Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nearform/lastlight/browser-qanpx skills add nearform/lastlight --skill browser-qagit clone --depth 1 https://github.com/nearform/lastlightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nearform/lastlight/browser-qa)<a href="https://agentmods.dev/skills/nearform/lastlight/browser-qa"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/browser-qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00069 | $0.02336 |
| Opus 5 | $0.00034 | $0.01168 |
| Sonnet 5 | $0.00014 | $0.00467 |
| Haiku 4.5 | $0.00007 | $0.00234 |
Grade A, and why
browser-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
evidence matters. For a CLI or a curl-able API, use `qa-test`/`verify` How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser QA
Drive a web UI with a real headless Chromium and report step-level pass/fail with evidence: extracted DOM text, assertion results, console errors, and screenshot files. The deliverable is a QA report — partial coverage with documented failures is the expected output.
This skill is the browser/screenshot path that verify and qa-test
scope out to "a separate docker-gated capability". It only works on the
lastlight-sandbox-qa:latest docker image, which bakes in Playwright +
Chromium. You have bash + file tools but no vision — you reason over the
driver's JSON stdout (extracted text, assertion results, console errors).
The PNG screenshots are human evidence only; you never see them.
This skill uses the building skill for installing dependencies and starting the repo's dev-server.
When this applies
A phase running on the docker QA image whose target is a web app the
repo serves on localhost and where rendered-UI behaviour or visual
evidence matters. For a CLI or a curl-able API, use qa-test/verify
instead — don't launch a browser you don't need.
FIRST — probe for a browser
The driver lives in this skill's bundle at
<skill-dir>/scripts/agent-browser.mjs. Resolve <skill-dir> from the
available-skills catalogue (it gives the absolute staged path of this
skill); do not assume a relative path from $PWD — the agent's cwd is the
checked-out repo, the bundle is a sibling.
Run the runtime probe before anything else:
node <skill-dir>/scripts/agent-browser.mjs doctor
- Exit 0 with
{"ok":true,"chromium":"..."}→ Chromium is available; proceed. - Exit non-zero (e.g.
playwright not available …, or no Chromium — the lean default image, or a gondolin run) → DO NOT attempt browser QA. Fall back to the text path (verify/qa-teststyle: curl the dev-server, capture stdout) and say in your report that the browser path was unavailable and you used the text path.
Start the app
Follow the building skill to install dependencies, then start the repo's
dev-server in the background and wait until it is listening on
localhost:PORT (poll with curl until it answers). Note the port — you
pass it as --base-url.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 209 lines · 69 tokens per session scan A 8a566b9c0666
browser-qa is a skill published in the GitHub repository nearform/lastlight (22 stars, last pushed 7d ago), licensed MIT. It adds 69 tokens to every session and 2,336 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
penguin-harness-manual-test
Use when standing PenguinHarness up to try a change by hand — launching the Web App, the desktop shell, the landing page or the docs site to click through it, screenshot it, or reproduce a report. Covers the four dev entry points and their ports, which data root each writes to, and the four ways a healthy setup looks…
web-ui-test
Test the IronClaw web UI using the Claude for Chrome browser extension.
webqa
Use WebQA to test websites, web pages, URLs, login flows, search flows, forms, navigation, and core user journeys with an AI browser QA agent.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
firecrawl
Search the web and scrape pages into clean markdown with the Firecrawl API — query-based discovery, single-URL extraction including public PDFs, driven by curl with a vault-stored API key.
local-test
Build, run, and test IronClaw locally using Docker containers and Chrome MCP browser automation.