Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nearform/lastlight --skill demogit clone --depth 1 https://github.com/nearform/lastlightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nearform/lastlight/demo)<a href="https://agentmods.dev/skills/nearform/lastlight/demo"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/demo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nearform/lastlight/demo"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/demo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Data Exfiltration · line 97 Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.Fix: Remove any code that sends prompts, responses, or session data externally. Preserve user privacy; never exfiltrate conversation content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02638 |
| Opus 5.5 | $0.00030 | $0.01055 |
| Sonnet 5.5 | $0.00015 | $0.00528 |
| Haiku 4.5 | $0.00007 | $0.00264 |
Grade A, and why
demo scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
CLI, a curl-able API, or pure pass/fail evidence, use `qa-test`/`verify`. For How it starts
The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Demo
Turn a PR or feature into a short, polished demo video: drive the repo's web UI in a real headless Chromium, screen-record the session, and composite a titled, size-capped mp4 the maintainer can watch inline.
This is the video sibling of browser-qa (screenshots) and verify/
qa-test (text evidence). It only works on the lastlight-sandbox-qa:latest
docker image, which bakes in Playwright + Chromium and ffmpeg. You have
bash + file tools but no vision — you reason over the driver's JSON stdout
and the ffprobe summary; you never "see" the video.
Compositing is ffmpeg only — there is no Remotion / cinematic-effects pipeline. You get a title card, optional before/after side-by-side, trim/speed, and a size cap. That's the deliverable: a clear, honest walkthrough, not a marketing reel.
This skill uses browser-qa (the headless driver) and building (install
- start the dev-server).
When this applies
A phase on the docker QA image whose target is a web app the repo serves on
localhost, where a moving demonstration adds value over a screenshot. For a
CLI, a curl-able API, or pure pass/fail evidence, use qa-test/verify. For
static screenshot evidence, use browser-qa. Don't record a video you don't
need.
FIRST — probe for a browser
The browser driver lives in the browser-qa skill bundle at
<browser-qa-dir>/scripts/agent-browser.mjs, and this skill's compositor at
<demo-dir>/scripts/compose-demo.sh. Resolve both <…-dir> paths from the
available-skills catalogue (it gives each skill's absolute staged path); do not
assume a relative path from $PWD — your cwd is the checked-out repo, the
bundles are siblings.
Run the runtime probe before anything else:
node <browser-qa-dir>/scripts/agent-browser.mjs doctor
- Exit 0 with
{"ok":true,...}→ proceed. - Exit non-zero (lean image / gondolin / no Chromium) → DO NOT attempt a demo. Report that the demo path was unavailable on this host and stop. (The workflow gates this phase to the QA image, so this should be rare — but never fake a recording.)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 229 lines · 75 tokens per session scan A be0fbf8e8aef
demo is a skill published in the GitHub repository nearform/lastlight (41 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,638 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-automation
Drive the PenguinHarness agent browser — the desktop app's built-in browser or the user's own Chrome — from the shell with penguin browser: open pages, read them as simplified HTML or text, act with JavaScript and trusted clicks and typing, and pull structured data out of them (orders, search results, tables), signed…
firecrawl
Search the web and scrape pages into clean markdown with the Firecrawl API — query-based discovery, single-URL extraction including public PDFs, driven by curl with a vault-stored API key.
orca
Use when the user asks to run an Orca flow (e.g. "use orca to implement …"), or when delegating a well-defined implementation task to Orca's autonomous multi-agent flow — a headless plan-code-review CLI to hand a coding task to instead of implementing it yourself.
extension-dev
Detect Chrome extension framework/stack, find proper docs, implement features, and debug across service worker, content script, and popup contexts.
extension-analyze
Audit Chrome extensions for security issues, best practice violations, performance problems, and CWS compliance. Scans manifest, code, CSP, message handlers, storage, and dependencies.
extension-create
Auto-scaffold Chrome extensions with WXT or CRXJS. Ask user for name/features, scaffold, configure entrypoints. Use when: create extension, scaffold, new extension.