Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Lord1Egypt/awesome-skill-forge --skill 3d-pet-checkout-testgit clone --depth 1 https://github.com/Lord1Egypt/awesome-skill-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lord1egypt/awesome-skill-forge/3d-pet-checkout-test)<a href="https://agentmods.dev/skills/lord1egypt/awesome-skill-forge/3d-pet-checkout-test"><img src="https://agentmods.dev/badge/skills/lord1egypt/awesome-skill-forge/3d-pet-checkout-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lord1egypt/awesome-skill-forge/3d-pet-checkout-test"><img src="https://agentmods.dev/badge/skills/lord1egypt/awesome-skill-forge/3d-pet-checkout-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01201 |
| Opus 5 | $0.00027 | $0.00600 |
| Sonnet 5 | $0.00011 | $0.00240 |
| Haiku 4.5 | $0.00005 | $0.00120 |
Grade C, and why
3d-pet-checkout-test scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
sleep 30 && curl -s http://127.0.0.1:18800/json/list | python3 -c " Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. 用 exec + curl 轮询,每次 sleep 30s: How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
3D Pet 下单测试
执行 3D 宠物产品下单完整流程,验证购买路径是否正常。
触发条件
- 用户说"测试3D宠物"、"测试下单"、"3D Pet test"、"运行工作流"
- cron 定时任务触发
- 手动执行测试
关键配置
| 配置 | 环境变量 | 默认值 |
|---|---|---|
| 网站 | - | https://joyarti.com |
| 账号邮箱 | JOYARTI_EMAIL | (无默认值,请设置) |
| 账号密码 | JOYARTI_PASSWORD | (无默认值,请设置) |
| 测试图片 | JOYARTI_IMAGE_URL | (可选) |
| 推送目标 | FEISHU_TARGET | (无默认值,需配置) |
环境变量设置
在运行前设置环境变量(可选,如不设置则使用默认值):
export JOYARTI_EMAIL="[email protected]"
export JOYARTI_PASSWORD="your-password"
export JOYARTI_IMAGE_URL="https://example.com/image.jpg"
export FEISHU_TARGET="chat:oc_xxxxxxxxxxxxxxxxxx"
执行步骤
Step A: 登录
- navigate 到 https://joyarti.com/account/login
- wait 2000ms
- evaluate 填写邮箱密码并点击 Login
- wait 4000ms 等待跳转
- evaluate 验证登录成功(URL 含 /account)
Step B: 选择产品
- evaluate 点击导航 '3D Figure'
- wait 3000ms,验证 URL 含 figmaker
- evaluate 点击 'For Pets' (必须用 BUTTON 元素)
- wait 3000ms
- evaluate 点击 'Minimal Style' 的 Create 按钮 (必须用 BUTTON 元素)
- wait 3000ms,验证 URL 含 style2 且有文件上传框
Step C: 上传图片
- exec 下载图片到 /tmp/openclaw/uploads/pet_image.jpg
- exec 运行 CDP 上传脚本:
CDP_SCRIPT="${WORKSPACE}/cdp_upload.py" # 或从 skill 目录读取 python3 "$CDP_SCRIPT" /tmp/openclaw/uploads/pet_image.jpg joyarti- 成功输出:
OK: files=1 - 失败输出:
ERR: ...
- 成功输出:
- wait 3000ms
- evaluate 点击 Create Preview 按钮
Step D: 等待生成
- 禁止用 browser wait 超过 20s
- 用 exec + curl 轮询,每次 sleep 30s:
sleep 30 && curl -s http://127.0.0.1:18800/json/list | python3 -c " import json,sys tabs=json.load(sys.stdin) for t in tabs: if 'joyarti' in t.get('url','') and 'projectId' in t.get('url',''): print('DONE:', t['url']) " - 检测输出含
DONE:即生成完成,提取 projectId
Step E: 验证结账
- evaluate 点击 Buy Now
- wait 4000ms
- evaluate 验证跳转到 Shopify(URL 含 myshopify.com 或 checkout)
- evaluate 读取结账关键字段(产品、价格)
- 验证:产品含 'Pet'/'Figure',价格含 '$89.99'
- 必须登出并关闭浏览器
消息规则
每个 Step 开始和完成必须发消息到飞书群:
message(action=send, channel=feishu, target=FEISHU_TARGET, message="...")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 126 lines · 54 tokens per session scan C ebb7fc419a71
3d-pet-checkout-test is a skill published in the GitHub repository Lord1Egypt/awesome-skill-forge (2 stars, last pushed 3mo ago), licensed MIT. It adds 54 tokens to every session and 1,201 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
synthetic-monitoring
AI-powered synthetic monitoring skill for e-commerce websites. Designs automated user journey tests for add-to-cart, checkout, and payment flows with alerting rules and performance baselines.
visual-regression-testing
AI-powered visual regression testing skill for e-commerce websites. Designs screenshot comparison workflows, mobile/desktop visual checks, and change detection alerts to prevent conversion-killing UI bugs.
smoke-test-critical-paths
Quick Reference - Load this first for fast context (2KB).
payment-testing
Test payment and checkout flows end to end against PSP sandboxes — Stripe first, with the general pattern for Adyen/Braintree/PayPal. Covers Stripe test-mode card numbers and their decline codes, the 3DS/SCA challenge flow and its nested-iframe handling in Playwright, test clocks for subscription/billing-cycle…
paddle-sandbox-testing
Test a Paddle integration end-to-end using the sandbox environment, test cards, the webhook simulator, and local tunnels — without taking real money.
spree-testing
Use when the user is writing or running automated tests for a Spree app — model specs, controller specs, API integration tests, admin feature specs, factories, fixtures. Covers RSpec + Factory Bot + Capybara (Spree's stack — NOT Minitest + fixtures), the spreedevtools gem, pulling in Spree's own factories, the shared…