Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mthines/agent-skills --skill ui-verifygit clone --depth 1 https://github.com/mthines/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mthines/agent-skills/ui-verify)<a href="https://agentmods.dev/skills/mthines/agent-skills/ui-verify"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/ui-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mthines/agent-skills/ui-verify"><img src="https://agentmods.dev/badge/skills/mthines/agent-skills/ui-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00240 | $0.09740 |
| Opus 5.5 | $0.00096 | $0.03896 |
| Sonnet 5.5 | $0.00048 | $0.01948 |
| Haiku 4.5 | $0.00024 | $0.00974 |
Grade A, and why
ui-verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
if curl -fsSL --max-time 30 -o "$B/agent0-setup.sh" \ How it starts
The opening of the file, as written. The whole thing — 392 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UI Verify
Attach an executable UI verification spec to a pull request, then run it against the live preview deployment.
A reviewer verifies a UI change by clicking through the preview.
ui-verify turns that click-through into an artifact an agent can follow: a short Markdown spec in the PR description, run against the deployed preview by aw-tester, reporting pass or fail.
The runner may take a different route than the written steps — it records each deviation — but it passes a spec only when every expected outcome was observed, with evidence, on the component the PR changed.
This
SKILL.mdis a thin index. Detailed procedures live inrules/*.mdandtemplates/*.md. Each operation loads only what it needs.
What this skill reuses
This skill owns four things and reuses the rest.
| Concern | Owner |
|---|---|
The two spec formats — the intent format this skill writes (Format: intent: **Changed:**, **Start:**, **Steps:** with [must-follow], **Expected:**), and the grammar it lifts (WHEN/THEN/AND, the locator mini-grammar, url:, network:, semantic:) |
aw-tester — templates/intent-spec.md.template and specs.md.template, side by side. This skill references both and never forks either. The semantic: assertion (delegated to jev-assert) flows through unchanged because it lives in the shared grammar the runner parses. |
| The spec-run contract (locator ladder, auth semantics, verdict schema, and how an intent spec is explored, graded, cached, and replayed — § 6) | spec-run-contract.md — the engine-agnostic contract both runners implement. |
| The runners + the compact verdict | Two, one contract: aw-tester (Playwright sub-agent) and aw-tester-chrome (in-session Chrome). run --driver picks one. |
The browser context (base_url, auth, fixtures) |
aw-target.yml — aw-target.yml.template. |
| Scaffolding the committed preview aw-target (auth detection, the two walls, the confirming login, the repo-scoped records) | aw-setup — the setup operation is a thin delegator (aw-setup --target preview); this skill never reimplements it. |
| The two-way lessons loop | aw-tester-lessons (locator friction, existing) + ui-verify-lessons (navigation / spec-quality friction, new). See rules/memory.md. |
| Embedding the spec in the PR body (marker + collapsed block, ceiling exemption) | this skill — rules/spec-format.md. |
| Resolving the PR's preview URL (GitHub deployments API) | this skill — rules/preview-url-resolution.md. |
| The author + run orchestration | this skill — this file + rules/runner.md. |
| The adversarial pass (probe catalog, oracles, guardrails, evidence report) | this skill — rules/adversarial.md, harness templates/adversarial-probes.spec.ts.template; rationale and sources in references/adversarial-testing.md. |
The out-of-bounds brainstorm (pending states, baseline moves, the fan-out / in-context modes, recovery outcomes) |
this skill — rules/out-of-bounds.md; rationale in references/out-of-bounds-rationale.md. --brainstorm deep delegates to the ideate skill. |
| Screen recordings (Playwright-only, per spec and per adversarial finding) | this skill wires them on — rules/recording.md; the --record-video run option itself is the spec-run contract's (autonomous-workflow/rules/spec-run-contract.md § Record video). |
| The telemetry check (the run's Dash0 web events, read from the Dash0 Dev MCP, judged by fixed oracles) | this skill — rules/telemetry.md. |
Posting findings as review threads (--post-findings, the review-loop --ui hand-off) |
this skill — rules/post-findings.md. |
| The severity tier that caps the out-of-bounds specs | severity — its ## Severity rubric section, inlined into the brainstorm judge's prompt; this skill owns only the gate (critical or high, one per move). |
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/adversarial-testing.md 7.1 KB
- references/agent0-browser-install.md 5.2 KB
- references/out-of-bounds-rationale.md 5.9 KB
- rules/adversarial.md 25 KB
- rules/agent0-runtime.md 9.3 KB
- rules/memory.md 13 KB
- rules/out-of-bounds.md 16 KB
- rules/post-findings.md 6.2 KB
- rules/preview-auth.md 8.9 KB
- rules/preview-url-resolution.md 12 KB
- rules/recording.md 2.6 KB
- rules/runner.md 24 KB
- rules/spec-format.md 10 KB
- rules/spec-sources.md 5.3 KB
- rules/telemetry.md 8.9 KB
- scripts/is-ui-diff.mjs 12 KB runs code
- templates/adversarial-probes.spec.ts.template 15 KB
- templates/embedded-spec.md.template 1.5 KB
- templates/preview-target.yml.template 7.4 KB
- templates/refresh-auth.mjs.template 4.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +14 lines · +5 tokens per session 4905402f4fee
- 15d ago Changed · +6 lines · +1 tokens per session 4b5ea6a54a53
- 16d ago Changed · +9 lines · +2 tokens per session 48b38a188754
- 18d ago Changed · +97 lines 7777894473d7
- 19d ago Changed · +37 lines cbd17aff6a84
- 23d ago Changed · +5 lines 563fc2293b10
- 25d ago Changed · -8 lines · -131 tokens per session 6bf11b1db009
- 27d ago Changed · +3 lines · +48 tokens per session ede5904d9dd8
- 29d ago First seen · 229 lines · 315 tokens per session scan A f0ddf09b5510
ui-verify is a skill published in the GitHub repository mthines/agent-skills (19 stars, last pushed today), licensed MIT. It adds 240 tokens to every session and 9,740 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
browser-testing-with-devtools
Use Chrome DevTools MCP to inspect, debug, and verify anything that runs in a browser — DOM structure, console errors, network requests, performance traces, and accessibility. Use when building or fixing browser UI, diagnosing a runtime bug that isn't visible from source code alone, or verifying a fix actually works…
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be…
web-test
A browser-automation tool for testing the 1C:Enterprise web client. It uses Playwright to navigate sections, fill forms, read tables and reports, and perform user actions in a browser.
actionbook-web-test
Run browser-based web tests against websites using Actionbook CLI. Activate when the user wants to test a website workflow, run smoke tests, verify a user flow, check if a web application works, run regression tests, or validate browser-based interactions. Supports test definition, execution, assertion, reporting, and…
playwright-visual-testing
Add, repair, or review Playwright visual regression tests for browser-facing .NET apps, including screenshot baselines, Pixelmatch thresholds, deterministic rendering, and GitHub Actions artifacts. USE FOR: toHaveScreenshot, page.screenshot visual checks, Pixelmatch/pngjs comparison scripts, visual baseline updates…
dogfood
This skill guides you through systematic exploratory QA testing of web applications using the browser toolset. You will navigate the application, interact with elements, capture evidence of issues, and produce a structured bug report.