Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/vscode/validate-ui-scenarionpx skills add microsoft/vscode --skill validate-ui-scenariogit clone --depth 1 https://github.com/microsoft/vscodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/vscode/validate-ui-scenario)<a href="https://agentmods.dev/skills/microsoft/vscode/validate-ui-scenario"><img src="https://agentmods.dev/badge/skills/microsoft/vscode/validate-ui-scenario.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00075 | $0.02804 |
| Opus 5 | $0.00037 | $0.01402 |
| Sonnet 5 | $0.00015 | $0.00561 |
| Haiku 4.5 | $0.00007 | $0.00280 |
Grade B, and why
validate-ui-scenario scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| Linux | `sudo apt install ffmpeg` | How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate UI Scenario
Drives a real VS Code instance through a scenario and records reproducible evidence.
Use this to reproduce a reported bug, to show that a fix works, or to attach a recording to a
test-plan item. For deterministic regression coverage that runs on every build, write a smoke test
instead (see the smoke-tests skill) — this skill is for one-off, issue-derived validation.
A scenario is a small JavaScript file run by test/scenario/out/runScenario.js. Nothing else has to be
configured: the runner launches VS Code, records video and a trace, captures a screenshot at every
step boundary, writes the report, and captions the recording with each step and its result.
Prepare
npm install # once
npm --prefix test/scenario run compile # after any change under test/scenario
Check ffmpeg and ffprobe are available before running. The runner looks on PATH and in the
usual install locations, so an ffmpeg installed after the editor started is still found. Without them
the scenario still runs and keeps the raw recording, but the video is not captioned with step titles.
The runner warns at startup; if they are missing, tell the user how to install them rather than
silently returning an unannotated video:
| Platform | Install |
|---|---|
| Windows | winget install Gyan.FFmpeg |
| macOS | brew install ffmpeg |
| Linux | sudo apt install ffmpeg |
A new terminal may be needed for PATH to pick them up, or set FFMPEG_PATH and FFPROBE_PATH. An
existing run can be annotated afterwards with
node test/scenario/out/renderEvidenceChapters.js <run-dir>.
| Target | Flags | Also required | Use for |
|---|---|---|---|
| Installed Insiders, else Stable | (none — the default) | nothing | Reproducing a report against shipped behavior |
| Dev build from this checkout | --dev |
npm run electron, npm run transpile-client |
Verifying an unmerged change |
| A specific install | --build <app-root> |
nothing | Pinning an exact build |
| Web | --web --headless |
npm run transpile-client |
Browser-only behavior |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 244 lines · 75 tokens per session scan B 44874cab7a0e
validate-ui-scenario is a skill published in the GitHub repository microsoft/vscode (190,808 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,804 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
supersplat
Use when editing 3D Gaussian Splatting (3DGS) .ply models in browser — cleanup noise/floaters, crop, transform, color-adjust, animate camera, publish online. SuperSplat: open-source browser-based 3DGS editor by PlayCanvas with PLY/compressed PLY/Splat/KSplat/SOG export.
posthog
Complete guide for the PostHog plugin — REST API access for querying analytics with HogQL, managing feature flags, inspecting events and persons, reading insights, experiments, cohorts, surveys, and more.
create-remotion-video
Create or edit video with Remotion. First-party clodex + Remotion skill. Contains full video-making process.
github
Complete guide for the GitHub plugin — REST API access for repositories, issues, pull requests, actions, releases, and search using a GitHub Personal Access Token.
supabase
Complete guide for the Supabase plugin — Management API access for running SQL queries, listing projects, managing edge functions, secrets, migrations, and inspecting project health.
mini-apps
Guide for building custom interactive web apps ("mini apps") displayed in browser tabs — scaffolding, iframe constraints, bidirectional messaging with the sandbox, and iteration workflows.