Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nrl-ai/chub --skill login-flowsgit clone --depth 1 https://github.com/nrl-ai/chubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nrl-ai/chub/login-flows)<a href="https://agentmods.dev/skills/nrl-ai/chub/login-flows"><img src="https://agentmods.dev/badge/skills/nrl-ai/chub/login-flows/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nrl-ai/chub/login-flows"><img src="https://agentmods.dev/badge/skills/nrl-ai/chub/login-flows.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.00686 |
| Opus 5 | $0.00007 | $0.00343 |
| Sonnet 5 | $0.00003 | $0.00137 |
| Haiku 4.5 | $0.00001 | $0.00069 |
Grade A, and why
login-flows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to login-flows — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Login Flow Patterns for Playwright
Reusable patterns for automating login flows in end-to-end tests.
Basic Username/Password Login
import { Page } from '@playwright/test';
async function login(page: Page, username: string, password: string) {
await page.goto('/login');
await page.fill('[name="username"]', username);
await page.fill('[name="password"]', password);
await page.click('button[type="submit"]');
await page.waitForURL('/dashboard');
}
OAuth / SSO Login
For OAuth flows that redirect to an external provider:
async function loginWithOAuth(page: Page) {
await page.goto('/login');
await page.click('text=Sign in with Google');
// Handle the OAuth popup or redirect
await page.fill('input[type="email"]', process.env.TEST_EMAIL!);
await page.click('text=Next');
await page.fill('input[type="password"]', process.env.TEST_PASSWORD!);
await page.click('text=Next');
// Wait for redirect back to app
await page.waitForURL('**/dashboard');
}
Persisting Auth State (storageState)
Avoid logging in before every test by saving and reusing browser state:
// global-setup.ts — runs once before all tests
import { chromium } from '@playwright/test';
async function globalSetup() {
const browser = await chromium.launch();
const page = await browser.newPage();
await page.goto('/login');
await page.fill('[name="username"]', 'testuser');
await page.fill('[name="password"]', 'testpass');
await page.click('button[type="submit"]');
await page.waitForURL('/dashboard');
// Save signed-in state
await page.context().storageState({ path: './auth.json' });
await browser.close();
}
export default globalSetup;
Then in playwright.config.ts:
export default defineConfig({
globalSetup: './global-setup.ts',
use: {
storageState: './auth.json',
},
});
MFA / 2FA Handling
For test environments with TOTP-based 2FA:
import { authenticator } from 'otplib';
async function loginWithMFA(page: Page, secret: string) {
await login(page, 'user', 'pass');
// Generate TOTP code
const code = authenticator.generate(secret);
await page.fill('[name="totp"]', code);
await page.click('button[type="submit"]');
await page.waitForURL('/dashboard');
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 109 lines · 14 tokens per session scan A 3eeca4af763e
login-flows is a skill published in the GitHub repository nrl-ai/chub (11 stars, last pushed 5mo ago), licensed MIT. It adds 14 tokens to every session and 686 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to login-flows, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
Cursor rules for JavaScript development with Chrome APIs integration
Skill "Cursor rules for JavaScript development with Chrome APIs integration" from AmariahAK/atlarix-skills, covering when to use this skill and source.
html-screenshot
Batch-screenshot HTML interactive prototype pages. Uses Playwright to open an HTML file, walk through pages, and save full-viewport screenshots. Fits Pencil design exports, HTML prototype documentation, UI page archival. Trigger words: screenshot HTML, prototype screenshots, batch capture pages.
playwright-recording
Record browser interactions as video using Playwright. Use for capturing demo videos, app walkthroughs, and UI flows for Remotion videos. Triggers include recording a demo, capturing browser video, screen recording a website, or creating walkthrough footage.
memstack-development-webapp-testing
Use when the user says 'write browser tests', 'test this page', 'playwright test', 'e2e test', 'end to end test', 'browser test', 'test the UI', or needs Playwright-based browser testing for a web application. Do NOT use for unit tests, API tests, or non-browser testing.
browser-use
An AI-driven browser automation tool that reads web pages, chooses actions, and carries out tasks from a natural-language description. Unlike a fixed script, it can make decisions while interacting with changing pages.
bb-browser
AI agent browser automation via CDP. Use when you need to access websites that require login, scrape data from platforms (Twitter/X, Reddit, GitHub, Xueqiu, Bilibili, etc.), bypass IP blocks, or fetch structured data from any site the user is logged into. Triggers: bb-browser, browser fetch, login required, scrape…