Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add decocms/studio --skill qa-screenshotgit clone --depth 1 https://github.com/decocms/studioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/decocms/studio/qa-screenshot)<a href="https://agentmods.dev/skills/decocms/studio/qa-screenshot"><img src="https://agentmods.dev/badge/skills/decocms/studio/qa-screenshot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/decocms/studio/qa-screenshot"><img src="https://agentmods.dev/badge/skills/decocms/studio/qa-screenshot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.00612 |
| Opus 5.5 | $0.00020 | $0.00245 |
| Sonnet 5.5 | $0.00010 | $0.00122 |
| Haiku 4.5 | $0.00005 | $0.00061 |
Grade A, and why
qa-screenshot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
qa-screenshot — see the change, then show it
A browser is installed globally in the sandbox, NOT in the repo's
node_modules — don't go looking for playwright there.
Capture
qa-screenshot <url> /app/org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]
- Renders any URL, localhost included, in headless Chromium and runs the page's JS.
- Framing: default is the top viewport,
--fullthe whole page,--selector='<css>'just the component you changed (best for a focused before/after). --mobileis a real phone viewport AND a mobile user-agent, not a narrowed desktop. Capture both desktop and mobile for a responsive change.--consolealso reports the page's runtime errors, which a screenshot alone shows as a pass.- Deep-link to the page the change affects, not the site root.
- No dev server runs by default. Start one yourself to capture localhost.
--engine=webkitrenders in WebKit (Safari's engine) — use it when a mobile scroll, snap or animation quirk could be engine-specific, or when asked to check Safari. It is not a real iPhone or Mac: report it as "checked in WebKit", not as tested on iOS or Safari.
Look at it
Read every file you wrote. A screenshot you never opened is not verification.
Show it
Write under /app/org/output/ and embed the shots in your task comment as markdown
images. Only that form renders on the card; a bare path or a code span shows
the reader nothing. Put a before/after pair in a two-column table so they
render side by side:
| Before | After |
| --- | --- |
|  |  |
Interact
To click, fill a form or hit-test with document.elementFromPoint, write a
throwaway node script against the global playwright-core:
const { chromium } = require("/usr/local/lib/node_modules/playwright-core");
const browser = await chromium.launch({
executablePath: "/usr/bin/chromium",
args: ["--no-sandbox"],
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 59 lines · 50 tokens per session scan A b19a14810819
qa-screenshot is a skill published in the GitHub repository decocms/studio (409 stars, last pushed today), licensed MIT. It adds 50 tokens to every session and 612 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-07.
Other skills, from other repositories
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
browser-qa
Testing web apps through a real browser: reconnaissance before acting, selector discovery, state capture, console errors and screenshot evidence. Use on a web surface end to end, or to reproduce a front-end bug.
web-system-tests
The web realization of the system-tests contract — browser-driven system tests with Playwright against a running frontend. Owns the project layout (tests/), the Playwright configuration (baseURL plus webServer, cross-engine projects), the role- and label-based selector policy, code coverage as an opt-in second run…
pn-smoke-tests
Run smoke or E2E tests, debug failures, and verify fixes. Use for end-to-end verification before or after changes.
webapp-testing
Web application testing principles. E2E, Playwright, deep audit strategies.
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.