Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/emdash-cms/emdash/repro-adminnpx skills add emdash-cms/emdash --skill repro-admingit clone --depth 1 https://github.com/emdash-cms/emdashWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01252 |
| Opus 5 | $0.00024 | $0.00626 |
| Sonnet 5 | $0.00010 | $0.00250 |
| Haiku 4.5 | $0.00005 | $0.00125 |
Grade A, and why
repro-admin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reproduce: Admin UI
The bug is in the React admin under /_emdash/admin/*. You need a running demo, an authenticated session, and a way to drive the UI through the reporter's steps. Reproduce and confirm entirely through agent-browser: the durable artifacts are your screenshots plus a precise, replayable transcript. Do not write Playwright or any other browser test -- you cannot run one reliably here, so an unrun test is unverified guesswork. The regression test belongs to whoever lands the fix.
Environment
Everything in this skill runs in an attached container -- the dev server, agent-browser, and any CLI seeding all need node and a browser, none of which exist in the isolate. Do your issue-reading and any source grepping in the isolate first, then attach the container for the reproduction itself.
Do not
- No
git commit,git push, or branch creation. - No GitHub writes. Read-only API GETs only.
- No network beyond
localhost(the demo) and the proxy-signed GitHub API. - Touch no issue other than the one being investigated.
- Do not modify Lingui catalogs (
packages/admin/src/locales/*/messages.po) -- a workflow regenerates them on merge; touching them here is churn.
Procedure
- Re-read the issue (isolate). Note the exact steps, the page, the browser, and any screenshots or stack traces. If the steps reference a collection or content item, decide whether the default demo seed covers it or whether you must create content first.
- Pick a demo.
demos/simpleis the default and covers most admin reproductions. Use a more specific demo only when the issue names one. - Attach a container and start the demo dev server. Astro 7 backgrounds dev servers natively -- from the demo directory run
astro dev --background(e.g.pnpm --filter ./demos/simple exec astro dev --background). It detaches, enables JSON logging, and returns once the server is up, so you do not poll or improvise process management. Read the URL/port/PID and readiness from the.astro/dev.jsonlock file orastro dev status; Astro serves the demo onlocalhost:4321. Tail output withastro dev logs --follow. If the server never comes up, captureastro dev logsand treat that as a setup failure, not a reproduction. Stop it withastro dev stopwhen done (or just leave it -- it dies with the container). - Get a session. Point agent-browser at the dev-bypass endpoint:
agent-browser open "http://localhost:4321/_emdash/api/setup/dev-bypass?redirect=/_emdash/admin". This runs migrations, creates the dev admin user ([email protected]), sets a session cookie, and lands you on the admin home. The endpoint is gated toimport.meta.env.DEV, so it exists only locally -- never against a deployed environment. - Drive the UI.
agent-browser snapshot -i -cgives an accessibility tree with@e<n>refs. Interact withclick @e<n>,fill @e<n> "text",select @e<n> "option". Refs are stable only within one snapshot -- re-snapshot after every navigation or DOM change. - Screenshot at meaningful steps. Save to
.bot-artifacts/step-<n>.png: one on landing, one at the point the reporter says the bug appears, one of the broken state. Use--fullonly when the bug is below the fold. Keep file sizes reasonable. - Watch for JS errors. After each interaction run
agent-browser consoleandagent-browser errors. React key warnings and unmounted-setState noise are almost never the bug; runtime exceptions usually are. - Confirm the failure mode matches. A different broken state is not a reproduction. If you can only reach an adjacent broken state, say so. Write the exact replayable sequence -- URL, refs/selectors, inputs, observed broken state -- so a maintainer can follow it without you.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 55 lines · 48 tokens per session scan A e1d44b775367
repro-admin is a skill published in the GitHub repository emdash-cms/emdash (12,159 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 1,252 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wordpress-plugin-to-emdash
Port a WordPress plugin to EmDash CMS. Use this skill when asked to migrate, convert, or port a WordPress plugin, theme functionality, or custom post type to EmDash. Provides concept mapping and implementation patterns.
emdash-cli
Use the EmDash CLI to manage content, schema, media, and more. Use this skill when you need to interact with a running EmDash instance from the command line — creating content, managing collections, uploading media, generating types, or scripting CMS operations.
building-emdash-site
Build and customize EmDash CMS sites on Astro. Use when creating pages, defining collections, writing seed files, querying content, rendering Portable Text, setting up menus/taxonomies/widgets, configuring deployment, or any task involving an EmDash-powered Astro site. Assumes basic Astro knowledge but provides all…
emdash-github-actions
Sets up GitHub Actions CI/CD workflows for EmDash plugins — TypeScript type-checking, ESLint linting, Vitest testing, npm publishing, and automated releases. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an EmDash…
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
agent-browser
Browser automation for testing and verification. Use when you need to interact with web UIs, verify visual changes, fill forms, or capture screenshots.