MoAI-ADK is a Go-based harness that organizes and verifies Claude Code work across planning, implementation, synchronization, and review stages. Developers use it to structure agentic coding tasks, apply quality gates, and route work across language models, while the catalogue entries extend its workflow with skills, hooks, commands, MCP servers, instructions, and settings.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add modu-ai/moai-adk --skill moai-ref-aside-browsergit clone --depth 1 https://github.com/modu-ai/moai-adkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/modu-ai/moai-adk/moai-ref-aside-browser)<a href="https://agentmods.dev/skills/modu-ai/moai-adk/moai-ref-aside-browser"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-adk/moai-ref-aside-browser/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/modu-ai/moai-adk/moai-ref-aside-browser"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-adk/moai-ref-aside-browser.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.01001 |
| Opus 5.5 | $0.00038 | $0.00400 |
| Sonnet 5.5 | $0.00019 | $0.00200 |
| Haiku 4.5 | $0.00009 | $0.00100 |
Grade A, and why
moai-ref-aside-browser scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Aside Browser (optional)
Purpose
Aside is an optional browser agent that acts inside the operator's own browser, so it sees every page the operator is signed in to, with the operator's credentials, cookies, and history. aside mcp starts an MCP server over stdio with two tools: exec runs the browser agent on logged-in sites, and repl runs Playwright-style JavaScript against open pages (120-second timeout; page starts unset, so call openTab(url) or getTabs() first). Flag and tool names here reflect one observed version; if a probe or a call fails, treat Aside as absent.
When to use, and when not
- Use it for a task that needs a page behind the operator's login, which a fresh headless browser cannot reach, and only when the operator asked for it.
- Do not use it for public pages (a plain fetch or the platform default browser tooling reads those), in CI, or because it happens to be installed.
Who operates it
Aside is operated by the orchestrator alone. A subagent never invokes Aside, neither the aside command nor the Aside MCP tools; a task that needs Aside returns a blocker report to the orchestrator, which runs the step itself or drops it.
Safe-use rules
- Permission. Never pass
--permission full-access, and never request full-access by any other route (settings, prompts, or tool arguments). - Guard by omission. The permission flag takes one of three values;
askandguardare the same Guard mode, and omitting the flag also means Guard. Prefer to omit--permissionentirely so the default Guard applies. - REPL limit.
aside replhas no permission flag, so its read-only limit is discipline, not enforcement: restrict REPL work to navigation, reading, and screenshot operations. - Writes. Any step that changes state (submitting a form, posting, purchasing, deleting, sending, changing a setting, approving) needs explicit operator confirmation, obtained by the orchestrator through its question channel before the step runs. Never infer consent from the task text. Treat every
execrun as state-changing, because an agent-driven run can click, type, and submit. - Install. Never install Aside and never run install tooling for it. If the operator wants Aside's own browser skill added to their coding agents, advise the operator to run
aside skills install; the orchestrator does not run it. - Secrets. The session carries the operator's logins, so never place credentials, cookies, tokens, or session data in any output, log, file, report, or prompt. Cite screenshots by path and carry only the minimum page text a step needs.
- Output size. Redirect verbose REPL output to a file and bring only the exit code and a bounded tail into context.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 60 lines · 94 tokens per session scan A 3570d7c65e84
moai-ref-aside-browser is a skill published in the GitHub repository modu-ai/moai-adk (1,234 stars, last pushed yesterday), licensed Apache-2.0. It adds 94 tokens to every session and 1,001 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-06.
Other skills, from other repositories
hn-summarize
Fetch and summarize Hacker News / hckrnews.com top stories, articles, and their comment threads. Use when asked to summarize HN front-page stories, a specific HN story plus its discussion, or "the top N from hckrnews".
gha
Analyze GitHub Actions failures and identify root causes.
code-reviewer
Automatic code quality and best practices analysis. Use proactively when files are modified, saved, or committed. Analyzes code style, patterns, potential bugs, and security basics. Triggers on file changes, git diff, code edits, quality mentions.
test-generator
Automatically suggest tests for new functions and components. Use when new code is written, functions added, or user mentions testing. Creates test scaffolding with Jest, Vitest, Pytest patterns. Triggers on new functions, components, test requests, testing mentions.
api-documenter
Auto-generate API documentation from code and comments. Use when API endpoints change, or user mentions API docs. Creates OpenAPI/Swagger specs from code. Triggers on API file changes, documentation requests, endpoint additions.
readme-updater
Keep README files current with project changes. Use when project structure changes, features added, or setup instructions modified. Suggests README updates based on code changes. Triggers on significant project changes, new features, dependency changes.