Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add greglas75/zuvo --skill write-e2egit clone --depth 1 https://github.com/greglas75/zuvoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greglas75/zuvo/write-e2e)<a href="https://agentmods.dev/skills/greglas75/zuvo/write-e2e"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/write-e2e/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greglas75/zuvo/write-e2e"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/write-e2e.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 112 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.06083 |
| Opus 5.5 | $0.00040 | $0.02433 |
| Sonnet 5.5 | $0.00020 | $0.01217 |
| Haiku 4.5 | $0.00010 | $0.00608 |
Grade A, and why
write-e2e scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zuvo:write-e2e — E2E Test Generation
Discover routes and user flows, rank them by criticality, generate Playwright specs that assert causality, and — when
the project can actually run Playwright — execute them and report exactly what was proven; a spec is a draft until a
state on the verification ladder says otherwise. Scope: web apps with routes, forms, interactions. Out of
scope: unit tests (zuvo:write-tests), a suite audit (zuvo:test-audit), diagnosing flaky specs (zuvo:debug), batch anti-pattern repair (zuvo:fix-tests).
Argument Parsing
Parse $ARGUMENTS as: [--scope <path>] [--flow <name>] [--output <dir>] [--base-url <url>] [--max-flows N] [--live] [--auto] [--flows] [--dry-run] [--no-install] [--allow-external-origin] [--allow-destructive <ops>]
| Argument | Mode | Flows | Description |
|---|---|---|---|
--scope <path> |
SCOPED | 1 | Restrict discovery to one app root, directory or route file |
[path] |
SCOPED | 1 | Deprecated positional alias for --scope — accepted, but prefer --scope <path> |
--flow <name> |
NAMED | 1 | Generate exactly the named flow |
--output <dir> / --base-url <url> |
OUTPUT / TARGET | — | Write specs under <dir> instead of the detected E2E root / name the origin the specs target, classified in Phase 0.5 before any request |
--max-flows N |
LIMIT | N | Explicit flow budget — the only way to ask for a large batch, 20 included |
--live |
LIVE | — | Permit live DOM/locator inspection against a permitted origin |
--auto |
AUTO | 3 | Skip the selection prompt; take the highest-scored flows |
--flows / --dry-run |
DISCOVER / PREVIEW | 0 | Print the scored list and stop / plan through scaffold and write nothing |
--no-install |
NO-BOOTSTRAP | — | Forbid the BOOTSTRAP_REQUIRED dependency materialization (env alias: ZUVO_E2E_NO_BOOTSTRAP=1); the run caps at STATIC_CHECKED and verdict WARN |
--allow-external-origin |
CONSENT 1 | — | Permits READ-ONLY execution against a non-local origin, and is the only thing (besides an exact ZUVO_E2E_STAGING_HOSTS match) that classifies an origin STAGING. Grants nothing mutating |
--allow-destructive <ops> |
CONSENT 2 | — | Authorizes the named mutating operations only, comma-separated. Independent of consent 1 — neither implies the other, and an unnamed operation stays BLOCKED |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed f007b4f04232
- 6d ago Changed · +1 lines f67fcf1c0393
- 12d ago Changed · +2 lines acd7acd8c41d
- 1mo ago Changed · -2 lines 8443e6fe3ab3
- 1mo ago First seen · 290 lines · 101 tokens per session scan A bf3e035eb84e
write-e2e is a skill published in the GitHub repository greglas75/zuvo (7 stars, last pushed today), licensed MIT. It adds 101 tokens to every session and 6,083 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
browser-check
Drive a real browser and come back with a MEASUREMENT rather than an impression - console errors and >=400 responses as counts, computed styles as JSON when appearance is disputed. Use when work touches UI, when a review must verify one, or when fidelity-gate asks for its measurement.
ai-agent-bench
Compare Claude Code and Codex on the same code task, with isolated worktrees, common checks, time, and cost.
ring:running-dev-cycle-frontend
Running the frontend (React/Next.js/TS) dev cycle from a plan.md (ring:writing-plans format; legacy tasks.md only for in-flight cycles) or backend handoff: drives frontend agents through Gate 0 TDD plus accessibility/visual/E2E/perf checks, Gate 7 parallel review, and Gate 8 user validation, with rolling-wave phase…
create-test
Define or implement regression proof: test strategy, black-box or integration tests, KPIs, thresholds, audits, or missing tests.
wrap-up-branch
Finish a feature branch: add missing tests, review and fix the code, align docs, then merge only after explicit confirmation.
eval-regression
Check skill routing or behavior, investigate a regression, or compare plugin changes with a base commit.