Borrowing it
Nothing to install: this file belongs to dwmkerr/signalbox. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dwmkerr/signalbox/main/.claude/skills/integration-test/SKILL.mdgit clone --depth 1 https://github.com/dwmkerr/signalboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dwmkerr/signalbox/integration-test)<a href="https://agentmods.dev/skills/dwmkerr/signalbox/integration-test"><img src="https://agentmods.dev/badge/skills/dwmkerr/signalbox/integration-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dwmkerr/signalbox/integration-test"><img src="https://agentmods.dev/badge/skills/dwmkerr/signalbox/integration-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.05209 |
| Opus 5 | $0.00039 | $0.02604 |
| Sonnet 5 | $0.00015 | $0.01042 |
| Haiku 4.5 | $0.00008 | $0.00521 |
Grade B, and why
integration-test scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`~/.claude/settings.json` for `signalbox hook claude`). Start a shellwright Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s http://127.0.0.1:8399/healthz How it starts
The opening of the file, as written. The whole thing — 474 lines — stays where its author put it; the contents beside it link to each section on GitHub.
signalbox integration evidence run
This is an evidence-gathering run, not a strict test suite. Every step runs
best-effort: if a step fails or times out, record what happened (output +
screenshot + verdict fail or warn) and move on. Never abort the run.
The deliverable is a single self-contained HTML report with screenshots.
Expect the full run to take a long time - that is fine, it is designed as an overnight run.
Conventions (read first)
Paths and environment. All commands run from the repo root. One evidence dir per run:
EVIDENCE="$PWD/scratch/integration/run-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$EVIDENCE"
SB="$PWD/components/cli/bin/signalbox"
Every shell (shellwright sessions included) exports the test environment so the run never touches the real board:
export SIGNALBOX_DATA_DIR="$EVIDENCE/state"
export SIGNALBOX_CONFIG="$EVIDENCE/settings.json"
export SIGNALBOX_URL="http://127.0.0.1:8399"
SIGNALBOX_CONFIG matters as much as the data dir: without it the hub reads
the user's real ~/.config/signalbox/settings.json, and a real
hub.upstream/hub.token will leak into the test (the first hub start comes
up as a forwarder to their remote). Pointing it at a non-existent file in the
evidence dir means pure defaults.
Ports for this run: 8399 local hub, 8410 remote/upstream hub, 8420
forwarder. Space them out: LAN mode opens a second TLS listener on port+1
(8399 -> https on 8400, pinned self-signed cert), so adjacent ports collide.
Token for authenticated scenarios: itest-token.
Evidence per step. Each step gets a directory $EVIDENCE/NN-slug/
containing:
meta.json-{"title": "...", "verdict": "pass|warn|fail", "commands": ["..."], "notes": "one or two sentences: what was checked, what the evidence shows"}output.txt- captured command output (optional but preferred)*.png- screenshots, in the order they should appear
Screenshots of shell sessions come from shellwright's shell_screenshot;
save or copy the PNG into the step dir. Screenshots of the app come from
screencapture (see the app step).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 474 lines · 77 tokens per session scan B 2623b09721ff
integration-test is a skill published in the GitHub repository dwmkerr/signalbox (20 stars, last pushed 2d ago), licensed MIT. It adds 77 tokens to every session and 5,209 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ui-aqa-flow
Workflow for automated QA: integration and end-to-end UI test automation, page objects, etc.
qa-knowledge
To run QA engineering — requirements/gap analysis, scenario & spec design, test implementation, failure triage — over the QA knowledge base.
e2e-runner
End-to-end testing specialist using Vercel Agent Browser or Playwright.
dev-testing
A testing guide that defines when to use unit, integration, API, and end-to-end tests. Unit tests check small pieces of code, while end-to-end tests check a full user flow.
dev-scenario-test
A specification for scenario testing, covering end-to-end tests, integration tests, and Artillery load tests. The input does not provide further details about its exact setup or outputs.
playwright-setup
Scan project docs/source, interview user, create Playwright E2E test specs + config from scratch for any app.