Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mthines/agent-skills/aw-setupnpx skills add mthines/agent-skills --skill aw-setupgit clone --depth 1 https://github.com/mthines/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mthines/agent-skills/aw-setup)<a href="https://agentmods.dev/skills/mthines/agent-skills/aw-setup"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/aw-setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.05157 |
| Opus 5 | $0.00046 | $0.02579 |
| Sonnet 5 | $0.00018 | $0.01031 |
| Haiku 4.5 | $0.00009 | $0.00516 |
Grade A, and why
aw-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 466 lines — stays where its author put it; the contents beside it link to each section on GitHub.
aw-setup — Aw-Target Scaffolding for aw-tester
Interactive, idempotent setup flow that scaffolds the .claude/aw-targets/ config
that aw-tester needs to run specs. Run it once before the first autonomous
PR that touches UI. Re-run it when auth drifts, fixtures change, or base URL moves.
This is the prerequisite for spec-driven UI verification in the autonomous-workflow. Without an aw-target file,
aw-testercannot run and the executor's Phase 4 spec verification step skips cleanly.
When to run
- First time: before running any autonomous feature that touches UI.
- Re-run: when
aw-testerreportsauth-refresh-failed, when the base URL changes, or when seed fixtures are restructured. - Never auto-triggered by the planner. The planner halts and tells the user
to run
/aw-setup. The user runs it explicitly.
Idempotency contract
First run: full guided scaffolding (Phases A–E).
Re-run: detect .claude/aw-targets/local.yml exists, validate each field:
- Auth storage state: does the file exist? Is it fresh (< N days old)?
- Fixtures: does the seed command resolve? Do references point to env vars that exist?
- Smoke spec: run it. If green, done — no prompts needed.
- Only prompt for what broke or is missing.
- Show a unified diff before overwriting any field in the aw-target file.
- Never silently overwrite the auth storage-state file (
.auth/*.json, or the repo's own convention such as.browser/auth-state*.json).
Phases
Phase A — Detect
Read the project to guess the aw-target configuration. Look for:
| Signal | What to look for |
|---|---|
| Base URL | next.config.*, vite.config.*, package.json scripts (dev port), env files (.env, .env.local) |
| Auth strategy | next-auth / auth.js imports, custom /api/auth routes, OAuth config |
| Test backdoors | Dev-only cookies (__e2e_token), test env vars (E2E_AUTH_TOKEN), seed scripts in package.json |
| Fixtures / seed | db:seed, db:reset, seed:aw, test:setup scripts |
| Existing aw-target | .claude/aw-targets/*.yml (re-run path) |
| Existing auth convention | A storage-state file or login script the repo already uses — see Reuse before you scaffold |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +42 lines 2ecb71029c9d
- 5d ago First seen · 424 lines · 91 tokens per session scan A 446b493693e9
aw-setup is a skill published in the GitHub repository mthines/agent-skills (12 stars, last pushed today), licensed MIT. It adds 91 tokens to every session and 5,157 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tdd-workflow
Runs the full TDD workflow for a TypeScript/JavaScript feature — user journeys to test cases, unit tests (Jest/Vitest + Testing Library), API/integration tests, Playwright E2E, and a coverage gate wired into CI. Use when building a Next.js/React/Node feature end to end, not just a single unit test, or when asked to…
e2e-testing
Guides Playwright end-to-end test design — Page Object Model, CI configuration, and flaky test diagnosis. Use when writing browser-based end-to-end tests, debugging a test that fails intermittently, setting up Playwright CI configuration, or reviewing E2E test code for race conditions and arbitrary waits.
browser-testing-with-devtools
Use Chrome DevTools MCP to inspect, debug, and verify anything that runs in a browser — DOM structure, console errors, network requests, performance traces, and accessibility. Use when building or fixing browser UI, diagnosing a runtime bug that isn't visible from source code alone, or verifying a fix actually works…
ego-browser
Skill "ego-browser" from citrolabs/ego-lite, covering ego-browser, quick start, common helpers, task spaces and control handoff.
testing-strategies
Comprehensive testing strategy covering unit, integration, e2e, property-based, and mutation testing with practical patterns.
mcp-case-overrides
Per-case mocked MCP override smoke skill used by skill-up e2e tests.