develop-ai-functions-example
Develop examples for AI SDK functions. Use when creating, running, or modifying examples under examples/ai-functions/src to validate provider support, demonstrate features, or create test fixtures.
capture-api-response-test-fixture
For provider response parsing tests, we aim at storing test fixtures with the true responses from the providers (unless they are too large in which case some cutting that does not change semantics is advised).
add-function-examples
Guide for adding new AI function examples, for testing specific features against the actual provider APIs.