Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/eunomia-bpf/agentsight/agentsight-testingnpx skills add eunomia-bpf/agentsight --skill agentsight-testinggit clone --depth 1 https://github.com/eunomia-bpf/agentsightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eunomia-bpf/agentsight/agentsight-testing)<a href="https://agentmods.dev/skills/eunomia-bpf/agentsight/agentsight-testing"><img src="https://agentmods.dev/badge/skills/eunomia-bpf/agentsight/agentsight-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01135 |
| Opus 5 | $0.00030 | $0.00567 |
| Sonnet 5 | $0.00012 | $0.00227 |
| Haiku 4.5 | $0.00006 | $0.00113 |
Grade A, and why
agentsight-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentSight Testing
Goal
Prove that an AgentSight change works at the product boundary, not only at the unit-test boundary. Prefer real binaries, real commands, and saved evidence. Mocks are allowed only for narrow regression tests; they do not replace real agent validation when the relevant CLI is installed and authenticated.
CI can supplement this proof, but it does not replace direct observation. The agent doing the change must inspect the TUI/UI/CLI output or saved artifacts itself and report what was observed. Do not defer missing observation to "the next PR" or say CI should cover it unless the user explicitly narrows the task to CI work.
Validation Ladder
Run the narrowest relevant check first, then widen until the changed behavior has been exercised end to end.
- Unit/regression tests:
cargo test --manifest-path collector/Cargo.toml <test_name> -- --nocapturecargo test --manifest-path ext/session/Cargo.toml <test_name> -- --nocapture
- Component suites:
cargo test --manifest-path collector/Cargo.tomlcargo test --manifest-path ext/session/Cargo.tomlcd frontend && npm run lint && npm run build
- CLI command smoke:
collector/target/debug/agentsight top --plain --oncecollector/target/debug/agentsight report listcollector/target/debug/agentsight report summarycollector/target/debug/agentsight report tokencollector/target/debug/agentsight stat -- <short command>when the change affects stat/record paths
- TUI smoke:
- Run
agentsight topin a real terminal or PTY. - Capture the screen text or screenshot artifact. Prefer terminal buffer
capture such as
tmux capture-pane,scriptoutput that includes the rendered screen, or a real screenshot; raw alt-screen escape logs without readable fields are not sufficient. - Verify key fields by screen buffer/text, not OCR: session id, agent, state, tokens, last message, model, evidence.
- Run
- Web UI smoke:
- Start a command that serves the web UI (
record,stat, or the relevant server mode). - Open the URL in a browser or Playwright.
- Verify the page loads real session/event data and save a screenshot artifact.
- The screenshot/artifact must show the relevant feature state, not only that a page rendered or that some JSON endpoint returned data.
- Start a command that serves the web UI (
- Real supported-agent smoke:
- Check installed/authenticated CLIs with
command -v. - Native session agents:
claude,codex,gemini. - Live/record targets from README support: Claude Code, Codex, Gemini CLI, OpenCode, OpenClaw/Node/OpenAI-compatible clients, and any command path touched by the change.
- For each available CLI, run a short non-destructive prompt under AgentSight and verify the expected rows/events. Do not count a mock agent as satisfying this step.
- Seeing generic captured data is not enough. Verify the product-level fields affected by the change, such as prompt text, response/last message, token counts, model, session binding, tool calls, evidence, and report/top rows.
- Check installed/authenticated CLIs with
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 97 lines · 60 tokens per session scan A 8a563b2eb656
agentsight-testing is a skill published in the GitHub repository eunomia-bpf/agentsight (663 stars, last pushed 4d ago), licensed MIT. It adds 60 tokens to every session and 1,135 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prometheus
Prometheus monitoring expert for PromQL, alerting rules, Grafana dashboards, and observability.
edgeone skill scanner
Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your device. Compatible with CodeBuddy, Cursor, Windsurf, Claude Code, OpenClaw and more. Triggers on: 这个 skill 安全吗, skill 安全扫描…
continual-learning
Nightly refinement of an existing per-repo review-style prompt using this reviewer's own finding outcomes. Read confirmed (resolved-by-commit / thumbs-up) and dismissed (thumbs-down) findings, promote the bug patterns the team actually fixes, demote the false-positive patterns, reconcile against the current prompt…
nano-banana-pro-openrouter
Deterministic OpenRouter image generation adapter for Nano Banana Pro / Gemini image models. Use as skillexec when a meta-skill needs local image files and structured IMAGEREADY records without spawning an LLM agent.
skill-creator-linter
Internal tool (not user-invocable). Called by meta-skill-creator as a DAG step (kind: agent) to lint a candidate meta-skill SKILL.md against G1 (parse + reference check + xmlescape grep + structural lint) and G2 (scheduler dry-run with stub executors). Deterministic, sub-second, no LLM. Returns JSON diagnostics.
paper-abstract-author
Write the abstract after the paper body has been revised, using the final claims and evidence.