Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mathaix/openclawmachines/ocm-testingnpx skills add mathaix/OpenClawMachines --skill ocm-testinggit clone --depth 1 https://github.com/mathaix/OpenClawMachinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mathaix/openclawmachines/ocm-testing)<a href="https://agentmods.dev/skills/mathaix/openclawmachines/ocm-testing"><img src="https://agentmods.dev/badge/skills/mathaix/openclawmachines/ocm-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00653 |
| Opus 5 | $0.00019 | $0.00327 |
| Sonnet 5 | $0.00008 | $0.00131 |
| Haiku 4.5 | $0.00004 | $0.00065 |
Grade A, and why
ocm-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OCM Testing
Use this skill when deciding what to test, debugging failing checks, or validating changes before commit, push, or PR review.
Read First
AGENT.mdfor repo-wide testing expectations.Makefilefor supported commands.docs/local-firecracker-e2e.mdfor local KVM/Firecracker proof.docs/kvm-integration-ci.mdfor maintainer-gated KVM runners.- Relevant package docs near the changed code.
Default Rule
Prove the touched surface first. Do not reflexively run every expensive lane.
- Inspect the diff and classify touched surfaces.
- Reproduce narrowly before fixing when a bug is reported.
- Patch the implicated owner module.
- Rerun the narrow proof.
- Broaden only when a shared contract, integration boundary, or user workflow requires it.
Surface Map
- Backend control plane, store, runtime, routing:
cd backend && go test ./internal/<pkg>. - Shared backend behavior or broad API changes:
make test-go. - Worker routing/auth/CORS/KV behavior:
make test-worker. - Frontend UI or auth/client behavior:
make test-frontendandmake typecheck. - Cross-cutting code changes:
make check,make test,make typecheck. - Docs-only: inspect rendered links/commands when practical and run
git diff --check. - Scripts/shell automation:
make check-scriptsif available throughmake check; otherwise run the script's dry-run/help path when it has one. - Firecracker, rootfs init, agent networking, TAP/bridge/NAT, VM persistence, or
KVM placement: run the narrowest KVM integration lane available, or state the
exact blocker such as missing
/dev/kvm, root privileges, artifacts, network, or Cloudflare credentials. - Cloudflare Worker deployment shape: test Worker logic locally and review
worker/wrangler.tomlplusdocs/self-hosted.env.examplefor routing loops.
Guardrails
- Prefer
maketargets over direct tool invocations when a target exists. - Do not run privileged KVM, Docker, Cloudflare, GCP, or deploy commands unless the user asked or the change genuinely needs that proof.
- Do not kill unrelated processes. Treat running services as user-owned unless they were started in the current task.
- Do not print secrets from env files, logs, cookies, JWTs, database URLs, or Cloudflare/Firebase/GCP credentials.
- If dependency install or network access is required and blocked, report the blocker and use the closest local proof.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 68 lines · 38 tokens per session scan A 09ff34751644
ocm-testing is a skill published in the GitHub repository mathaix/OpenClawMachines (57 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 38 tokens to every session and 653 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-reach
MUST USE when user wants to 调研/research/搜索/search/查/找/look up anything on the internet — e.g. 全网调研 X / 帮我调研一下 X / 查一下 X / 搜搜 X / 看看大家怎么评价 X / X 上有什么讨论 / research this topic。 Also MUST USE when user mentions any platform or shares any URL/链接: 小红书/xiaohongshu/xhs, Twitter/推特/X, B站/bilibili, Reddit, Facebook, Instagram…
ebay-sold-listings-search
All process output to user (progress updates, process notifications) follows the user's language.
youtube-channel-business-email
YouTube channel business email and contact extractor: accepts a channel id (UCxxx), handle (@name), or URL; navigates the channel About view; extracts the business email from the description text plus full channel metadata (name, id, country, subscriber count, view count, video count, joined date, external links…
webcrawler-deep-crawl
Deep-crawl any website from start URLs, return per-page LLM-ready text/markdown/HTML plus metadata (title, description, author, language, canonical URL, OG) and in-scope outbound links. Use when user mentions deep crawl website, recursive crawl, crawl a whole site, scrape entire website, scrape docs site, scrape…
1688-product-detail
Extracts comprehensive wholesale product data from 1688.com product detail pages: title, tiered pricing, SKU variants with dimensions/weight, product images, seller info, shop scores, buyer protection, cross-border flags, product attributes, coupon/promotion data, and review stats. Use when user mentions 1688…
amazon-listing-competitor-analysis-skill
This skill helps users analyze Amazon competitor listings by ASIN and produce structured competitive intelligence plus strategic opportunity points for their own go-to-market. The Agent should proactively apply this skill when users want to analyze a competitor Amazon listing by ASIN, understand what a top-ranked…