EmDash is a content management system for creating and managing websites, built with TypeScript and Astro and deployable on Cloudflare or Node.js with SQLite. It is for site owners and developers who want WordPress-like administration, templates, and plugins without PHP or separate hosting.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add emdash-cms/emdash --skill repro-admingit clone --depth 1 https://github.com/emdash-cms/emdashWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/emdash-cms/emdash/repro-admin)<a href="https://agentmods.dev/skills/emdash-cms/emdash/repro-admin"><img src="https://agentmods.dev/badge/skills/emdash-cms/emdash/repro-admin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/emdash-cms/emdash/repro-admin"><img src="https://agentmods.dev/badge/skills/emdash-cms/emdash/repro-admin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01252 |
| Opus 5.5 | $0.00019 | $0.00501 |
| Sonnet 5.5 | $0.00010 | $0.00250 |
| Haiku 4.5 | $0.00005 | $0.00125 |
Grade A, and why
repro-admin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reproduce: Admin UI
The bug is in the React admin under /_emdash/admin/*. You need a running demo, an authenticated session, and a way to drive the UI through the reporter's steps. Reproduce and confirm entirely through agent-browser: the durable artifacts are your screenshots plus a precise, replayable transcript. Do not write Playwright or any other browser test -- you cannot run one reliably here, so an unrun test is unverified guesswork. The regression test belongs to whoever lands the fix.
Environment
Everything in this skill runs in an attached container -- the dev server, agent-browser, and any CLI seeding all need node and a browser, none of which exist in the isolate. Do your issue-reading and any source grepping in the isolate first, then attach the container for the reproduction itself.
Do not
- No
git commit,git push, or branch creation. - No GitHub writes. Read-only API GETs only.
- No network beyond
localhost(the demo) and the proxy-signed GitHub API. - Touch no issue other than the one being investigated.
- Do not modify Lingui catalogs (
packages/admin/src/locales/*/messages.po) -- a workflow regenerates them on merge; touching them here is churn.
Procedure
- Re-read the issue (isolate). Note the exact steps, the page, the browser, and any screenshots or stack traces. If the steps reference a collection or content item, decide whether the default demo seed covers it or whether you must create content first.
- Pick a demo.
demos/simpleis the default and covers most admin reproductions. Use a more specific demo only when the issue names one. - Attach a container and start the demo dev server. Astro 7 backgrounds dev servers natively -- from the demo directory run
astro dev --background(e.g.pnpm --filter ./demos/simple exec astro dev --background). It detaches, enables JSON logging, and returns once the server is up, so you do not poll or improvise process management. Read the URL/port/PID and readiness from the.astro/dev.jsonlock file orastro dev status; Astro serves the demo onlocalhost:4321. Tail output withastro dev logs --follow. If the server never comes up, captureastro dev logsand treat that as a setup failure, not a reproduction. Stop it withastro dev stopwhen done (or just leave it -- it dies with the container). - Get a session. Point agent-browser at the dev-bypass endpoint:
agent-browser open "http://localhost:4321/_emdash/api/setup/dev-bypass?redirect=/_emdash/admin". This runs migrations, creates the dev admin user ([email protected]), sets a session cookie, and lands you on the admin home. The endpoint is gated toimport.meta.env.DEV, so it exists only locally -- never against a deployed environment. - Drive the UI.
agent-browser snapshot -i -cgives an accessibility tree with@e<n>refs. Interact withclick @e<n>,fill @e<n> "text",select @e<n> "option". Refs are stable only within one snapshot -- re-snapshot after every navigation or DOM change. - Screenshot at meaningful steps. Save to
.bot-artifacts/step-<n>.png: one on landing, one at the point the reporter says the bug appears, one of the broken state. Use--fullonly when the bug is below the fold. Keep file sizes reasonable. - Watch for JS errors. After each interaction run
agent-browser consoleandagent-browser errors. React key warnings and unmounted-setState noise are almost never the bug; runtime exceptions usually are. - Confirm the failure mode matches. A different broken state is not a reproduction. If you can only reach an adjacent broken state, say so. Write the exact replayable sequence -- URL, refs/selectors, inputs, observed broken state -- so a maintainer can follow it without you.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 55 lines · 48 tokens per session scan A e1d44b775367
repro-admin is a skill published in the GitHub repository emdash-cms/emdash (13,719 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 1,252 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
adversarial-reviewer
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart. Do not use for ordinary review, style feedback, or general improvement suggestions.
webiny-api-logger-catalog
Name: Logger Import: import { Logger } from "webiny/api/logger" Source: @webiny/api-core/features/logger/index.ts Description: Structured logging with multiple log levels.
creating-plugins
Create EmDash CMS plugins with sandboxed hooks, routes, storage, content and media APIs, MCP tools, and declarative admin UI, or native React and Astro extensions. Use when scaffolding or implementing an EmDash plugin.
emdash-cli
Use the EmDash CLI to inspect and manage an EmDash instance from the command line, including content, schema, media, taxonomies, menus, search, authentication, seeds, migrations, generated types, and whole-site export and import.
building-emdash-site
Build the site-facing parts of an EmDash CMS project on Astro, including schema and seeds, content queries, Portable Text rendering, menus, taxonomies, widgets, and deployment configuration. Use for EmDash site and theme work; use creating-plugins instead when the task is plugin authoring alone.
wordpress-plugin-to-emdash
Analyze and port WordPress plugin behavior, custom post types, shortcodes, admin workflows, and stored data to current EmDash extension points. Use for WordPress-plugin migrations or when deciding which behavior belongs in an EmDash plugin, site schema, seed, or Astro code. Do not use for visual theme ports without…