Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/makigjuro/cloudstack-ai-plugins/smoke-testnpx skills add makigjuro/cloudstack-ai-plugins --skill smoke-testgit clone --depth 1 https://github.com/makigjuro/cloudstack-ai-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.01965 |
| Opus 5 | $0.00022 | $0.00983 |
| Sonnet 5 | $0.00009 | $0.00393 |
| Haiku 4.5 | $0.00004 | $0.00197 |
Grade C, and why
smoke-test scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -sf http://localhost:{API_PORT}/health/ready | python3 -m json.tool 2>/dev/null || echo "Health check failed" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sf http://localhost:{API_PORT}/health/live > /dev/null 2>&1 && echo "API: UP" || echo "API: DOWN" How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smoke Test
Navigate key application routes using Playwright and verify they render without errors.
Arguments
--frontend-only— Only test frontend routes (skip API health checks)--api-only— Only test API health endpoints--interactive— Run interactive CRUD flows after route testing (creates test data)--screenshot— Take screenshots of each page (saved to /tmp/smoke-test/){url}— Test a specific URL instead of the default routes
Configuration
Read cloudstack.json from the project root at the start of execution. Extract:
FRONTEND_PATH=frontend.path(default:web)DEV_PORT=frontend.devPort(default:5173)UI_LIBRARY=frontend.uiLibrary(default:shadcn)STATE_SERVER=frontend.stateManagement.server(default:tanstack-query)STATE_CLIENT=frontend.stateManagement.client(default:zustand)MULTI_TENANT=backend.multiTenancy(default:false)
Also extract:
API_PORT=backend.devPort(default:5000)ORCHESTRATOR=localDev.orchestrator(default:none) — e.g.,aspire,docker-compose,noneORCHESTRATOR_PORT=localDev.orchestratorPort(default:none)
If cloudstack.json does not exist, auto-detect by checking package.json dependencies.
Auth Configuration
Check cloudstack.json for localDev.authConfig. If present, use it. Otherwise, detect the auth store pattern from the codebase (see screenshot skill for details).
Prerequisites
The local environment must be running. If not, suggest starting the dev server first.
Process
Step 1: Verify Services Are Up
Check that the expected ports are responding before running browser tests:
# Check API
curl -sf http://localhost:{API_PORT}/health/live > /dev/null 2>&1 && echo "API: UP" || echo "API: DOWN"
# Check Frontend
curl -sf http://localhost:{DEV_PORT} > /dev/null 2>&1 && echo "Frontend: UP" || echo "Frontend: DOWN"
If ORCHESTRATOR is set (e.g., aspire, docker-compose), also check the orchestrator dashboard:
# Only if ORCHESTRATOR_PORT is configured
curl -sf http://localhost:{ORCHESTRATOR_PORT} -k > /dev/null 2>&1 && echo "Orchestrator: UP" || echo "Orchestrator: DOWN"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 196 lines · 44 tokens per session scan C 7c6b773cf171
smoke-test is a skill published in the GitHub repository makigjuro/cloudstack-ai-plugins (1 stars, last pushed 1mo ago), licensed MIT. It adds 44 tokens to every session and 1,965 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
js-in-html-testing
Test JS logic embedded in HTML using two-layer strategy - Python unit tests + Playwright browser integration tests.
playwright-screen-recording
Record browser test videos with Playwright for PR review and bug fix verification.
qa
QA-test a website or web app and return a 1-5 quality score (5 = flawless, 1 = broken) with evidence. Use when the user wants to test, QA, evaluate, score, or "check how good" a site, page, flow, or app — including a local dev server (e.g. "qa test localhost:5173", "does the checkout work?", "rate this landing page").…
e2e-verify
面向 Bifrost 管理端的端到端 UI 与 API 验证工具。 适用于浏览器测试、场景回归、管理端接口验证与页面快照排查。 Use when: 端到端验证、功能验证、E2E 测试、UI 测试、浏览器测试、API 测试、接口验证.
browser-qa-delivery
Validate a Design Studio HTML artifact in the sandbox browser, fix rendering and runtime defects, then deliver exactly the tested file.
cypress-ops
Cypress end-to-end and component testing operations - selector/retry-ability strategy, cy.intercept network stubbing, cy.session auth, component vs e2e, flake diagnosis, CI, Test Replay. Use for: cypress, e2e test, component test, cy.get, cy.intercept, cy.session, data-cy, data-test, retry-ability, flake, flaky test…