Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dragoon0x/dragoon-skills/diffnpx skills add Dragoon0x/dragoon-skills --skill diffgit clone --depth 1 https://github.com/Dragoon0x/dragoon-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dragoon0x/dragoon-skills/diff)<a href="https://agentmods.dev/skills/dragoon0x/dragoon-skills/diff"><img src="https://agentmods.dev/badge/skills/dragoon0x/dragoon-skills/diff.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.00329 |
| Opus 5 | $0.00046 | $0.00164 |
| Sonnet 5 | $0.00018 | $0.00066 |
| Haiku 4.5 | $0.00009 | $0.00033 |
Grade A, and why
diff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/diff
Scaffolds visual regression with playwright snapshots.
When to use
- The user wants visual regression coverage
- "Set up screenshot diffing", "snapshot tests", "pixel diff"
- Before any major UI refactor
What it writes
playwright.visual.config.tssnapshot-tuned configtests/visual/routes.tslist of routes to capture (default/)tests/visual/snapshots.spec.tsspec that loops routes and runstoHaveScreenshot
Pixel diffing is done by playwright's built-in toHaveScreenshot, not by dragoon. We just generate the harness.
Run it
dragoon diff
dragoon diff --apply
dragoon diff --apply --routes "/,/about,/login"
Then
npm i -D @playwright/test
npx playwright install --with-deps chromium
npx playwright test tests/visual --update-snapshots # first time, baselines
npx playwright test tests/visual # after that, regression
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 41 lines · 92 tokens per session scan A 5509599b6d0b
diff is a skill published in the GitHub repository Dragoon0x/dragoon-skills (4 stars, last pushed 4mo ago), licensed MIT. It adds 92 tokens to every session and 329 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tauri-pilot
Inspect, interact with, and test a running Tauri v2 app via CLI. Communicates over Unix socket using JSON-RPC 2.0. Use when testing UI, automating interactions, or debugging a Tauri app.
form-validation-scan
Probe the forms on a page for validation gaps — missing required-field enforcement, no client-side validation, accepts malformed input, and absent error messaging. Reports per-field findings. Playwright MCP only, no signup.
broken-link-scan
Find broken links on any website. Crawls the page, checks every link for 404s, redirects, and timeouts. Reports dead links with their location. Uses Playwright MCP only — no signup.
chrome-ext-testing
This skill should be used when writing or setting up tests for a Chrome extension. Trigger when: "test chrome extension", "extension unit test", "extension e2e test", "Vitest extension", "Playwright extension", "@webext-core/fake-browser", "test content script", "test service worker", "test messaging", "test storage"…
sigil-audit
The auditor crawls every /docs/components/ page on the local dev server and combines static MDX analysis with a real Chromium browser pass.
qa-explore
Exploratory end-to-end QA with a team of agents that drive a real browser like human testers — they click through the whole app, create/fill/submit, screenshot and visually judge rendering + data correctness, capture trace/HAR/console/video evidence, adversarially verify each finding, learn from rejected findings, and…