Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add eunomia-bpf/agentsight --skill agentsight-testinggit clone --depth 1 https://github.com/eunomia-bpf/agentsightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eunomia-bpf/agentsight/agentsight-testing)<a href="https://agentmods.dev/skills/eunomia-bpf/agentsight/agentsight-testing"><img src="https://agentmods.dev/badge/skills/eunomia-bpf/agentsight/agentsight-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eunomia-bpf/agentsight/agentsight-testing"><img src="https://agentmods.dev/badge/skills/eunomia-bpf/agentsight/agentsight-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01135 |
| Opus 5.5 | $0.00024 | $0.00454 |
| Sonnet 5.5 | $0.00012 | $0.00227 |
| Haiku 4.5 | $0.00006 | $0.00113 |
Grade A, and why
agentsight-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentSight Testing
Goal
Prove that an AgentSight change works at the product boundary, not only at the unit-test boundary. Prefer real binaries, real commands, and saved evidence. Mocks are allowed only for narrow regression tests; they do not replace real agent validation when the relevant CLI is installed and authenticated.
CI can supplement this proof, but it does not replace direct observation. The agent doing the change must inspect the TUI/UI/CLI output or saved artifacts itself and report what was observed. Do not defer missing observation to "the next PR" or say CI should cover it unless the user explicitly narrows the task to CI work.
Validation Ladder
Run the narrowest relevant check first, then widen until the changed behavior has been exercised end to end.
- Unit/regression tests:
cargo test --manifest-path collector/Cargo.toml <test_name> -- --nocapturecargo test --manifest-path ext/session/Cargo.toml <test_name> -- --nocapture
- Component suites:
cargo test --manifest-path collector/Cargo.tomlcargo test --manifest-path ext/session/Cargo.tomlcd frontend && npm run lint && npm run build
- CLI command smoke:
collector/target/debug/agentsight top --plain --oncecollector/target/debug/agentsight report listcollector/target/debug/agentsight report summarycollector/target/debug/agentsight report tokencollector/target/debug/agentsight stat -- <short command>when the change affects stat/record paths
- TUI smoke:
- Run
agentsight topin a real terminal or PTY. - Capture the screen text or screenshot artifact. Prefer terminal buffer
capture such as
tmux capture-pane,scriptoutput that includes the rendered screen, or a real screenshot; raw alt-screen escape logs without readable fields are not sufficient. - Verify key fields by screen buffer/text, not OCR: session id, agent, state, tokens, last message, model, evidence.
- Run
- Web UI smoke:
- Start a command that serves the web UI (
record,stat, or the relevant server mode). - Open the URL in a browser or Playwright.
- Verify the page loads real session/event data and save a screenshot artifact.
- The screenshot/artifact must show the relevant feature state, not only that a page rendered or that some JSON endpoint returned data.
- Start a command that serves the web UI (
- Real supported-agent smoke:
- Check installed/authenticated CLIs with
command -v. - Native session agents:
claude,codex,gemini. - Live/record targets from README support: Claude Code, Codex, Gemini CLI, OpenCode, OpenClaw/Node/OpenAI-compatible clients, and any command path touched by the change.
- For each available CLI, run a short non-destructive prompt under AgentSight and verify the expected rows/events. Do not count a mock agent as satisfying this step.
- Seeing generic captured data is not enough. Verify the product-level fields affected by the change, such as prompt text, response/last message, token counts, model, session binding, tool calls, evidence, and report/top rows.
- Check installed/authenticated CLIs with
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 97 lines · 60 tokens per session scan A 8a563b2eb656
agentsight-testing is a skill published in the GitHub repository eunomia-bpf/agentsight (754 stars, last pushed yesterday), licensed MIT. It adds 60 tokens to every session and 1,135 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-prs
Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…
fix-failing-tests
Diagnose a failing test in the googleapis/mcp-toolbox repo and land a fix by reasoning from the actual error: read the failure, reproduce it, shrink it until the cause is forced into the open, then fix the cause. Use this whenever a test or CI job is red, a build breaks after a change, many packages fail at once, or a…
reproduce-bug
Reproduce a reported bug in googleapis/mcp-toolbox and decide whether it is real, delivering an evidence-backed verdict: confirmed, already fixed, misconfiguration, client-side, works as intended, not reproducible, or blocked. Use whenever a maintainer asks you to reproduce, verify, confirm, or investigate a bug…
tool-abuse-detection
Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.
dev-browser
Browser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website"…
langbot-testing
Test LangBot WebUI and core product flows with an automated browser and backend logs. Use when validating the configured LangBot frontend, pipeline Debug Chat, model provider setup and test buttons, bot and knowledge-base UI flows, or troubleshooting failed LangBot end-to-end tests.