Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JohnWayneeee/ai-agent-skills --skill browser-auditgit clone --depth 1 https://github.com/JohnWayneeee/ai-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/johnwayneeee/ai-agent-skills/browser-audit)<a href="https://agentmods.dev/skills/johnwayneeee/ai-agent-skills/browser-audit"><img src="https://agentmods.dev/badge/skills/johnwayneeee/ai-agent-skills/browser-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.01302 |
| Opus 5 | $0.00048 | $0.00651 |
| Sonnet 5 | $0.00019 | $0.00260 |
| Haiku 4.5 | $0.00010 | $0.00130 |
Grade A, and why
browser-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser Audit
Audit the rendered page in a real browser before deployment. Treat Lighthouse and automated accessibility checks as strong signals, not as a complete conformance claim. Always include manual browser checks for anything automation cannot prove reliably.
Workflow
- Confirm scope: target URL, viewport(s), auth state, and key user flows. If unspecified, audit the provided/current page at desktop and mobile widths.
- Open the page in a browser. For localhost or preview URLs, use the available browser automation/in-app browser tooling. Capture at least one screenshot per viewport when possible.
- Run automated checks:
- Lighthouse categories:
accessibility,seo,best-practices, andperformancewhen performance risk matters. - Browser console errors, failed network requests, mixed content, CSP/security warnings.
- DOM checks for title, meta description, canonical, robots, viewport,
html[lang], heading structure, image alt text, form labels, accessible names, duplicate IDs, invalid/broken ARIA references, landmark presence, and empty/ambiguous links/buttons. - Accessibility tree inspection for key navigation, dialogs, controls, forms, and repeated components.
- Lighthouse categories:
- Run manual browser checks:
- Keyboard-only navigation: Tab, Shift+Tab, Enter, Space, Escape, arrow keys for composite widgets, no unreachable controls, no unexpected traps.
- Focus visibility and focus management: visible focus, not obscured by sticky UI, dialogs trap/restore focus, route changes place focus sensibly.
- Contrast and visual states: text, icons, borders, disabled/error/focus states, hover-only information, active navigation.
- Responsive UX: mobile width, 200% zoom if practical, target sizes, no horizontal scroll, no overlapping text or controls.
- Forms and validation: labels, required/invalid states, error messages, autocomplete, redundant-entry risk, submit feedback.
- Critical UX: broken layouts, blocked primary CTA, loading states that never resolve, overlays hiding content, privacy/cookie banners blocking keyboard users.
- Map findings to severity and priority. Do not report issues from static source inspection alone unless they are confirmed in the rendered browser or clearly marked as source-only.
- Produce the structured report in the format below. Explicitly mark manual checks that could not be completed.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 106 lines · 96 tokens per session scan A 8c6050d24333
browser-audit is a skill published in the GitHub repository JohnWayneeee/ai-agent-skills (1 stars, last pushed 3mo ago), licensed MIT. It adds 96 tokens to every session and 1,302 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
browser-subagent-task-bounding
How to constrain browser subagents with deterministic stop conditions, step ceilings (max 5-8 steps), and selector-targeted DOM extraction to prevent runaway token costs and infinite navigation loops.
awt-e2e-testing
AI-powered E2E web testing — eyes and hands for AI coding tools. Declarative YAML scenarios, Playwright execution, visual matching (OpenCV + OCR), platform auto-detection (Flutter/React/Vue), learning DB. Install: npx skills add ksgisang/awt-skill --skill awt -g.
facebook-page-profile-posts
Scrapes posts from any public Facebook Page or personal Profile timeline, returning structured data including post text, author info with profile picture, engagement metrics (likes/comments/shares), full reaction breakdown (Like/Love/Wow/Haha/Sad/Angry/Care as both array and flat counts), hashtags and external links…
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…
amazon-search-listing
Amazon search and category listing scraper: extract product listings from any Amazon search results page, keyword search URL, or category browse page and return per-item cards (asin, title, url, image, price, listPrice, stars, reviewCount, badges, isAmazonChoice, isBestSeller, isSponsored, delivery, boughtInPast…
etsy-product-detail
Etsy product detail scraper: given an Etsy listing URL, returns full product detail including listingId, title, priceCurrent, priceOriginal, currency, images (all), description, shopName, shopUrl, rating, reviewCount, favorites, inCartCount, variations (with per-option price ranges), highlights, listedDate…