Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/higoralves/orc/browser-qanpx skills add HigorAlves/orc --skill browser-qagit clone --depth 1 https://github.com/HigorAlves/orcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/higoralves/orc/browser-qa)<a href="https://agentmods.dev/skills/higoralves/orc/browser-qa"><img src="https://agentmods.dev/badge/skills/higoralves/orc/browser-qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.01977 |
| Opus 5 | $0.00036 | $0.00988 |
| Sonnet 5 | $0.00014 | $0.00395 |
| Haiku 4.5 | $0.00007 | $0.00198 |
Grade A, and why
browser-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser QA
The single source of truth for driving browser QA — /orc:qa and /orc:flow both execute this protocol instead of restating it. Inputs from the caller: the feature description, the state dir, --driver/--web/--no-env flags when given, and (workspace mode) the web-surface repo + siblings.
Step 0 — Provision or attach the environment
Skip when --web <url> or --no-env. Check orc-docker-env is-ready $(orc-docker-env state-path "$ORC_STATE_DIR" <sanitized-branch>):
ready→ attach; echo the reuse line (project, appUrl, "reused").- otherwise → dispatch
orc-env-provisionerviaTask(repoPath = the worktree; workspace mode addsrepos[],webSurfaceRepo, plan path). Onfallback: re-print the agent's ⚠️ callout and continue. Onfailed: re-print the 🛑 callout andAskUserQuestion— retry / retry--fresh/ continue with--no-envlegacy boot / abort QA.
The environment stays up after QA — the "QA partial → fix → re-run" loop attaches in seconds. Teardown belongs to /orc:cleanup. Then init ${ORC_STATE_DIR}/<sanitized-branch>/files/qa/; in workspace mode, cross-repo integration evidence goes there while per-repo QA stays at <repoPath>/.orc/<branch>/files/qa/.
Step 1 — Choose the driver
If --driver was passed or the session has a settled driver decision, use it silently. Otherwise print the Gate headline, then AskUserQuestion (record the answer via orc-state decision set driver <v> --provenance asked — re-runs keep the same driver unless the user asks to switch):
> **⛔ Gate — browser driver**
>
> Web QA is ready to run against <appUrl>. Pick how to drive the browser.
- agent-browser CLI (headless) — richest evidence: annotated screenshots, network HAR, request mocking for failure-state testing, and a WebM recording when
ffmpegis installed; runs isolated from your browsing. Best for thorough pre-PR gates and CI-like rigor. - Claude-in-Chrome extension (watch live) — the test runs in YOUR Chrome; you see every click as it happens, with your real sessions, cookies, and extensions, and the GIF recording needs no external tooling. Best when you want to visually follow the flow or the app needs an already-logged-in state.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 72 lines · 72 tokens per session scan A b222f9f64335
browser-qa is a skill published in the GitHub repository HigorAlves/orc (6 stars, last pushed 9d ago), licensed MIT. It adds 72 tokens to every session and 1,977 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pn-smoke-tests
Run smoke or E2E tests, debug failures, and verify fixes. Use for end-to-end verification before or after changes.
test-browser
Run browser tests on pages affected by current PR or branch.
playwright-cli-helpers
Default verification tool for local HTML files. Use visual-check.sh as the FIRST choice whenever you need to verify, test, or check any local HTML page — whether confirming elements render correctly, checking layout, detecting overflow, or asserting uniform widths. Prefer this over raw playwright-cli commands. Also…
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
browse
Fast headless browser for QA testing and site dogfooding. (gstack).
playwright-dev
Explains how to develop Playwright - add APIs, MCP tools, CLI commands, and vendor dependencies.